Onderwerp: Cross-Site Scripting in Unparsable XML Files (GM#013-IE)

GreyMagic Security Advisory GM#013-IE
=====================================

By GreyMagic Software, Israel.
17 Jun 2003.

Available in HTML format at http://security.greymagic.com/adv/gm013-ie/.

Topic: Cross-Site Scripting in Unparsable XML Files.

Discovery date: 18 Feb 2003.

Affected applications:
======================

Microsoft Internet Explorer 5.5 and 6.0.

Note that any other application that uses Internet Explorer's engine
(WebBrowser control) is affected as well (AOL Browser, MSN Explorer, etc.).


Introduction:
=============

Internet Explorer automatically attempts to parse any XML file requested
individually by the browser. When the parsing process is successful, a
dynamic tree of the various XML elements is presented. However, when a
parsing error occurs Internet Explorer displays the parse error along with
the URL of the requested XML file.


Discussion:
===========

We have found that in some cases the displayed URL is not filtered
appropriately, and may cause HTML that was passed in the querystring of the
URL to be rendered by the browser. This creates a classic cross-site
scripting attack in almost any XML file that MSXML fails to read.
Practically, this means that leaving XML files on your server that can't be
parsed correctly by Internet Explorer and MSXML is exposing the site to a
global Cross-Site Scripting attack.

We have been able to reproduce this problem in various setups, but we
couldn't pinpoint the vulnerable component reliably enough. It is most
likely an MSXML issue, and not a flaw in Internet Explorer itself.


Exploit:
========

This sample shows the basic URL for injecting content:

http://host.with.unparsable.xml.file/flaw.xml?<script>alert(document.cookie)
</script>


Demonstration:
==============

We put together a simple proof of concept demonstration, which can be found
at http://security.greymagic.com/adv/gm013-ie/.


Solution:
=========

Microsoft was notified on 20-Feb-2003. They reported that they were able to
reproduce this flaw on IE6 Gold, and no other version. Our research showed
different, yet inconsistent results (see "Tested on" section for details).


Tested on:
==========

IE5.5 NT4.
IE6 Win98.
IE6 Win2000.


Disclaimer:
===========

The information in this advisory and any of its demonstrations is provided
"as is" without warranty of any kind.

GreyMagic Software is not liable for any direct or indirect damages caused
as a result of using the information or demonstrations provided in any part
of this advisory.


Feedback:
=========

Please mail any questions or comments to security@greymagic.com.

- Copyright © 2003 GreyMagic Software.

Hello,

On Tue, 17 Jun 2003 10:09:51 "GMT"
GreyMagic Software <security@greymagic.com> wrote:

> GreyMagic Security Advisory GM#013-IE
> =====================================
>
....
>
> Topic: Cross-Site Scripting in Unparsable XML Files.
>
> Discovery date: 18 Feb 2003.

I also reported this to Microsoft - sometime around May or June 2002. In the exchange of emails I had with them, they confirmed that it was indeed due to the MSXML parser. I'd tested the flaw on IE 5 and 5.5 (Win2k.) I do remember that MS said they would
fix it in a service pack - although they didn't specify whether it was an IE service pack or Win2k (one would assume Win2k as MSXML isn't a part of IE? Not sure about that).

Several Application Server default installs leave files visible which can be used to exploit this bug (e.g. Oracle 9iAS 9.0.2 has several .dtd files visible which can be used to cause the MSXML parser to generate the error page).

I copied Steve Christey at Mitre on a couple of the emails to MS so this may already have a CAN entry. (Hello Steve)

Over the course of at least four months I exchanged several emails with someone called 'Terry' from the MS Security Response Centre. However, I never got any definitive answer as to whether the problem was fixed or not.

Obviously not.

regards,

Matt

--
Matt Moore <matt.moore (at) pentest-limited.com>
E073 2975 0D69 B250 C225
A03E 30A8 AE27 A4F7 2A8A

Matt Moore said:

>I also reported this to Microsoft - sometime around May or June
>2002... I copied Steve Christey at Mitre on a couple of the emails

I can confirm that on July 19, 2002, Matt CC'ed me on an email to the
Microsoft Security Response Center in which Matt asked about when his
reported issue would be fixed. Included in that email was a trail of
other messages dating back to his original notification of June 25,
2002, with a subject of "Potential Cross Site Scripting Flaw in
Internet Explorer XML Parser".

Matt's original email includes the following:

... it's possible to perform XSS attacks against IE clients of a web
server that has a malformed XML document residing on it.

... The XML parser in IE should sanitise any resource names it
includes in it's error messages. It appears that various [sic] of
the IE XML parser error pages are vulnerable to this.

>this may already have a CAN entry.

For disclosures in which the vendor actively uses CVE identifiers,
such as Microsoft, our general approach is to encourage the researcher
to obtain a CVE name through the vendor. This reduces the risk of
accidental duplication and errors in assigning CVE names, e.g. if
multiple researchers find the same issue, or if researchers find the
"symptoms" of a larger problem.

We do follow the "30-day" disclosure guideline and provide a CAN to
the researcher if they want to publicize an issue after 30 days, but
in this case Matt did not release, so a CAN was not assigned until
this issue was publicized by GreyMagic (CAN-2003-0446).


Steve Christey
CVE Editor