A Function constructor that came from an outer window can be used to create a function whose global object is the outer window. Such function can be used for an XSS attack. See also Bug 311024. Bug 357947 was already fixed on trunk in Bug 355161. Thus, a testcase works only on fx2.0.
This tries to get cookies for www.mozilla.com.
An attacker can perform the XSS attack without user interaction. It seems that Function can refer to the outer window's Function only when the window has been opened by window.open(). Since the popup blocker is turned on by default, my first testcase requires user interaction. But, window.toString.constructor refers to the outer window's Function even when the window is a subframe. Thus, an attacker can exploit without user interaction.
This does not require user interaction to exploit.
Does this apply to the 1.8.0 branch? bug 355161 is claimed to be a regression from bug 343417 that never landed there. Need to test (no time now). plussing for 126.96.36.199
Assignee: dveditz → jst
Flags: blocking188.8.131.52? → blocking184.108.40.206+
Whiteboard: [sg:high] public bug 355161
On 220.127.116.11, I cannot get outer window's Function. (though I don't understand how window.toString.constructor refers to outer window's Function with the fix for bug 343417.)
We're saying we don't need this one on the 1.8.0 branch
Flags: blocking18.104.22.168? → blocking22.214.171.124-
bug 355161 has been fixed on the 1.8 branch, this one ought to be fixed by that as well. Needs to be verified.
v.fixed on 1.8 branch with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:126.96.36.199pre) Gecko/20061201 BonEcho/188.8.131.52pre, no exploit with testcase 2.
Whiteboard: [sg:high] public bug 355161 → [sg:high] 1.8.1/1.9-only, public bug 355161
This bug is fixed now
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Whiteboard: [sg:high] 1.8.1/1.9-only, public bug 355161 → [sg:high] 1.8.1/1.9-only, abuses bug 355161
pvnick is doing a bit of research on XSS and also gathering up bugs with security related test cases to help add to the regression/certification test suites. adding him to the cc list in these...
You need to log in before you can comment on or make changes to this bug.