lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 26 Nov 2007 10:42:39 +0900
From: "HASEGAWA Yosuke" <yosuke.hasegawa@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: XSS with UTF-7 in yahoo.com

XSS with UTF-7 in yahoo.com

Abstract:
XSS with UTF-7 was found in yahoo.com (already fixed).
Although charset was specified in HTTP response header, but
charset-name was incorrect so XSS occurred.


PoC:
http://search.yahoo.com/search?p=%2BADw-/title%2BAD4-%2BADw-script%2BAD4-alert(document.cookie)%2BADw-/script%2BAD4-&fr=yfp-t-501&toggle=1&cop=mss&ei=UTF-8&eo=euc

Details:
The "euc" is specified for output charset with "eo" parameter,
so responded HTTP header from Yahoo is like as:
--
Content-Type: text/html; charset=EUC
--

"euc" is not registered as correct charset name for IE.
IE recognizes only charset names Hardocorded in MLang.dll
like as "EUC-JP", "EUC-KR", "UTF-8" and so on.

Therefore, an automatic detection function for encoding works,
and detect as "UTF-7".

Typical incorrect charset name in japanese web pages are followings:

utf8 - Idiomatic expression of "UTF-8" hyphen falls out.
euc - Idiomatic expression of "EUC-JP"
jis - Idiomatic expression of "ISO-2022-JP"
MS932 / MS932 / CP942C - Comparable encodings to Shift_JIS on Java
Windows-31J - IANA registered name for Codepage 932, but not
registered in Windows.

Status:
Nov 16 2007 reported to Yahoo and was fixed immediately.

-- 
HASEGAWA Yosuke
    yosuke.hasegawa@...il.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ