There is a security vulnerability in Netscape Communicator 4.6 Win95, 4.07 Linux (and probably all 4.x versions) in the way it works with "view-source:wysiwyg://1/javascript" URLs. This security vulnerability exposes Netscape users to malicious attacks.
The security problem in Netscape Communicator arises when Communicator tries to parse a "view-source:wysiwyg://1/javascript" URL. While parsing this URL in a "view-source" window, the security context of the JavaScript is elevated to that of the view-source, making it possible for the JavaScript to access sensitive information.
The problem also consists of the fact documents are allowed to be included in the parent document via ILAYER SRC="view-source:wysiwyg://1/" using find().
This vulnerability allows an attacker to do the following:
* Browse local directories
* Read the user's cache
* Read parsed HTML files
* Read Netscape's configuration ("about:config") including user's email address, mail servers and the mail password.
This vulnerability may be exploited using HTML based email messages.
An easy workaround would be to disable JavaScript.
The source code for this demonstration follows:
<HTML>
<BODY>
This demonstration tries to find your email address, it may take some time.
<BR><BR>
<A HREF="http://www.nat.bg/~joro">Written by Georgi Guninski</A>
<HR>
<SCRIPT>
