Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me:
& JavaScript includes
<BR SIZE="&{alert('XSS')}">
I tried out the following HTML:
<html>
<head>
<title>test</title>
</head>
<body>
<br size="&{alert('1')}">
</body>
</html>
on Firefox 31.0 and it didn't seem to work (i.e. no alert box). Did I miss anything, or is this technique only applicable to older browsers?
JavaScript, the Definitive Guide, 4th Edition - published in 2001 - mentions these in a bit more detail. The relevant section appears to be freely available. It's right at the bottom of that link. Here's the excerpt:
12.2.5. JavaScript in Nonstandard Contexts
Both Netscape and Microsoft have implemented proprietary extensions in their browsers, and you may occasionally see JavaScript code in a context other than those described here. For example, Internet Explorer allows you to define event handlers in a
<script>tag that uses specialforandeventattributes. Netscape 4 allows you to use JavaScript as an alternative syntax for defining CSS style sheets within a<style>tag. Netscape 4 also extends the HTML entity syntax and allows JavaScript to appear within entities (but only within the values of HTML attributes). This can result in HTML that looks like this:<table border="&{getBorderWidth( )};">Finally, Netscape 4 also supports a form of conditional comment based on this JavaScript entity syntax. Note that Netscape 6 and the Mozilla browser on which it is based no longer support these nonstandard uses of JavaScript.
So it's an abuse of the typical HTML entity syntax - the kind where we use & to produce an ampersand. Instead of writing amp, I write {alert('oh no')}.
However, the book mentions that Netscape 6 - released in 2000, around the time of IE6 - and the very early Mozilla browser were already taking action to eliminate this exploit. It's fairly unlikely it exists in recent browser versions.
If it ever affected Internet Explorer (which isn't mentioned as even permitting this in the first place), I have no information on at what version it ceased being a viable IE exploit.
<br />tag and it doesn't mention any attributes.