bugtraq - Cross-Site Scripting vulnerability in Mozilla, Firefox and Chrome

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 15 Jul 2009 19:32:08 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <bugtraq@...urityfocus.com>
Subject: Cross-Site Scripting vulnerability in Mozilla, Firefox and Chrome

Hello SecurityFocus!

I want to warn you about Cross-Site Scripting vulnerability in Mozilla,
Firefox and Chrome.

Some time ago Mozilla fixed vulnerability in Firefox described in MFSA
2009-22 (http://www.mozilla.org/security/announce/2009/mfsa2009-22.html).
Which allowed Refresh header to redirect to javascript: URIs.

This vulnerability was fixed in Firefox 3.0.9. And recently, 06.07.2009, I
found possibility to bypass this protection in Firefox. Also this method of
XSS attacks works in Mozilla (1.7.x) and Chrome.

To bypass protection from JavaScript code execution via refresh header it's
needed to use data: URI, which will be containing requisite JS code. This
method of conducting of XSS attacks via meta-refresh tag is already known -
it was in XSS Cheat Sheet (http://ha.ckers.org/xss.html) already in 2006
year. And I used it to bypass protection in Firefox and to conduct attacks
via refresh-header redirectors.

XSS:

Meta-refresh tag and refresh header attack vectors:

<meta http-equiv="refresh"
content="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ+">

With request to script at web site:

http://site/script.php?param=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2b

Which returns in answer the refresh header and the code will execute in the
browser:

refresh: 0;
URL=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2b

Via data: it's possible to bypass in Firefox 3.0.9 and higher (I tested in
3.0.11) prohibition on JavaScript code execution in refresh header. But in
Firefox 3.0.11 and Google Chrome you can't get to cookies this way, but it's
possible in old Mozilla (and in those versions of Firefox where there is
relation between data: page and original page).

Vulnerable version is Mozilla 1.7.x and previous versions.

Vulnerable version is Mozilla Firefox 3.0.11 and previous versions (and 3.5
should be also vulnerable).

Vulnerable version is Google Chrome 1.0.154.48 and previous versions (and
potentially next versions too).

I mentioned about this vulnerability at my site
(http://websecurity.com.ua/3315/).

P.S.

After I informed Mozilla, they declined to fix this vulnerability. Thus
allowing to execute JavaScript code in their browsers (particularly for
malware spreading) on all refresh-header redirectors, which there are a lot
in Internet.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

!DSPAM:4a5e0423317718290892692!