PUBLIC SECURITY ADVISORY: Sandblad #13 -------------------------------------------------------------- Title: Cross-domain exploit on zombie document with event handlers Date: 2004-02-25 Software: Mozilla web browser Vendor: http://www.mozilla.org/ Status: Patched Reference: http://bugzilla.mozilla.org/show_bug.cgi?id=227417 Type: Cross site scripting Impact: Site spoofing, cookie/password theft Author: Andreas Sandblad, sandblad@acc.umu.se -------------------------------------------------------------- SUMMARY: ======== When linking to a new page it is still possible to interact with the old page before the new page has been successfully loaded (zombie document). Any javascript events fired will be invoked in the context of the new page, making cross site scripting possible if the pages belong to different domains. HISTORY: ======== 2003-12-02: Mozilla Security Team contacted. Assigned Bugzilla bug #227417: http://bugzilla.mozilla.org/show_bug.cgi?id=227417 2003-12-03: Fix added. DETAILS: ======== Mozilla has several security layers to prevent exploitation of zombie documents. Most important the origin of all javascript code is checked before execution. The problem occurs with event handlers used in tags. Some attempts are made to disable them, but can easily be bypassed. The trick is to fill the current document with as many event handlers as possible and then redirect to a new page. If the event handler is invoked at the right time it will be executed in the context of the new page, thus making cross site scripting possible. DISCLAIMER: =========== Andreas Sandblad is not responsible for the misuse of the information provided in this advisory. The opinions expressed are my own and not of any company. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this advisory. Any use of the information is at the user's own risk. FEEDBACK: ========= Please send thoughts and comments to: _ _ sandblad@acc.umu.se o' \,=./ `o (o o) ---=--=---=--=--=---=--=--=--=--=---=--=--=-----ooO--(_)--Ooo--- Andreas Sandblad, Umeå Sweden. ---=--=---=--=--=---=--=--=--=--=---=--=--=--=--=--=--=--=---=--