full-disclosure - IE handling the HTML notes incorrectly may lead to XSS attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 8 Aug 2011 10:53:43 +0800
From: CnCxzSec衰仔 <cncxzhack@...il.com>
To: full-disclosure@...ts.grok.org.uk, secure@...rosoft.com
Subject: IE handling the HTML notes incorrectly may lead
	to XSS attacks

hi all, here is an interesting trick to perform an xss attack with IE
browsers.

some rich text applications such as email and blog, may provide HTML uses
but have a policy to block the on-event execution to prevent the XSS attack.
However, this applications may also allow the HTML notes uses,for instance
""

but..

code1(saved as poc1.html):
<!--<img/onerror=alert(1) src=]>

with code1, IE handles the "IMG tag" as an HTML note, and of course, IE will
not execute the onerror event.

code2(saved as poc2.html):
<!--[if<img/onerror=alert(1) src=]>

with code2, IE handles <img/onxxxxx as a real and valid HTML tag, and we can
see the alert js evaled!

IE can perform better webpages by using the css-hack trick <!--[if IE 6]>,
this XSS attack trick may be a derivative from this.

I really regard this as an IE vulnerability and suggest Microsoft to fix it.

thanks Sogili for offering me an XSS similar to this.

best regards!

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/