[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-disclosure] Using JPEG Exif injection for XSS

<html><body><span style="font-family:Verdana; color:#000000; 
font-size:10pt;"><div>With Firefox 3.6 now utilizing FileAPI, it practically 
guarantees the increase of using Exif parsers in web applications and plugins. 
I put together a demonstration of how this could be used to inject iframe's 
into Exif images which executes a xss. Since Firefox displays the new FileAPI 
in 3.6 using a Exif parser on there demo site, I decided to take advantage of 
it. Check it out at: <a 
title="http://www.iglobalonline.com/2010/03/26/firefox-3-6-fileapi-exif-injection/";
 
href="http://www.iglobalonline.com/2010/03/26/firefox-3-6-fileapi-exif-injection/";
 
mce_href="http://www.iglobalonline.com/2010/03/26/firefox-3-6-fileapi-exif-injection/";
 
target="_blank">http://www.iglobalonline.com/2010/03/26/firefox-3-6-fileapi-exif-injection/</a><br
 mce_bogus="1"></div><div><br></div><div>Ref: <a 
href="http://demos.hacks.mozilla.org/openweb/FileAPI/";>http://demos.hacks.mozilla.org/openweb/FileAPI/</a></div><div><br></div><div>Thanks,</div><div>Michael<br></div></span></body></html>


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/