804146 - XSS via PHP

Status: RESOLVED INVALID

(Core :: General, defect)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Hello.

I found Firefox has risk of potential XSS.

If the tag like below in html file,
<script src="http://[e-mail]/x"></script>

Firefox read http://bogus.jp/x directory (no alert)
It can force to read external JavaScript code.

----------------------------------
This php script has risk of potential XSS.

<?php
$base="http://packetmonster.com";
echo '<script src="'.htmlspecialchars($base.$_GET["file"]).'"></script>';
?>
------------------------------
Usually accessing by such URL is assumed.
http://packetmonster.com/scriptsrcxss.php?file=/base.js

this URL is possible to execute external JavaScript.
http://packetmonster.com/scriptsrcxss.php?file=@bogus.jp/x

Regards.
-
Yuji Tounai
[e-mail]
http://twitmatome.bogus.jp/

Comment 2

[Benjamin Smedberg]

There is nothing unknown here nor a security risk. Websites can load scripts from other domains as part of the design of the web.