[Full-disclosure] Apple Safari cross-domain XML theft vulnerability
- From: Chris Evans <scarybeasts@xxxxxxxxx>
- Date: Tue, 9 Jun 2009 14:14:05 -0700
Safari prior to version 4 may permit an evil web page to steal
arbitrary XML data cross-domain.
This is accomplished by abusing a relatively obscure cross-domain
access point which was completely missing a cross-domain access check.
The access point in question is the document() function in XSL. This
is best illustrated with a sample evil XSL file which abuses this
Below, you should see e-mail stolen cross-domain!
To mount the attack, the attacker would serve a web page which has XML
MIME type and requests to be styled by the evil stylesheet:
<?xml version="1.0" encoding="ISO-8859-1"?>
<?xml-stylesheet type="text/xsl" href="safaristealmailbug.xsl"?>
There are a number of interesting XML-based formats you might want to
steal including authenticated RSS, XML-formatted AJAX-y responses, and
Full technical details: http://scary.beasts.org/security/CESA-2009-008.html
Blog post: http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-also-fixes-cross-domain.html
(includes 1-click demo)
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Prev by Date: [Full-disclosure] TELUS Security Labs VR - Microsoft Office Excel Malformed Records Stack Buffer Overflow
- Next by Date: [Full-disclosure] CORE-2009-0521 - DX Studio Player Firefox plug-in command injection
- Previous by thread: [Full-disclosure] TELUS Security Labs VR - Microsoft Office Excel Malformed Records Stack Buffer Overflow
- Next by thread: [Full-disclosure] CORE-2009-0521 - DX Studio Player Firefox plug-in command injection