Bugtraq mailing list archives
Cross-Site Scripting vulnerability in Mozilla, Firefox and Chrome
From: "MustLive" <mustlive () websecurity com ua>
Date: Wed, 15 Jul 2009 19:32:08 +0300
Hello SecurityFocus! I want to warn you about Cross-Site Scripting vulnerability in Mozilla, Firefox and Chrome. Some time ago Mozilla fixed vulnerability in Firefox described in MFSA 2009-22 (http://www.mozilla.org/security/announce/2009/mfsa2009-22.html). Which allowed Refresh header to redirect to javascript: URIs. This vulnerability was fixed in Firefox 3.0.9. And recently, 06.07.2009, I found possibility to bypass this protection in Firefox. Also this method of XSS attacks works in Mozilla (1.7.x) and Chrome. To bypass protection from JavaScript code execution via refresh header it's needed to use data: URI, which will be containing requisite JS code. This method of conducting of XSS attacks via meta-refresh tag is already known - it was in XSS Cheat Sheet (http://ha.ckers.org/xss.html) already in 2006 year. And I used it to bypass protection in Firefox and to conduct attacks via refresh-header redirectors. XSS: Meta-refresh tag and refresh header attack vectors: <meta http-equiv="refresh" content="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ+"> With request to script at web site: http://site/script.php?param=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2b Which returns in answer the refresh header and the code will execute in the browser: refresh: 0; URL=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2b Via data: it's possible to bypass in Firefox 3.0.9 and higher (I tested in 3.0.11) prohibition on JavaScript code execution in refresh header. But in Firefox 3.0.11 and Google Chrome you can't get to cookies this way, but it's possible in old Mozilla (and in those versions of Firefox where there is relation between data: page and original page). Vulnerable version is Mozilla 1.7.x and previous versions. Vulnerable version is Mozilla Firefox 3.0.11 and previous versions (and 3.5 should be also vulnerable). Vulnerable version is Google Chrome 1.0.154.48 and previous versions (and potentially next versions too). I mentioned about this vulnerability at my site (http://websecurity.com.ua/3315/). P.S. After I informed Mozilla, they declined to fix this vulnerability. Thus allowing to execute JavaScript code in their browsers (particularly for malware spreading) on all refresh-header redirectors, which there are a lot in Internet. Best wishes & regards, MustLive Administrator of Websecurity web sitehttp://websecurity.com.ua
!DSPAM:4a5e0423317718290892692!
Current thread:
- Cross-Site Scripting vulnerability in Mozilla, Firefox and Chrome MustLive (Jul 15)
- Re: Cross-Site Scripting vulnerability in Mozilla, Firefox and Chrome Michal Zalewski (Jul 15)
- Re: Cross-Site Scripting vulnerability in Mozilla, Firefox and Chrome MustLive (Jul 27)
- <Possible follow-ups>
- Re: Cross-Site Scripting vulnerability in Mozilla, Firefox and Chrome advisories (Jul 16)
- Re: Cross-Site Scripting vulnerability in Mozilla, Firefox and Chrome MustLive (Jul 28)
- Re: Cross-Site Scripting vulnerability in Mozilla, Firefox and Chrome Michal Zalewski (Jul 15)