[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-disclosure] IE handling the HTML notes incorrectly may lead to XSS attacks



On 2011-08-07, at 19:53, CnCxzSec衰仔 wrote:
> hi all, here is an interesting trick to perform an xss attack with IE
> browsers.
> 
> some rich text applications such as email and blog, may provide HTML uses
> but have a policy to block the on-event execution to prevent the XSS attack.
> However, this applications may also allow the HTML notes uses,for instance
> "<!--  -->"

Any such applications are likely to also be vulnerable to a simpler attack 
based on "downlevel-hidden" conditional comments:

<!--[if IE]>
<script>anything you want can go here, presumably</script>
<![endif]-->
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/