Backslash-escaped comments allow CSS injection vulnerability
Closed, ResolvedPublic

Description

Wikipedia user Suffusion of Yellow discovered a CSS injection vulnerability, which occurs when CSS comments /* ... */ are escaped with backslashes: \2f\2a ... \2a\2f. The bug is due to an error in the CSS escape sequence normalisation code which we introduced to fix bug 23687.

As with any CSS injection vulnerability, the impact is complete account compromise (XSS) for Internet Explorer users, and possible privacy loss due to arbitrary remote image embedding for users of other browsers.


Version: 1.16.x
Severity: normal

Details

Reference
bz28450
bzimport set Reference to bz28450.
bzimport added a subscriber: Unknown Object (MLST).
tstarling created this task.Apr 7 2011, 4:33 AM

Was fixed in r85856

Basic test added with r100584

Add Comment