[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Input Validation Vulnerability in Apple Safari version 1.2.4 v125.12
From:       Jonathan Rockway <jrockw2 () uic ! edu>
Date:       2005-02-04 12:10:10
Message-ID: 90d6eea4e8f0b3216d26c631c3526f73 () uic ! edu
[Download RAW message or body]

Input Validation Vulnerability in Apple Safari version 1.2.4 v125.12

Apple's Safari web browser ignores the Content-type: sent by the web 
server.   As a result, plain text is rendered as HTML.  This is 
obviously undesirable; a text file could contain HTML and carry out an 
XSS attack.

For an example of this in action, visit:

http://tigger.uic.edu/htbin/perlwrap/jrockw2/safari_test.pl

This will only work if you are on the UIC campus, if you have a login 
at UIC, UIUC, or UIS you can visit:

https://tigger.uic.edu/htbin/perlwrap-auth/jrockw2/safari_test.pl

Anyway, for the 99.99% of you not affiliated with the University of 
Illinois, this script simply prints:
  --
Content-type: text/plain

<HTML><BODY><FONT color="red">Your browser contains a security problem 
if this text is red.</FONT></BODY></HTML>
  --

sans the --'s, obviously.

In Safari, the text is red.  In Firefox 1.0, the text is rendered 
appropriately; i.e. the user sees the tag soup.

The security problem is that servers serving HTML may be taking 
measures to prevent XSS attacks; i.e. they convert < to &lt;.  These 
servers, when serving plain text, may not do this (because it is 
unnecessary and undesirable).  Safari opens up a hole where a malicious 
user could inject HTML into a plain text output and perform an XSS 
attack that would not work otherwise (with a proper browser).

The latest version of this advisory is viewable at 
http://tigger.uic.edu/~jrockw2/safari_20050204.txt

Note that it won't render properly in Safari :-)

Regards,
-- 
Jonathan Rockway <jrockway@computer.org>
Student - University of Illinois at Chicago
http://www.uic.edu/~jrockw2/

[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic