New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 845253 link

Starred by 3 users
Status: WontFix
Owner:
tsepez@chromium.org
Closed: May 2018
Cc:
█ mkwst@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 2
Type: Bug



Sign in to add a comment

Security: Chrome XSS XSS auditor Bypass

Reported by new404er...@gmail.com, May 21 2018 
Hello,

I have Found A Bug On Chrome XSS Bypass

POC Vist This link

http://1cu.pw/xss/chrome.html?redir=%19Jav%09asc%09ript:https://google.com/%250Aconfirm%2528133.7*10%2529


Thanks
xss c.jpg
79.7 KB View Download

Comment 1 by mmoroz@chromium.org, May 21 2018

Cc: tsepez@chromium.org
Components: Blink>SecurityFeature>XSSAuditor
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug

Comment 6 by mkwst@chromium.org, May 22 2018

Cc: -tsepez@chromium.org mkwst@chromium.org
Owner: tsepez@chromium.org
Status: Assigned (was: Unconfirmed)

Comment 7 by viswa.karala@chromium.org, May 22 2018

Labels: M-68 Needs-Milestone Triaged-ET FoundIn-68 Target-68 OS-Linux OS-Mac OS-Windows Pri-2
Able to reproduce the issue on chrome stable# 66.0.3359.181 and on latest chrome# 68.0.3436.0 using Windows-10, Ubuntu 14.04 and Mac 10.12.6. As the issue is seen from M-60(60.0.3112.0), hence considering this as Non-Regression issue.

Thanks!

Comment 8 by new404er...@gmail.com, May 22 2018 

is it not a vulnerability issue?


thank you

Comment 10 by new404er...@gmail.com, May 22 2018 

I was seen...


if any process please notify me 



Thank you

Comment 11 by tsepez@chromium.org, May 24 2018

Status: WontFix (was: Assigned)
The XSSAuditor is not able to defend against persistent XSS or DOM-based XSS. as explained https://chromium.googlesource.com/chromium/src/+/lkcr/docs/security/faq.md#Are-XSS-filter-bypasses-considered-security-bugs

For all these cases, we get a script that eventually does:

        var redir = searchParams.get('redir');
	if (redir !== null) {
		document.location = redir;
	}

or 

        var index = searchParams.get('index').toString();
	eval('market.index=' + index);
	document.getElementById('p1').innerHTML = 'Current market index is ' + market.index + '.';

which are DOM-based XSS.
►

Sign in to add a comment