CVE-2006-6991 in Fast Browser
Summary
by MITRE
Cross-domain vulnerability in Fast Browser Pro 8.1 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker s originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2017
This vulnerability exists in Fast Browser Pro version 8.1 and represents a cross-domain access flaw that enables remote attackers to bypass security restrictions between different web domains. The vulnerability exploits the browser's handling of object tags and HTTP headers to create a pathway for unauthorized information disclosure. The attack vector specifically involves an object tag with a data parameter that references a malicious link on the attacker's originating site, which then uses a Location HTTP header to point to the target site. This technique leverages the browser's trust model and fails to properly validate cross-domain requests, creating a security gap that allows sensitive data to be accessed from restricted domains.
The technical implementation of this vulnerability relies on the browser's processing of the outerHTML attribute within object tags. When the browser encounters an object tag with a data parameter referencing an attacker-controlled URL, it follows the Location HTTP header directive to fetch content from the target domain. The browser then makes this content available through the outerHTML attribute, effectively exposing information that should be restricted to the originating domain. This behavior violates fundamental web security principles and demonstrates a failure in cross-origin resource sharing controls. The vulnerability shares similarities with CVE-2006-3280, indicating a pattern of implementation flaws in how browsers handle cross-domain object references and HTTP header processing.
The operational impact of this vulnerability is significant as it allows attackers to access restricted information from other domains without proper authentication or authorization. This could potentially expose sensitive data including user credentials, personal information, or corporate data that should be protected by cross-domain security policies. The attack requires minimal user interaction beyond visiting a malicious webpage, making it particularly dangerous in phishing scenarios or when exploited through compromised websites. Security researchers have identified this as a type of cross-site scripting or cross-domain information leakage vulnerability that undermines the browser's security model.
This vulnerability aligns with CWE-200, which addresses improper restriction of information exposure, and represents a failure in proper access control implementation. The attack pattern follows techniques described in the ATT&CK framework under T1071.004 for application layer protocol manipulation and T1566 for phishing attacks. The flaw demonstrates a critical weakness in the browser's handling of HTTP headers and object tag processing, particularly in how it manages cross-domain requests through the outerHTML attribute. Organizations should implement immediate mitigations including browser updates, network-level restrictions, and proper configuration of security headers to prevent exploitation of this vulnerability. The vulnerability highlights the importance of proper input validation and cross-origin resource sharing controls in preventing unauthorized information disclosure through browser-based attacks.