UXSS vulnerability caused by logical defects in Android WeChat and QQ browsers

Source: Internet
Author: User

UXSS vulnerability caused by logical defects in Android and QQ browsers
I. Vulnerability description

The X5 kernel of the QQ browser used by both the Android platform and the QQ browser has a logic defect in ip address processing and domain name hostnames, which bypasses the browser policy and leads to the UXSS vulnerability.

Ii. PoC code and simple analysis

The code for PoC.htm is as follows:

1 <iframe src = "'HTTP: // '"> </iframe> <iframe>

When Android mobile phone users use the http: // code, such:

& Nbsp 1 2 3 4 5 <script> alert ('document. domain: '+ document. domain); document. domain = 'qq. com '; alert (document. domain); </script>

That is to say, when the IP address + & ldquo. & rdquo + the URL of the root domain Automatically splits the URL according to the IP address structure and accesses this IP address, while the JavaScript code parsed by the browser is based on the current document. URL, the current document. domain is the subdomain of the root domain.

Iii. Vulnerability demonstration

Test poc.htm, QQ scan, or click access URL

& Nbsp

Note: The version is 6.3.8 & nbsp & nbspQQ. The version is v6.1.0.2635.

Iv. how to exploit the vulnerability by setting document. domain to achieve cross-origin; combined with flash crossdomain. xml settings for cross-origin. using html5 or other third-party plug-ins such as jre may implement cross-origin. V. Possible impact and repair suggestions

When I first discovered this vulnerability, the android QQ browser was affected (Subsequent tests failed). Therefore, this vulnerability may affect other product lines that call the QQ browser kernel, therefore, we recommend that you fix this vulnerability in the QQ browser X5 kernel. The specific fix can determine and process the IP address structure symbol & rdquo. & rdquo.

6. Vulnerability timeline: July 22, October 2015 & nbsp found that the android QQ browser was affected by this vulnerability. July 22, December 2015 & nbsp found android the QQ browser cannot be triggered, however, QQ and other products can trigger the December 26, 2015 & nbsp vulnerability report and submit it to TSRC & nbsphttp: // security.tencent.com/July 15, December 28, 2015 & nbsp & nbspTSRC confirm that the vulnerability was fixed on July 15, January 20, 2016 & nbsp & nbspTSRC report that the vulnerability was released on July 15, February 29, 2016 & nbsp </iframe>

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.