Interesting the E4X spec says this shouldn’t be possible, have you got a POC?

Anyway it’s possible to get the rest of the doc using setTimeout and assigning the remaining HTML to a E4X variable

Hey Chris, fixed the XML it was because I used a code formatter plugin and now that I removed it (because it was vulnerable =) ) the raw XML data displayed.

I sent you a email about e4x

Google Chrome (or more accurately, v8) doesn’t have E4X support at the moment. Best I know it’s only Firefox.

My foray into E4X security was: http://scarybeastsecurity.blogspot.com/2009/05/more-plausible-e4x-attack.html

In response to that, Firefox committed a change in 3.5 such that pure XML was not considered valid JavaScript. I’m curious if that change also fixes your UTF7 attack, or if terminating the XML and including another JavaScript statement after causes Firefox to not error?

General question I suppose – is FF3.5.8 still vulnerable to this?

Have fun,
Chris

p.s. the XML isn’t rendering properly in my browser. You probably want to escape braces etc. with < even though you’re in a PRE tag.

See Kuza’s link which discusses defensive measures at the bottom.

You can remote include styles using the link tag, a variation on the one in our Bluehat presentation