[NEWS] Hotmail Cross Site Scripting Vulnerability (Malformed Tags)
From: SecuriTeam (support_at_securiteam.com)
To: email@example.com Date: 20 Dec 2004 18:38:27 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
Hotmail Cross Site Scripting Vulnerability (Malformed Tags)
Finjan has discovered a script injection vulnerability in Hotmail that
allows a remote attacker to execute malicious scripts when the victim is
reading his/her email, this is due to Hotmail's inability to process
correctly malformed HTML tags and make the script embedded inside them
Hotmail's mobile code filtering mechanism is based on an active content
filter whose purpose is to block the injection of any active content into
Hotmail messages. Hotmail's filter identifies any possibly malicious HTML
tags, properties and elements, and then modifies them into a non-malicious
When receiving an email, Hotmail's filtering engine analyzes and filters
the HTML event properties inside the email s HTML tags. Hotmail's filter
identifies the dangerous event properties and renames them to x +event,
thereby alters their original functionality.
< img onmouseover=alert()></img>
is renamed to:
< img xonmouseover=alert()></img>
While the filter analyzes the data, it does not inspect all content after
the = and before the next property. This means that in the example above,
the alert() code will not be inspected and filtered. This can be exploited
by creating a malformed HTML tag which will fake a property and then
execute an event property.
The malformed request must have the following syntax:
< [anytag] [anychar/word]=[anychar from ascii 1-8 or 14-31)] [event
< img MCRC= onmouseover=alert()>
All the data after the =[special char][space] tag is considered by
Hotmail's filter to be the data inside the fake tag, and it is therefore
not inspected. Internet browsers however, execute this as a valid code.
ANY tag/object that supports HTML events can be used to remotely call a
* Automatically launching malicious code
* Stealing the victim s password by using a spoofed re-login window
* Reading the victim s INBOX and contacts
* Sending email messages without any user authorization
Proof Of Concept:
< img src= http://www.finjan.com/images/logo.gif MCRC= onmouseover=alert(
Vendor was notified on Sep 8th, 2004. The bug is now fixed.
The information has been provided by <mailto:firstname.lastname@example.org> Rafel
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: email@example.com
In order to subscribe to the mailing list, simply forward this email to: firstname.lastname@example.org
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.