bugtraq - Re: Link Injection Redirection Attacks - Exploiting Google Chrome Design Flaw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 5 Jan 2010 10:49:07 -0800
From: Michal Zalewski <lcamtuf@...edump.cx>
To: Aditya K Sood <0kn0ck@...niche.org>
Cc: websecurity@...appsec.org, bugtraq@...urityfocus.com
Subject: Re: Link Injection Redirection Attacks - Exploiting Google Chrome 
	Design Flaw

Aditya,

> Video: http://www.secniche.org/videos/google_chrome_link_inj.html

You might find it informative to review the section of BSH on URL parsing:
http://code.google.com/p/browsersec/wiki/Part1#Uniform_Resource_Locators

There are many known quirks related to URL parsing; the practice of
certain browsers to tokenize the authority section using the rightmost
@ sign, in particular, is documented there. Three other spectacular
examples include:

http://example.com;.coredump.cx/ - MSIE will take you somewhere else
than most other browsers would
http://example.com\@coredump.cx/ - means one thing to most browsers,
something else to Firefox
https:example.com - absolute to Firefox (while http:example.com is a
relative link in that same browser)

In essence, any site that accepts, but does not normalize and rewrite
relative / not well formed URLs, and hopes to achieve any degree of
control over the destination of that link, is bound to fail. The
particular example in your video seems to be a clear case of
insufficient validation, and not a browser bug.

It is also unfortunate that URL parsing is deceptively difficult for
humans, but that's the way it is; address bar host name highlighting
and auto-hiding of credentials is the only sensible approach I can
think of; crippling URL syntax, on the other hand, seems heavy-handed.

/mz