- Jul 16, 2001
- 17,967
- 140
- 106
Text
The flaw is so serious that developers are warning users to completely uninstall Greasemonkey versions prior to 0.3.5.
Mark Pilgrim, an XML coder who helped to evangelize the extension with the free "Dive into Greasemonkey" e-book, has published working exploits to highlight the severity of the flaw.
"An attacker doesn't even need to know the exact filename," he said, noting that a certain exploit would return a parseable directory listing.
"In other words, running a Greasemonkey script on a site can expose the contents of every file on your local hard drive to that site," Pilgrim said.
The flaw is so serious that developers are warning users to completely uninstall Greasemonkey versions prior to 0.3.5.
Mark Pilgrim, an XML coder who helped to evangelize the extension with the free "Dive into Greasemonkey" e-book, has published working exploits to highlight the severity of the flaw.
"An attacker doesn't even need to know the exact filename," he said, noting that a certain exploit would return a parseable directory listing.
"In other words, running a Greasemonkey script on a site can expose the contents of every file on your local hard drive to that site," Pilgrim said.
Facebook
Twitter