The file extension of moz-binding: url in FF3 is not restricted, leading to the XSS vulnerability.

Emptiness

Abstract:

In html ">/Article/200906/39552 .htmlSee, FF3 pair

<Style>BODY {-Moz-binding: url("Http://www.80vul.coom/test.xml#xss")} </style>

The domain in the url is restricted.

If some web application functions are used together, you can bypass this restriction.

Detailed description:

FF3 does not allow remote reference 《{-Moz-binding: url ("here ")XML file.

But there is no limit on the file extension here.

As long as we can upload files in the domain where the web application is located.

Content:You can execute the XSS content.

XML/HTML code

1. <?Xml Version="1.0"?><Bindings Xmlns=Http://www.mozilla.org/xbl"><Binding Id="Xss"><Implementation><Constructor><! [CDATA [alert (XSS)]></Constructor>

 

Example:

Http://www.inbreak.net/kxlzxtest/ff3/a.htm