Chrome (and Safari) antiXSS filter bypass

["vulns () 11paths com" <vulns () 11paths com>]

Modern browsers usually have an antiXSS filter, that protects users from some of the consequences of this kind of 
attacks. Normally, they block cross site scripting execution, so the "injected" code (normally, JavaScript or HTML) is 
not executed inside victim's browser. Chrome calls this filter XSSAuditor.

But if the victim visits a website with an XSS problem that an attacker is trying to take advantage of, it would not be 
fully protected. This  bug  is  based  on  a  misuse  of  srcdoc  attribute  of  IFRAME tag,  included  in  HTML5 
definition.  To  perform an  XSS  attack  on Google  Chrome  Browser or Safari  using this  bug,  the website must  
include an IFRAME and must be able to read any attribute of this element from HTTP parameters (GET/POST) without 
applying any charset filter. Then, in the IFRAME parameter,  the  srcdoc  attribute  may be included with JavaScript  
code. The browser cannot filter it and will be executed.

An HTML injection on src parameter would be:

iframe src=""srcdoc="<script>alert('Bypass message')</script>"

For a proof of concept, visit:

 
http://demofaast.elevenpaths.com:9002/xssbypass/iframebypass.php?iframe=%22srcdoc=%22%3Cscript%3Ealert('Bypass%20message')%3C/script%3E

The problem was reported in October, the 23rd. They fixed it two days later, making XSSAuditor catch reflected srcdoc 
properties even without an "IFRAME" tag injection. Chrome has just fixed it in recent 32.0.1700.76 version.

Safari for Mac and iPhone is vulnerable as well.



This weakness has been discovered by Ioseba Palop from Eleven Paths (ioseba.palop () 11paths com<mailto:ioseba.palop () 
11paths com>). Full samples and detailed explanation here: 
http://blog.elevenpaths.com/2014/01/how-to-bypass-antixss-filter-in-chrome.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/