UXSS vulnerability caused by logical defects in Android WeChat and QQ browsers

UXSS vulnerability caused by logical defects in Android and QQ browsers
I. Vulnerability description

The X5 kernel of the QQ browser used by both the Android platform and the QQ browser has a logic defect in ip address processing and domain name hostnames, which bypasses the browser policy and leads to the UXSS vulnerability.

Ii. PoC code and simple analysis

The code for PoC.htm is as follows:

1 <iframe src = "'HTTP: // 1.1.1.1..qq.com '"> </iframe> <iframe>

When Android mobile phone users use the http: // 1.1.1.1/.qq.com/&nbsppage code, such:

& Nbsp 1 2 3 4 5 <script> alert ('document. domain: '+ document. domain); document. domain = 'qq. com '; alert (document. domain); </script>

That is to say, when the IP address + & ldquo. & rdquo + the URL of the root domain Automatically splits the URL according to the IP address structure and accesses this IP address, while the JavaScript code parsed by the browser is based on the current document. URL, the current document. domain is the subdomain of the root domain.

Iii. Vulnerability demonstration

Test poc.htm, QQ scan, or click access URL

& Nbsp

Note: The version is 6.3.8 & nbsp & nbspQQ. The version is v6.1.0.2635.

Iv. how to exploit the vulnerability by setting document. domain to achieve cross-origin; combined with flash crossdomain. xml settings for cross-origin. using html5 or other third-party plug-ins such as jre may implement cross-origin. V. Possible impact and repair suggestions

When I first discovered this vulnerability, the android QQ browser was affected (Subsequent tests failed). Therefore, this vulnerability may affect other product lines that call the QQ browser kernel, therefore, we recommend that you fix this vulnerability in the QQ browser X5 kernel. The specific fix can determine and process the IP address structure symbol & rdquo. & rdquo.

6. Vulnerability timeline: July 22, October 2015 & nbsp found that the android QQ browser was affected by this vulnerability. July 22, December 2015 & nbsp found android the QQ browser cannot be triggered, however, QQ and other products can trigger the December 26, 2015 & nbsp vulnerability report and submit it to TSRC & nbsphttp: // security.tencent.com/July 15, December 28, 2015 & nbsp & nbspTSRC confirm that the vulnerability was fixed on July 15, January 20, 2016 & nbsp & nbspTSRC report that the vulnerability was released on July 15, February 29, 2016 & nbsp </iframe>