Re: Help with referer issues in XSS

Hello,


> Suppose there is a reflect XSS vulnerability in a pop SNS, but this
> site is "concerned" about security, so they check the referer field of
> certain POST request to make sure that they are normal and correct. Is
> it possible for me to bypass this check within javascript? It seems
> that I can't set this parameter like this:
> 
> xmlHttp.setRequestHeader("Referer","http://expected.target");
> 
> It would be appreciated if someone can give me a clue.


I'm always interested to see what the community's response is to this
question.  It comes up relatively frequently in the context of CSRF
(since this kind of checking can mitigate CSRF).  Often most people
are skeptical that this kind of checking is sufficient to prevent CSRF
and reflected XSS, but in recent times, I am not aware of a way around
it in the general case.

Old versions of Flash do allow one to set Referer cross-domain, but it
is my impression this was fixed quite some time ago.  Various XHR API
vulnerabilities have also existed in the past to allow for injection
of restricted headers, like Referer, but these could be seen as
browser vulnerabilities.

Recently [1] it was pointed out how headers containing '-' can be
spoofed due to foolishness in CGI-compatible APIs that transliterate
header names, but Referer of course doesn't have a '-'.

Can anyone give an example of how one would get around Referer
checking?

tim


1. http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2012-January/008170.html

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

[email protected]
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org