UXSS of ZTE micron browser and Solutions

UXSS of ZTE micron browser and Solutions

The latest version is tested.

Download micron browser address: http://www.umeweb.cn/

Micron browser is developed in cooperation with ZTE.
 

Uxss (Universal Cross-Site Scripting general-purpose XSS) UXSS is an attack type that uses browser or browser extension vulnerabilities to create XSS conditions and execute code. Attackers can remotely execute commands, bypass the same-origin policy, steal user information, and hijack users remotely.


Enter online test address in the browser: http://uxss.sinaapp.com/index.php


 

For detailed POC please see https://code.google.com/p/chromium/issues/detail? Id = 143437

Issue 143437: v8 builtins object exposed to user causing UXSS
 

Solution:

1. The server prohibits iframe nested X-FRAME-OPTIONS: DENY.

2. The client uses the setAllowFileAccess (false) method to disable webview access to the local region.

3. The client uses the onPageStarted (WebView view, String url, Bitmap favicon) method to determine cross-origin before the jump.

4. The client filters the iframe object tag attributes.