Cross-Site Scripting in Unparsable XML Files

By Thomas McGuire on July 1, 2003, 11:20 AM
Affected applications: Microsoft Internet Explorer 5.5 & 6.0.
Note that any other application that uses Internet Explorer's engine (WebBrowser control) is affected as well (AOL Browser, MSN Explorer, etc.).

Discussion: We have found that in some cases the displayed URL is not filtered appropriately, & may cause HTML that was passed in the querystring of the URL to be rendered by the browser. This creates a classic cross-site scripting attack in almost any XML file that MSXML fails to read. Practically, this means that leaving XML files on your server that can't be parsed correctly by Internet Explorer & MSXML is exposing the site to a global Cross-Site Scripting attack. We have been able to reproduce this problem in various setups, but we couldn't pinpoint the vulnerable component reliably enough. It is most likely an MSXML issue, & not a flaw in Internet Explorer itself.

Would you like to know more?

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.