Injecting the script tag into XML

Tuesday, 9 October 2007

Firefox is now the browser I like hacking, there’s just so much stuff it can do. I simply don’t have enough time to explore everything, but what I have found was some very interesting XML behavior. I was helping Ronald a while back with a Firefox chrome security flaw and we discussed on slackers that some XML entities in Firefox contain sensitive information which it is possible to read using XHR.

I thought of what other interesting things I could do with XML entities and I found a way of injecting script tags using them. This could have implications if you offer a HTML upload service but you filter out dangerous tags for example. The proof of concept is very basic but displays the method clearly.

XML injection

The entry 'Injecting the script tag into XML' was posted on October 9th, 2007 at 2:09 pm and is filed under javascript, Security, xss. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

8 Responses to “Injecting the script tag into XML”

  1. buherator writes:
    No. 1 — October 9th, 2007 at 3:17 pm

    It works on Opera 9.23 Linux too 😉

  2. Gareth Heyes writes:
    No. 2 — October 9th, 2007 at 3:36 pm

    Hehe cool, I’ve not tried it in other browsers

  3. thornmaker writes:
    No. 3 — October 9th, 2007 at 7:22 pm

    /me likes it. very clever

  4. Jordan writes:
    No. 4 — October 9th, 2007 at 8:02 pm

    In case you’re curious, Safari 2.0.4 doesn’t like the inject entity:

    This page contains the following errors:

    error on line 11 at column 46: Entity ‘inject’ not defined

    iPhone version shows the alert(1) text itself, but not in a script element.

  5. Gareth Heyes writes:
    No. 5 — October 9th, 2007 at 8:42 pm

    @Jordan

    Thanks for the info useful 🙂

    @thornmaker

    Cheers 🙂

  6. kourge writes:
    No. 6 — October 10th, 2007 at 4:36 am

    This works with WebKit 25438.

  7. Oniric writes:
    No. 7 — October 10th, 2007 at 9:18 am

    Sweeeeet!

  8. raaka! writes:
    No. 8 — October 14th, 2007 at 3:55 am

    Gareth Heyes

    Honestly

    i developed months ago,exploited google toolbar using this technique. i deserve some credit 😀

    if you are intrested about POC. let me know

«
»