# Mozilla Firefox <= 1.0.4 "Set As Wallpaper" Code Execution Exploit // Exploit by Michael Krax
Firewalling - Proof-of-Concept
The "Set As Wallpaper" dialog takes the image url as a parameter without validating it. This allows to execute javascript in chrome and to run arbitrary code.
By using absolute positioning and the moz-opacity filter an attacker can easily fool the user to think he is setting a valid image as wallpaper.
Right click on the image and choose "Set As Wallpaper". The demo requests UniversalXPConnect rights, creates c:\booom.bat and launches the batch file that shows a directoy listing in a dos box (Windows only).
# milw0rm.com [2005-07-13]