Recent XSS 0day vulnerability struck, the impact of the latest version of the IE browser-vulnerability warning-the black bar safety net
2015-02-06T00:00:00
ID MYHACK58:62201558836 Type myhack58 Reporter 佚名 Modified 2015-02-06T00:00:00
Description
!
Security researchers recently discovered a seriousXSS 0day vulnerability that can impact the latest version of the IE browser, the user is exposed in the attack and identity theft risk.
Vulnerability information
The vulnerability can affect fully restored IE browser, hackers can exploit the vulnerability to steal sensitive user data such as logon credentials and be able to browser sessions to inject malicious content.
An attacker using theXSSthe vulnerability may bypass the same-origin policy（SOP）。 The same-origin policy is a web application in a basic security model used to protect the user's browsing experience.
The same origin policy on Wikipedia interpreted as:
“The policy allows the same site, system, host name, and port number combination on the page of the script to access each other's DOM, but no specific restrictions, but blocking access to different sites on the DOM.”
{"type": "myhack58", "published": "2015-02-06T00:00:00", "reporter": "\u4f5a\u540d", "objectVersion": "1.2", "bulletinFamily": "info", "cvelist": [], "cvss": {"vector": "NONE", "score": 0.0}, "hash": "2b1feeff8316b5ae45b482a40ffa28f4cb6eb594a07722e1fa5f272ad557a320", "enchantments": {"score": {"value": 1.5, "vector": "NONE", "modified": "2016-11-10T18:29:37"}, "dependencies": {"references": [], "modified": "2016-11-10T18:29:37"}, "vulnersScore": 1.5}, "lastseen": "2016-11-10T18:29:37", "viewCount": 0, "id": "MYHACK58:62201558836", "history": [], "references": [], "edition": 1, "hashmap": [{"key": "bulletinFamily", "hash": "caf9b6b99962bf5c2264824231d7a40c"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "d4be9c4fc84262b4f39f89565918568f"}, {"key": "description", "hash": "79c500f849978e4296282b6c23aae9d7"}, {"key": "href", "hash": "843c92158a0a2ca7e39444db9558bdd4"}, {"key": "modified", "hash": "5875a3ea5d50733dec4f4a7f67122b4c"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "5875a3ea5d50733dec4f4a7f67122b4c"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "645396391020478112635e14b34a0f8b"}, {"key": "title", "hash": "db952fae1498944aaf3c9dae71f8593b"}, {"key": "type", "hash": "0665a8b0792e65b50ab13aef58a018dc"}], "href": "http://www.myhack58.com/Article/html/3/62/2015/58836.htm", "modified": "2015-02-06T00:00:00", "title": "Recent XSS 0day vulnerability struck, the impact of the latest version of the IE browser-vulnerability warning-the black bar safety net", "description": "! [](/Article/UploadPic/2015-2/201525135853273.jpg) \n\n\n**Security researchers recently discovered a serious[XSS](<http://www.myhack58.com/Article/html/3/7/Article_007_1.htm>) 0day vulnerability that can impact the latest version of the IE browser, the user is exposed in the attack and identity theft risk.**\n\n**Vulnerability information**\n\n**The vulnerability can affect fully restored IE browser, hackers can exploit the vulnerability to steal sensitive user data such as logon credentials and be able to browser sessions to inject malicious content.**\n\nAn attacker using the[XSS](<http://www.myhack58.com/Article/html/3/7/Article_007_1.htm>)the vulnerability may bypass the same-origin policy\uff08SOP\uff09\u3002 The same-origin policy is a web application in a basic security model used to protect the user's browsing experience.\n\nThe same origin policy on Wikipedia interpreted as:\n\n\n\u201cThe policy allows the same site, system, host name, and port number combination on the page of the script to access each other's DOM, but no specific restrictions, but blocking access to different sites on the DOM.\u201d\n\n**Vulnerability POC** \n\n\n**[1] [[2]](<58836_2.htm>) [[3]](<58836_3.htm>) [next](<58836_2.htm>)**\n"}
