Flash Application Security Series [4] -- another 0day of Flash Player

When processing the communication between Flash applications and HTML pages, Flash Player does not filter special characters, which may cause cross-site scripting attacks.
Last time, we mentioned the flash. external. ExternalInterface. call vulnerability. In essence, it is caused by improper Character Processing during SWF and HTML communication. I still remember that the communication between SWF files and HTML pages, including from SWF to HTML, is the execution of JS in the traditional sense, it also includes the communication from HTML to SWF, which is implemented by the function flash. external. externalInterface. addCallback. The addCallback function can register the ActionScript method to be called from a container (here, HTML. After addCallBack () is successfully called, JS in the container can call the functions registered in Flash Player. So what happened to the communication from HTML to SWF. We have simply created an addcallback.swf file with the code: addCallBack. as function f () {trace ("debug");} flash. external. externalInterface. addCallback ("fname", this, f); addcallback.html Solution:You will not fix it anyway.