CVE-2003-0816

published 2004-02-03

CVE-2003-0816: Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing…

Priority P4 33 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
microsoft	ie	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21199.zip↗

command window.open("http://wrong_site_add/","_search")↗

command window.open('file:javascript:document.write("' + inject_html + '")','_search');↗

command window.open("file:javascript:alert(document.cookie);","_search")↗

• → Detect use of NavigateAndFind method to load a file: URL containing Javascript (PoC: NAFfileJPU) ↗
• → Detect use of window.open method to load a file: URL containing Javascript targeting the _search window (PoC: WsOpenFileJPU) ↗
• → Detect manipulation of the href property in the base tag for the _search window as a cross-zone bypass vector (PoC: WsBASEjpu) ↗
• → Detect loading of the search window into an Iframe as a cross-zone bypass (PoC: WsFakeSrc) ↗
• → Detect caching of javascript: URLs in browser history then accessing them in the same frame as a target domain (PoCs: WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, RefBack) ↗
• → Monitor for file:javascript: scheme combinations passed to window.open targeting the _search window, indicative of cross-zone scripting exploitation ↗
• → Monitor for document.cookie access via file:javascript: URLs loaded into the _search pane, indicating cross-zone cookie theft ↗

• · Vulnerability affects Internet Explorer 6 SP1 and earlier; patched versions are not affected ↗
• · The exploit PoC relies on a 5-second setTimeout delay before injecting into the _search pane; detection logic should account for deferred execution patterns ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.