Mozilla Firefox Image Javascript URI Dragging Cross-Site Scripting

TITLE:
Mozilla Firefox Image Javascript URI Dragging Cross-Site Scripting

SECUNIA ADVISORY ID:
SA14406

VERIFY ADVISORY:
http://secunia.com/advisories/14406/

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting

WHERE:
>From remote

SOFTWARE:
Mozilla Firefox 0.x
http://secunia.com/product/3256/
Mozilla Firefox 1.x
http://secunia.com/product/4227/

DESCRIPTION:
Paul has reported a vulnerability in Mozilla Firefox, which can be
exploited by malicious people to conduct cross-site scripting
attacks.

The vulnerability is caused due to missing URI handler validation
when dragging an image with a "javascript:" URL to the address bar.
This can be exploited to execute arbitrary HTML and script code in a
user's browser session in context of an arbitrary site by tricking a
user into dragging an image to the address bar.

This is similar to vulnerability 2 in:
SA14160

The vulnerability has been reported in version 1.0 and 1.0.1. Other
versions may also be affected.

SOLUTION:
Do not drag images to the address bar.

PROVIDED AND/OR DISCOVERED BY:
Paul (greyhats)

OTHER REFERENCES:
SA14160:
http://secunia.com/advisories/14160/

 

Why would anyone want to drag images in the address bar?

 

Beats the heck out of me, and nothing I have ever seen done...

 

Emphasis mine. The only time I've tried it the address window showed "javascript.void(0) ".