Re: Possible XSS issue on Windows XPSP2 IE6 via MIME Encapsulation of Aggregate HTML

[3APA3A <3APA3A () SECURITY NNOV RU>]

Dear bitlance winter,

Using  MHTML  to  bypass  content  filtering  for scripting was at least
reported  here  by  offtopic as well as few more tricks. You may want to
read this:

offtopic, 3APA3A. Bypassing client application protection techniques
http://www.security.nnov.ru/advisories/bypassing.asp

and this

3APA3A. Bypassing content filtering whitepaper
http://www.security.nnov.ru/advisories/content.asp

--Monday, February 28, 2005, 6:11:31 PM, you wrote to full-disclosure () lists netsys com:

bw> Hi, LIST.

bw> ========
bw> subject:
bw> ========
bw> Possible XSS issue on Windows XPSP2 IE6 via MIME Encapsulation of Aggregate
bw> HTML Documents

bw> ========
bw> NOTE:
bw> ========
bw> This bug had been provided by an unknown person on his site.
bw> This bug is widely known in Japan since August, 2004.
bw> (These news was reported.)
bw> Now his site is closed.
bw> Some engineers prevented this bug. They are maintaining Web services.
bw> Wiki, Webmail, Blog, BBS, those might be dangerous.

bw> ========
bw> First:
bw> ========

bw> I want to show the following first. Please checkout using IE on XPSP2.

bw> The cat is here.
bw> http://freehost02.websamba.com/bitlance/mhtmlbug/scriptkitty.jpg

bw> And the cat is a script kitty.
bw> mhtml:http://freehost02.websamba.com/bitlance/mhtmlbug/scriptkitty.jpg

bw> You see? executing JavaScript? Ok.
bw> If you are using old IE or Windows, try this one.
bw> mhtml:http://freehost02.websamba.com/bitlance/mhtmlbug/scriptkitty.jpg.mhtml

bw> Confirmed?

bw> ========
bw> Second:
bw> ========

bw> What is happen to us?
bw> Please checkout.
bw> http://dsv.su.se/jpalme/ietf/mhtml-test/mhtml-3.txt
bw> or same file,
bw> http://freehost02.websamba.com/bitlance/mhtmlbug/q1.txt

bw> This is a test messages which demonstrate of sending e-mail
bw> in HTML format according to RFC 2557.

bw> And check out please.
bw> mhtml:http://dsv.su.se/jpalme/ietf/mhtml-test/mhtml-3.txt
bw> or same file,
bw> mhtml:http://freehost02.websamba.com/bitlance/mhtmlbug/q1.txt


bw> ========
bw> Third:
bw> ========

bw> Then we can change Content-Transfer-Encoding:
bw> from '7bit' to 'quoted-printable'.
bw> Checkout please.
bw> http://freehost02.websamba.com/bitlance/mhtmlbug/q2.txt


bw> - ----- q2.txt ------
bw> Content-Type: text/html; charset=us-ascii
bw> Content-Transfer-Encoding: quoted-printable

bw> =3C!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"=3E
bw> =3CHTML=3E
bw> =3CHEAD=3E=3CTITLE=3ETest message no. 3=3C/TITLE=3E
bw> =3C/HEAD=3E
bw> =3CBODY=3E
bw> =3CH1=3EThis is test message no. 3=3C/H1=3E

bw> =3CH2=3EHere comes the red test image:=3C/H2=3E
bw> =3CIMG
bw> SRC=3D"http://www.dsv.su.se/jpalme/mimetest/red-test-image.gif";
bw> BORDER=3D0 HEIGHT=3D32 WIDTH=3D117
bw> ALT=3D"red test image"=3E

bw> =3CH2=3EHere comes the yellow test image:=3C/H2=3E
bw> =3CIMG
bw> SRC=3D"http://www.dsv.su.se/jpalme/mimetest/yellow-test-image.gif";
bw> BORDER=3D0 HEIGHT=3D32 WIDTH=3D152
bw> ALT=3D"yellow test image"=3E

bw> =3CP=3EThis is the last line of this test message.
bw> =3C/BODY=3E=3C/HTML=3E
bw> - ----- q2.txt ------

bw> Where is HTML TAG?
bw> Do you know how to sanitise?
bw> mhtml:http://freehost02.websamba.com/bitlance/mhtmlbug/q2.txt

bw> The malicious code would be inserted by a malicious user,
bw> on Blog, Wiki, BBS with fileuploader ,etc.
bw> JPEG file or Gif file are also poisoned.

bw> There is possible XSS issue on Windows XPSP2 IE6 via MHTML.

bw> ========
bw> Reference:
bw> ========

bw> Using HTML in E-mail
bw> http://www.dsv.su.se/jpalme/ietf/mhtml.html

bw> MIME Encapsulation of Aggregate HTML Documents (MHTML)
bw> 
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cdosys/html/_cdosys_mime_encapsulation_of_aggregate_html_documents_mhtml_.asp

bw> RFC 2045 - Multipurpose Internet Mail Extensions (MIME) Part One: Format of
bw> Internet Message Bodies
bw> http://www.faqs.org/rfcs/rfc2045.html

bw> ===========

bw> Sorry my bad English.
bw> Best Regards.

bw> ===========
bw> --
bw> bitlance winter

bw> _________________________________________________________________
bw> Don’t just search. Find. Check out the new MSN Search! 
bw> http://search.msn.click-url.com/go/onm00200636ave/direct/01/

bw> _______________________________________________
bw> Full-Disclosure - We believe in it.
bw> Charter: http://lists.netsys.com/full-disclosure-charter.html


-- 
~/ZARAZA
Стреляя во второй раз, он искалечил постороннего. Посторонним был я. (Твен)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html