[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-Disclosure] Global *.net XSS, thank you Verisign(TM)

Richard M. Smith wrote: 
VeriSign should fix their bug, but I don't see the danger of a
cross-site scripting error at a non-existent domain.  The scripting code
can't really do anything at the Web site........


Indeed, but it is exploitable in some cases where the user is using an http proxy, since there are 2 url parsers involved. If anyone remembers the rather neat Analog-X/IE Global XSS you can probably find the same issue with almost any proxy.

I've not tested, but.... the Analog-X URL parser looks for a ':' or a '\' as a terminator for the domain name, while IE looks for any character which isn't part of a legal domain name.

So you can get cookies from *any* domain by doing things like

http://www.msn.com";alert('slut');".net

In theory IE parses this to the msn.com domain and the proxy parses this to the www.msn.com";alert('slut');".net domain.

Again - it all depends on the proxy and the browser disagreeing on the URL parsing.

Scott Manley

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html