Eiji James Yoshida wrote in http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049784.html :
> If 'Encoding' is set to 'Auto Select', and Internet Explorer finds a UTF-7 > string in the response's body, it will set the charset encoding to UTF-7 > automatically ... > Proof of concept: > http://MaliciousSite/+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-...
I know that Apache servers return
The requested URL /xyz was not found on this server.
when fetching http://apache.svr/xyz . Trouble is that IE shows a "custom" error message, ignoring the error body. Pondering, see that
> ... Internet Explorer will not display these pages, however, unless they > are larger than 512 bytes. ...
This provides UXSS (Universal Cross-Site Scripting):
(with a couple of hundred Zs) will do what we want. Works for https also:
Can steal any Apache server (http or https) cookies. I do not have easy access to ISS servers to test whether similar attacks would work there.
Will Apache fix (carefully escape) the error message? Will MS fix IE to not be so over-friendly?
In the meantime, do not use IE to do anything "private" like banking...
Paul Szabo firstname.lastname@example.org http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of Sydney Australia
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/