Cross Context Scripting with Firefox

[Nytro]

Cross Context Scripting with Firefox

Roberto Suggi Liverani

Senior Security Consultant

Security-Assessment.com

21 April 2010

Contents
Abstract ............................................................................................................................ 3
1. Introduction .................................................................................................................. 4
1.1 XPCOM Component Model ........................................................................................ 4
1.2 XUL ............................................................................................................................ 4
1.3 Chrome ....................................................................................................................... 5
1.4 XBL - Custom tags........................................................................................................ 5
1.5 XUL Overlay ................................................................................................................ 5
1.6 Themes, Skins and Locales ........................................................................................... 5
2. XCS Cases .................................................................................................................. 6
2.1 Case I: XCS via Event Handlers – Drag and Drop ............................................................. 6
2.2 Case II: Attacking Custom DOM event handlers................................................................ 8
2.3 Case III: Cross Domain Content/Script Include ............................................................... 10
2.4 Case IV: Injection via XBL ........................................................................................... 12
2.5 Case V: Attacking Wrappers ........................................................................................ 14
2.6 Case VI: Attacking XPCOM Components....................................................................... 15
2.7 Case VII: Sandbox Chrome Leakage ............................................................................ 18
2.8 Case VIII: Bypassing nsIScriptableUnescapeHTML.parseFragment() ................................ 19
3. Conclusion ................................................................................................................. 21
4. References ................................................................................................................ 22

Download:

http://security-assessment.com/files/documents/whitepapers/Cross_Context_Scripting_with_Firefox.pdf

http://security-assessment.com/files/documents/whitepapers/Exploiting_Cross_Context_Scripting_vulnerabilities_in_Firefox.pdf