Carlos Muñoz Application Security Engineer WhiteHat Security @RTWaysea
Bypass: History Explanation: What Is Going On Process: Things To Look For Demos: alert(1) Done Live (hopefully) CSP: Content Security Policy End Notes: (Bonus Bypass?)
Late Friday, August 23 rd, 2013 Finishing Webapp Assessment Visiting site in different browsers, looking for browser-specific functionality
Previously found reflective XSS vulnerability Page reflects injection JavaScript block further up the page Is page rendered within iframe from specific page? ( self!= parent ) No? Redirect to page with iframe and remove injection
Page in iframe defined from URL/URI query string parameter Injection from URL/URI parameter value lands in iframe definition which then calls vulnerable page with injection and XSS executes on vulnerable page
Vuln initially found with Firefox Looked for browser-specific functionality Tested Internet Explorer last Decided to poke at the XSS vuln in Internet Explorer
Standard XSS training Hex entities decoded in attribute space param= value part of html tag Try an injection that doesn t look like <script>alert(1)</script> Encode a few characters, enter injection into Internet Explorer
Weekend: Built Deliberately Vulnerable PHP code to recreate bypass Reported to Microsoft: August 26 th, 2013 Case #15412 Response from Microsoft: October 4 th, 2013
Internet Explorer s XSS filter has a Trust model that determines which requests are subject to the filter Some requests are not trusted: subject to filter Some requests are trusted: not subject to filter Abuse that trust: Bypass the filter
Primary Request with injection is made Primary Request doesn t cause IMMEDIATE JavaScript code execution Primary Request is subject to the filter Secondary Request within the same domain is induced with data from the Primary Request Secondary Request does cause JavaScript code execution Secondary Request is trusted and not subject to the filter
Looking for functionality on site that will allow a secondary request onto the same domain Iframes, Frames Form submissions href attributes JavaScript Redirects Places where both <a> and </a> can be injected
Hiding data from Primary Request: Landing in Attribute space? Hexadecimal: &#xyy; - HTML 4.0 1998 Decimal: &#ZZ; - HTML 2.0 1995 Named Entity: &ww; - HTML 2.0 1995 URL/URI: %VV RFC 1630 1994 Landing in JavaScript space? URL/URI: %VV RFC 1630 1994
Filter doesn t like. Periods <form> <frame> <iframe> Filter sometimes permits, sometimes doesn t: () [] {} Parenthesis, Square Brackets, Curly Brackets The word style Can use class instead (see demos)
Content Security Policy A policy language used to declare a set of content restrictions for a web resource, and a mechanism for transmitting the policy from a server to a client where the policy is enforced. Content Security Policy 1.0 http://www.w3.org/tr/csp/ Maybe no more XSS (if done correctly)??? What about Internet Explorer?
Only Internet Explorer 10 & 11 have any support for Content Security Policy Content Security Policy support in Internet Explorer 10 & 11 is limited Uses older X-Content-Security-Policy header instead of official Content-Security-Policy Source: http://content-security-policy.com Does Content Security Policy currently help? (no)
Microsoft s No Fix response: Two different reasons given: First Reason (given back in Oct 2013): Requires special functionality Not actually true everything used in bypass has been part of official HTML spec since at least 1998 Second Reason (given later, Dec 2013): Requires user interaction Partially true, but not fully true
Bonus Bypass: If webapp performs double-url/uri decoding, Internet Explorer s XSS filter doesn t catch it Demo (if time permits)
The Playground Deliberately vulnerable pages Can be used for training on bypass
Links: http://blogs.msdn.com/b/dross/archive/2008/07/03/ie8- xss-filter-design-philosophy-in-depth.aspx http://threatpost.com/bypass-of-internet-explorer-crosssite-scripting-filter-possible/103106 http://gazebelwerks.net/internetexplorer/ https://github.com/rtwaysea/ie-xss-filter-bypass-2.0
Any Questions? http://gazebelwerks.net/internetexplorer/ https://github.com/rtwaysea/ie-xss-filter-bypass-3.0 @RTWaysea carlos.munoz@whitehatsec.com Thank You ToorCon!