lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
From: rivgi at finjan.com (Rafel Ivgi, The-Insider)
Subject: Hotmail Cross-Site Scripting Vulnerability #1

Finjan Security Advisory
=================
Hotmail Cross-Site Scripting Vulnerability


Introduction
------------
Finjan has discovered a script injection vulnerability in
Hotmail that allows a remote attacker to execute malicious
scripts when the victim is reading his/her mail.


Technical Description
---------------------
Hotmail?s mobile code filtering mechanism is based on an active
content filter whose purpose is to block the injection of any
active content into Hotmail messages. Hotmail?s filter identifies
any possibly malicious HTML tags, properties and elements,
and then modifies them into a non-malicious code.

When analyzing an HTML condition comment tag 
(for example: ?<![if IE gte 4]>?), Hotmail?s filter changes it to
a comment (e.g. ?<! [if IE gte 4]>?). A space character is added
after the ?!?, making the code inside the condition be treated as
a comment rather than as an executable. Any potentially malicious
code inside the condition is not altered.

For example: 
<! [if IE gte 4]><style>@\im\port'\ja\vasc\ript:alert()';</style>

In order to bypass this protection, a comment tag can be added before
the condition tag.

For example: 
<!--   <![if IE gte 4]><style>@\im\port'\ja\vasc\ript:alert()';</style>

At this stage the code is harmless since Internet browsers treat
this script as an HTML comment. However, a possible risk arises
when an HTML condition comment tag opener (?<!?) is inserted at
the beginning of the code.

For example: 
<! <!--   <![if IE gte 4]><style>@\im\port'\ja\vasc\ript:alert()';</style>

Since Hotmail?s HTML filter treats this code as a comment, it does
not filter out the script. In contrast, Internet browsers do not
treat this script as a comment, but rather execute the code inside
the condition tag. In this manner, any tag that supports style,
events or javascript execution can be used to remotely call a javascript file.

The injected javascript code could be used for:
? Automatically launching malicious code 
? Stealing the victim?s password by using a spoofed re-login window
? Reading the victim?s inbox and contacts
? Sending email messages without any user authorization.


The Code (Proof of Concept)
----------------------cut here-----------------------
<!
<!--   
<![if IE gte 4]><style>@\im\port'\ja\vasc\ript:alert()';</style>
----------------------cut here-----------------------


Vulnerability Status 
--------------------
Vendor was notified on Sep 8th, 2004.
The bug is now fixed.


Credit 
------
Rafel Ivgi, Malicious Code Research Center (MCRC), Finjan Software Ltd.
-----------------------------------------------
This message was scanned for malicious content and viruses by Finjan Internet Vital Security 1Box(tm)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041214/8eef15c4/attachment.html

Powered by blists - more mailing lists