# Flash local-with-fileaccess Sandbox Bypass

Flash local-with-fileaccess sandbox bypassed via ignored file:// URI characters and a decoder script, letting an attacker read arbitrary local and cross-origin files.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: staatseigendom
- Disclosed: 2014-04-17
- CVE: CVE-2014-0508
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2140
- Library page: https://bugbountylibrary.com/r/h1%3A2140
- Tags: area:os domain:browser impact:data-leak kind:bounty platform:hackerone sev:high tech:chromium technique:chained technique:source-review vuln:access-control vuln:info-disclosure

**Target:** Flash applet in browser local-with-fileaccess sandbox
**Root cause:** Flash mishandles ignored characters in file:// URIs, allowing navigation to a decoder page that reads local files and passes data to the parent page, escaping the local-with-fileaccess sandbox.
**Steps:**
1. Load PoC flash applet in mode 2 to determine file content length via flashvars.
2. Determine max leak space (Chrome ~260 bytes) and divide by 8 bits to get chars per transmission.
3. Compute number of transmissions needed for the whole file.
4. Walk the file in chunks, appending each requested part to variable 'total' via the iframe applet.
5. Pass data through localstorage to poc.html; reset iframe on receipt.
6. For remote files: auto-click `<a download>` to save to predictable download path, then read it via the sandbox bypass.
**How found:** Researcher observed Flash's handling of ignored characters in file:// URIs and hypothesized navigation to a decoder script could escape the local sandbox; built a chunked length-then-content reader to test.
**Exploitation:** Attacker hosts a page with the Flash applet; victim visits it, applet reads local files (or remote files downloaded to a predictable path) and exfiltrates content to the parent page, enabling theft of webmail feeds and XSRF tokens.
**Escalation:** Chaining arbitrary remote file download to a predictable location with the local file read expands impact to cross-origin authenticated data theft.
**Insight:** Ignored/encoded characters in file:// URIs can defeat Flash's local sandbox origin checks; chunked length-probing plus localstorage relay lets you exfiltrate files past small per-transmission limits.