CVE-2006-3280

published 2006-06-28

CVE-2006-3280: Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag…

Priority P3 36 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, aka "Redirect Cross-Domain Information Disclosure Vulnerability."

Affected

11 ranges

Vendor	Product	Version range	Fixed in
advanced_search_technologies_inc	enigma_browser	—	—
fast_browser	fast_browser	—	—
flashpeak	slim_browser	—	—
gosurf_browser	gosurf_browser	—	—
maxthon	maxthon	—	—
microsoft	internet_explorer	—	—
more_quick_tools	greenbrowser	—	—
myweb4net	myweb4net_browser	—	—
netcaptor	netcaptor	—	—
phaseout	phaseout	—	—
softinform	finebrowser	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename i.html↗

filename r.php↗

command setTimeout('alert(o.object.documentElement.outerHTML)',1000)↗

• → Look for HTML pages using an <object> tag with a 'data' parameter pointing to an attacker-controlled redirect (e.g., r.php) that issues a Location HTTP header to a cross-domain target, combined with outerHTML access in JavaScript. ↗
• → Detect JavaScript use of 'documentElement.outerHTML' on an embedded object element, which is the mechanism used to exfiltrate cross-domain page content in this exploit. ↗
• → Monitor for HTTP responses from attacker-controlled servers that issue a Location redirect header pointing to a third-party/target domain, where the initial request originated from an <object data=...> tag load. ↗

• · The proof-of-concept exploit is described as incomplete; it demonstrates feasibility but may not be a fully weaponized payload. ↗
• · The vulnerability was confirmed on a specific platform (Windows Server 2003 Enterprise Edition SP1); detection rules should account for the fact that exploitation context is tied to Internet Explorer's cross-domain policy enforcement. ↗
• · A similar variant of this cross-domain outerHTML vulnerability also affects Slim Browser 4.07 build 100, so detection logic should not be scoped exclusively to Internet Explorer. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.