bugtraq - Re: <BASE> tag used for hijacking external resources (XSS)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJB2JzuTNxjzdiGOGUN5n7-w-piRzLCwjCFBZXwWfs40kvyz1Q@mail.gmail.com>
Date: Fri, 16 Dec 2011 22:12:10 +0100
From: Mario Vilas <mvilas@...il.com>
To: bugtraq@...urityfocus.com
Subject: Re: <BASE> tag used for hijacking external resources (XSS)

Makes sense as a trick to bypass some crappy XSS filters that look
forstrings like "javascript:", but I don't think it's a vulnerability
in itself.

On Fri, Dec 16, 2011 at 5:20 PM, Jann Horn <jannhorn@...glemail.com> wrote:
>
> 2011/12/15 Bouke van Laethem <vanlaethem@...il.com>:
> > ISSUE:
> > The <base> tag is parsed outside of <head></head>. This can lead to
> > the base being reset, both before and after the <base> tag being
> > injected, depending on browser types and versions. As a result, images
> > and javascript can be loaded from an attackers domain, and forms and
> > hyperlinks point to the attackers domain.
>
> Erm... so you're basically assumint that the attacker can inject stuff
> into the page? If that's the case, you should have other issues than
> your links getting altered or so, no? E.g. what about javascript
> injection?




--
“There's a reason we separate military and the police: one fights the
enemy of the state, the other serves and protects the people. When the
military becomes both, then the enemies of the state tend to become
the people.”