[Full-disclosure] XSS with UTF-7 in Google
- From: "HASEGAWA Yosuke" <yosuke.hasegawa@xxxxxxxxx>
- Date: Thu, 27 Dec 2007 23:52:57 +0900
XSS with UTF-7 in Google
XSS with UTF-7 was found in www.google.com (already fixed).
Although charset was specified in HTTP response header, but
charset-name was incorrect so XSS occurred.
The "cp932" is specified for output charset with "oe" parameter,
so responded HTTP header and <meta> in HTML from Google are like as:
Content-Type: text/html; charset=CP932
<meta http-equiv=content-type content="text/html; charset=CP932">
"cp932" is the similar name of the Shift_JIS encoding,
but it is not registered as correct charset name for IE.
IE recognizes only charset names hardocorded in MLang.dll
like as "Shift_JIS", "EUC-JP", "EUC-KR", "UTF-8" and so on.
Therefore, an automatic detection function for encoding works,
and detect as "UTF-7".
Typical incorrect charset name in japanese web pages are followings:
utf8 - Idiomatic expression of "UTF-8" hyphen falls out.
euc - Idiomatic expression of "EUC-JP"
jis - Idiomatic expression of "ISO-2022-JP"
MS932 / MS932 / CP942C - Comparable encodings to Shift_JIS on Java
Windows-31J - IANA registered name for Codepage 932, but not
registered in Windows.
Apr 17 2007
Reported to Google via IPA/ISEC <http://www.ipa.go.jp/security/index-e.html>
Dec 26 2007
Received reply it fixed from Google via IPA/ISEC.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Prev by Date: [Full-disclosure] usb shorting to ground
- Next by Date: Re: [Full-disclosure] New TV show "Tiger Team": social engineering, wired/wireless hacking, physical break-in
- Previous by thread: [Full-disclosure] usb shorting to ground
- Next by thread: [Full-disclosure] rIP BETA - reverse IP tool