GmailJSON Hijacking by IE8 Css Cross-Domain vul

5up3rh3iblog IE8 Css Cross-Domain Information Disclosure Vulnerability Gmail JSON Hijacking Attack Technique In fact, this vulnerability is an archaeological "Antique": html ">CSS-String-Injection ArchaeologyLink: Http://www.hacker.co.il/security/ie/css_import.html In the previous test, you can use document.stylesheets(0).imports(0).css Text to get the code... For general js and html files, you can directly retrieve them. It is not small to mention the extra css string injection [of course it is not any file, and it needs to be parsed as a css file by ie, it generally contains characters such as {}. For exploitation, you can also load local files through UNC to cause information leakage. Of course, ie cannot be parsed as css by default, or css string injection can be used. The most perfect way to exploit this vulnerability is to use JSON Hijacking to break through the traditional json protected by javascript endless loops. GmailJSON Hijacking is a good column :) The ms071 patch is actually a "mistaken injury", which causes the vulnerability to be patched! This mainly limits the types of imports file loading.