Re: [Full-disclosure] IE handling the HTML notes incorrectly may lead to XSS attacks



a good example to see the "incorrect handling":
<!--[if<img/onerror=alert(1) src=]> //executed.
<!--[i<img/onerror=alert(1) src=]> //not executed.


On Mon, Aug 8, 2011 at 2:23 PM, Christian Sciberras <uuf6429@xxxxxxxxx>wrote:

I think it's worth to note that MSIE expects an *expression* in the
conditional (it's a feature).
Hence even if you disable direct XSS, there still would probably be
more ways an *expression* could be used to write HTML code.

As such, I don't think they should be "fixing" this (since it is
intended), but rather warn developers about it's existence.

On the other hand, if developers are writing unfiltered HTML inside
this conditional, I think there are worse issues than this.
I've always believed in the philosophy of making browsers work as
expected instead of expecting them to comply and fix my issues.
Especially if the browser in question is Internet Explorer ;-).

Cheers,
Chris.



On Mon, Aug 8, 2011 at 5:59 AM, CnCxzSec衰仔 <cncxzhack@xxxxxxxxx> wrote:
this is a normal use, but <!--[if<img/onerror=alert(1) src=]> is an
unnormal
use. IE should regard this as an HTML comment instead of a
downlevel-hidden
comment, so the HTML tags inside the COMMENT should not be evaled.
On Mon, Aug 8, 2011 at 11:30 AM, Andrew Farmer <andfarm@xxxxxxxxx>
wrote:

On 2011-08-07, at 19:53, CnCxzSec衰仔 wrote:
hi all, here is an interesting trick to perform an xss attack with IE
browsers.

some rich text applications such as email and blog, may provide HTML
uses
but have a policy to block the on-event execution to prevent the XSS
attack.
However, this applications may also allow the HTML notes uses,for
instance
"<!-- -->"

Any such applications are likely to also be vulnerable to a simpler
attack
based on "downlevel-hidden" conditional comments:

<!--[if IE]>
<script>anything you want can go here, presumably</script>
<![endif]-->

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/