[B! XSS] drupaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

drupa id:drupa

XSSã«é–¢ã™ã‚‹drupaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (12)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

XSSã‚’é˜²ãæ–°ã—ã„XSS-Protectionãƒ˜ãƒƒãƒ€ - ASnoKaze blog
evalã¨reportOnlyã«ã¤ã„ã¦è¿½è¨˜ã—ã¾ã—ãŸ (2016/10/10) 2016/10/20 ä»•æ§˜åã¯ä»¥ä¸‹ã®é€šã‚Šã«ãªã‚Šã¾ã—ãŸã€‚Anti-XSS Response-Time Uniqueness Requirement ã¾ãŸã€ãƒ˜ãƒƒãƒ€åã¯ã€XSS-Protectionãƒ˜ãƒƒãƒ€ã§ã¯ãªãã€ARTURãƒ˜ãƒƒãƒ€ã¨ãªã£ã¦ãŠã‚Šã¾ã™ãŒã€ã¾ãŸå¤‰æ›´ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ Googleã®èª¿æŸ»ã«ã‚ˆã‚‹ã¨ã€CSPã«ã‚ˆã‚‹XSSã®é˜²æ¢ã¯ç¾å®Ÿçš„ã«ãƒ‡ãƒ—ãƒã‚¤ã®æ¬ é™¥ã«ã‚ˆã‚ŠXSSã®é˜²æ¢åŠ¹æžœãŒãªã„ã“ã¨ã‚’ç¤ºã—ã¦ã„ã¾ã™ã€‚èª¿æŸ»ã¯ã€ŒCSP Is Dead, Long Live CSP!ã€ã¨ã—ã¦ACMã®ã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã§ç™ºè¡¨ã•ã‚Œã€ãƒšãƒ¼ãƒ‘ãƒ¼ã‚‚é–²è¦§ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ 9æœˆã«è¡Œã‚ã‚ŒãŸW3C TPAC 2016ã®WebAppSecã®ãƒŸãƒ¼ãƒ†ã‚£ãƒ³ã‚°ã§è°è«–ã•ã‚Œã€Googleã®Mike Westæ°ã‚ˆã‚Šæ–°ã—ãXSS Protectionã¨ã„ã†ä»•æ§˜ãŒææ¡ˆã•ã‚Œã¦
drupa 2016/10/09
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS

Web

json
ãƒªãƒ³ã‚¯
Electronã§ã‚¢ãƒ—ãƒªã‚’æ›¸ãå ´åˆã¯ã€æ°—åˆã„ã¨æ ¹æ€§ã§XSSã‚’ç™ºç”Ÿã•ã›ãªã„ã‚ˆã†ã«ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„ã€‚ - è‘‰ã£ã±æ—¥è¨˜
ãã®ã†ã¡ã‚‚ã†å°‘ã—ãã¡ã‚“ã¨æ›¸ãã¾ã™ãŒã€ã¨ã‚Šã‚ãˆãšæ™‚é–“ãŒãªã„ã®ã§çµè«–ã ã‘æ›¸ãã¨ã€ã‚¿ã‚¤ãƒˆãƒ«ãŒå…¨ã¦ã§Electronã§ã‚¢ãƒ—ãƒªã‚’æ›¸ãå ´åˆã¯æ°—åˆã„ã¨æ ¹æ€§ã§XSSã‚’ç™ºç”Ÿã•ã›ãªã„ã‚ˆã†ã«ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„ã€‚ ã“ã‚Œã¾ã§Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ä¸Šã§XSSãŒå˜åœ¨ã—ãŸã¨ã—ã¦ã‚‚ã€å½±éŸ¿ç¯„å›²ã¯ãã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä¸ã«ç•™ã¾ã‚‹ã®ã§ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®æä¾›å´ãŒãã‚Œã‚’è¨±å®¹ã™ã‚‹ã®ã§ã‚ã‚Œã°XSSã®å˜åœ¨ã«ç›®ã‚’ã¤ã‚€ã‚‹ã“ã¨ã‚‚ã§ããŸã€‚ã—ã‹ã—ã€Electronã‚¢ãƒ—ãƒªã§DOM-based XSSãŒä¸€ã‹æ‰€ã§ã‚‚ç™ºç”Ÿã™ã‚‹ã¨ã€(ãŠãã‚‰ã)ç¢ºå®Ÿã«ä»»æ„ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã¸ã¨ã¤ãªãŒã‚Šã€åˆ©ç”¨è€…ã®PCã®(ãã®ãƒ¦ãƒ¼ã‚¶ãƒ¼æ¨©é™ã§ã®)å…¨æ©Ÿèƒ½ãŒæ”»æ’ƒè€…ã«ã‚ˆã£ã¦åˆ©ç”¨ã§ãã‚‹ã€‚ ãã®ãŸã‚ã€Electronã§ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œæˆã™ã‚‹é–‹ç™ºè€…ã¯æ°—åˆã„ã¨æ ¹æ€§ã§XSSã‚’å®Œå…¨ã«ã¤ã¶ã•ãªã‘ã‚Œã°ãªã‚‰ãªã„ã€‚ nodeIntegration:falseã‚„Content-Security-Pol
drupa 2015/12/27
XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

electron
ãƒªãƒ³ã‚¯
ã‚¨ãƒ©ãƒ¼ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã«ã‚ˆã‚‹XSSã«ã”ç”¨å¿ƒ
ä»¥å‰ã®è¨˜äº‹ã€ŒPHPã®display_errorsãŒæœ‰åŠ¹ã ã¨ã‚«ã‚¸ãƒ¥ã‚¢ãƒ«ã«XSSè„†å¼±æ€§ãŒå…¥ã‚Šè¾¼ã‚€ã€ã§ã¯ã€php.iniç‰ã§display_errorsã‚’æœ‰åŠ¹ã«ã—ã¦ã„ã‚‹ã¨ã€ã‚¹ã‚¯ãƒªãƒ—ãƒˆã«è„†å¼±æ€§ãŒãªãã¦ã‚‚XSSï¼ˆã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼‰è„†å¼±æ€§ãŒå…¥ã‚Šè¾¼ã‚€å¯èƒ½æ€§ãŒé«˜ã„ã“ã¨ã‚’æŒ‡æ‘˜ã—ã¾ã—ãŸã€‚ ã—ã‹ã—ã€display_errorã‚’ç„¡åŠ¹ã«ã—ã¦ã„ã¦ã‚‚ã€ã‚¨ãƒ©ãƒ¼å‡¦ç†ãŒã¾ãšã„ã¨ã€ã‚¨ãƒ©ãƒ¼è¡¨ç¤ºãŒåŽŸå› ã§XSSè„†å¼±æ€§ãŒå…¥ã‚Šè¾¼ã‚€å ´åˆãŒã‚ã‚Šã¾ã™ã€‚ãƒãƒƒãƒˆä¸Šã®ã‚µãƒ³ãƒ—ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’è¦‹ã¦ã‚‚ã€æ½œåœ¨çš„ã«XSSè„†å¼±æ€§ãŒã‚ã‚‹ã‚‚ã®ãŒå¤šãã‚ã‚Šã¾ã™ã€‚ ã‚µãƒ³ãƒ—ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆ ã¾ãšã¯ã€å…¸åž‹çš„ãªè„†å¼±æ€§ã®ä¾‹ã‚’ã‚¹ã‚¯ãƒªãƒ—ãƒˆã§ç´¹ä»‹ã—ã¾ã™ã€‚PHP+PDO+PostgreSQLã®çµ„ã¿åˆã‚ã›ã§ã™ã€‚ <?php try { $db = new PDO("pgsql:host=localhost options='--client_encoding=UTF8';dbnam
drupa 2015/05/10
XSS

ã‚¹ã‚¯ãƒªãƒ—ãƒˆ

PHP

ã‚¨ãƒ©ãƒ¼
ãƒªãƒ³ã‚¯
PHPå…¥é–€æ›¸ã®SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¨XSSå¯¾ç–ã‚’ã‚ã‚‰ãŸã‚ã¦èª¿ã¹ã¦ã¿ãŸ
ç¶™ç¶šçš„ã«PHPå…¥é–€æ›¸ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã‚’ç¢ºèªã—ã¦ã„ã¾ã™ãŒã€ä»Šå›žã¯ã€Œã‚„ã•ã—ã„PHP ç¬¬3ç‰ˆã€ã‚’å–ã‚Šä¸Šã’ã€ä»Šã©ãã®PHPå…¥é–€æ›¸ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£çŠ¶æ³ã‚’å ±å‘Šã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ ã‚„ã•ã—ã„PHP ã‚„ã•ã—ã„ã‚·ãƒªãƒ¼ã‚º å˜è¡Œæœ¬ â€“ 2008/2/29 ã‚„ã•ã—ã„PHP ç¬¬2ç‰ˆ (ã‚„ã•ã—ã„ã‚·ãƒªãƒ¼ã‚º) å˜è¡Œæœ¬ â€“ 2010/8/28 ã‚„ã•ã—ã„PHP ç¬¬3ç‰ˆ (ã€Œã‚„ã•ã—ã„ã€ã‚·ãƒªãƒ¼ã‚º) å¤§åž‹æœ¬ â€“ 2014/9/26 ä¸Šè¨˜ã®ã‚ˆã†ã«ã€2008å¹´ã«åˆç‰ˆãŒå‡ºç‰ˆã•ã‚ŒãŸå¾Œ2å›žã®æ”¹ç‰ˆãŒã‚ã‚Šã¾ã—ãŸã€‚ ç¬¬2ç‰ˆã§ã¯ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°(XSS)ã®èª¬æ˜ŽãŒè¿½åŠ ã•ã‚Œã€ç¬¬3ç‰ˆã§ã¯XSSã«åŠ ãˆSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®èª¬æ˜ŽãŒè¿½åŠ ã•ã‚Œã¾ã—ãŸã€‚ã¤ã¾ã‚Šã€åˆç‰ˆã§ã¯ã“ã‚Œã‚‰ã®èª¬æ˜Žã¯ãªã‹ã£ãŸã¨ã„ã†ã“ã¨ã§ã™ã€‚ ç¬¬3ç‰ˆã«ãŠã‘ã‚‹SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å¯¾ç–æ–¹æ³•ã¯ãƒ—ãƒ¬ãƒ¼ã‚¹ãƒ›ãƒ«ãƒ€ã«ã‚ˆã‚‹ã‚‚ã®ã§ã€çµæžœã¨ã—ã¦æœ¬æ›¸ã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§ã¯è¦‹å½“ãŸã‚Šã¾ã›ã‚“ï¼ˆãƒ‘ãƒãƒ‘ãƒãƒ‘
drupa 2015/04/21
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

PHP

XSS

SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³
ãƒªãƒ³ã‚¯
è‰²ã‚“ãªXSS â€“ nootropic.me
2015/4/16(æœ¨)ï¼šãƒšãƒ¼ã‚¸ã®ä¸€ç•ªä¸‹ã«è¿½è¨˜ã‚’è¨˜è¿°ã—ã¾ã—ãŸã€‚ ãã®æ˜”ã€ãªã‚“ã¨ã‹ã‚ãƒ£ãƒ³ãƒ—ã¨ã„ã†ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ã‚¤ãƒ™ãƒ³ãƒˆã«å‚åŠ ã—ãŸæ™‚ã€Œã‚¢ã‚¦ãƒˆãƒ—ãƒƒãƒˆãŒå¤§äº‹ã€ã¨è¨€ã‚ã‚ŒãŸã®ã‚’æ€ã„å‡ºã—ã¾ã—ãŸã€‚ ã§ã‚‚ã€æ™®é€šè‡ªåˆ†ã®è¦‹ã¤ã‘ãŸçŸ¥è˜ã¯å¾Œç”Ÿå¤§äº‹ã«æŠ±ãˆã¦ãŠããŸã„ã‚‚ã‚“ã ã¨æ€ã„ã¾ã™ã€‚ ãã“ã§ä»Šå›žã¯ãã†ã„ã£ãŸä½•ã‹ã—ã‚‡ãƒ¼ã‚‚ãªã„ã‚‚ã®ã‚’æ¨ã¦ã‚‹ã¹ãã€æºœã‚è¾¼ã‚“ã è‰²ã‚“ãªXSSã®PoCã‚’å°‘ã—æ›¸ãå‡ºã—ã¦ã¾ã¨ã‚ã¾ã—ãŸã€‚ ä»Šã¾ã§è‡ªåˆ†ã§è¦‹ã¤ã‘ãŸã‚‚ã®ã‚„æµ·å¤–ã®Security Researcheré”ã‹ã‚‰åŽé›†ã—ãŸã‚‚ã®ã‚‚ã‚ã‚Šã¾ã™ã€‚ ã•ã¦ã€ä»Šå›žãƒªã‚¹ãƒˆã‚¢ãƒƒãƒ—ã—ãŸPoCã®è¦‹æ–¹ã§ã™ãŒã„ãã¤ã‹ã®é …ç›®ãŒã‚ã‚Šã¾ã™ã€‚ ä¸€ç•ªä¸Šã®ã€Œæ‰‹æ³•ã€ã¯ã‚¿ã‚¤ãƒˆãƒ«ã¿ãŸã„ãªã‚‚ã®ã ã¨æ€ã£ã¦ä¸‹ã•ã„ã€‚ äºŒç•ªç›®ã®ã€ŒPoCã€ã¯ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å®Ÿè¡Œã™ã‚‹ç‚ºã®ã‚³ãƒ¼ãƒ‰ã§ã™ã€‚æ®†ã©ãŒã‚¢ãƒ©ãƒ¼ãƒˆãŒå‡ºã‚‹ã ã‘ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®ç‚ºå±é™ºãªã‚³ãƒ¼ãƒ‰ã¯ç„¡ã„ã¤ã‚‚ã‚Šã§ã™ãŒã”è‡ªåˆ†ã®ãƒ–ãƒ©ã‚¦ã‚¶ã§å®Ÿè¡Œã™ã‚‹éš›ã¯è‡ªå·±è²¬ä»»ã§ãŠé¡˜ã„ã—ã¾ã™ã€‚ãƒªãƒ³ã‚¯ã‚’ã‚¯ãƒªãƒƒ
drupa 2015/04/13
ã„ã„ã¾ã¨ã‚!

ãƒ–ãƒ©ã‚¦ã‚¶

IE

XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
JavaScript:element.setAttributeã—ãŸã¨ãã®ã€HTMLã¯ã©ã†ãªã£ã¦ã„ã‚‹ã‹ï¼Ÿ
å®Ÿé¨“ç”¨ã‚³ãƒ¼ãƒ‰ï¼š <form onsubmit="return false;"> <b>input_text:</b><br /> <textarea id="input-text" rows="4" cols="80"> ">Hello!</textarea><br /> ä¾‹ï¼‰">Hello!<br /> <input type="button" value="å®Ÿè¡Œ" onclick="runTest_setAttribute_outerHTML();" /><br /> </form> <br /> <b>element.setAttribute("title", input_text)ã®outerHTMLï¼š</b><br /> <textarea id="output-html" rows="4" cols="80"> ã“ã“ã«ãƒ‡ãƒ¼ã‚¿å‡ºåŠ› </textarea><br
drupa 2015/02/27
JavaScriptã«ã¦ã€DOM Based XSS ã‚’é˜²ãã«ã¯ã€DOMæ“ä½œãƒ¡ã‚½ãƒƒãƒ‰ã‚’ä½¿ç”¨ã™ã‚‹ã¨è‰¯ã„ã¨ã•ã‚Œã¦ã„ã¾ã™ã€‚å®Ÿéš›ã«å®‰å…¨ã‹ã©ã†ã‹ã‚’ setAttribute ã«å¯¾ã—ã¦æ¤œè¨¼ã—ã¾ã—ãŸã€‚

DOM Based XSS

HTML

JavaScript

XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
JavaScript:document.createTextNodeã‚’appendChildã—ãŸã¨ãã®ã€HTMLã¯ã©ã†ãªã£ã¦ã„ã‚‹ã‹ï¼Ÿ
JavaScript:document.createTextNodeã‚’appendChildã—ãŸã¨ãã®ã€HTMLã¯ã©ã†ãªã£ã¦ã„ã‚‹ã‹ï¼Ÿ ã‚¤ãƒ³ãƒˆãƒãƒ€ã‚¯ã‚·ãƒ§ãƒ³ JavaScript ã«ã¦ã€ã€ŒDOM Based XSSã€ã®è„†å¼±æ€§ã‚’åŸ‹ã‚è¾¼ã‚€ã®ã‚’é˜²ããŸã‚ã«ã¯ã€document.write ã‚„ element.innerHTML ãªã©ã‚’ä½¿ã†ã®ã§ã¯ãªãã€ä»¥ä¸‹ã®ã‚ˆã†ã« DOM æ“ä½œç”¨ãƒ¡ã‚½ãƒƒãƒ‰ã‚’ä½¿ç”¨ã™ã‚‹ã¨è‰¯ã„ã¨ã•ã‚Œã¦ã„ã¾ã™ã€‚ å…¥åŠ›ã•ã‚ŒãŸãƒ†ã‚ã‚¹ãƒˆã‚’ãƒ–ãƒ©ã‚¦ã‚¶ã®ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã«è¡¨ç¤ºï¼š element.appendChild(document.createTextNode(input_text)); input_text : å…¥åŠ›ã•ã‚ŒãŸãƒ†ã‚ã‚¹ãƒˆ element : ãƒ†ã‚ã‚¹ãƒˆã‚’è¿½åŠ ã™ã‚‹è¦ªè¦ç´ (element ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆ) ã“ã®ã¨ãã€ãƒ†ã‚ã‚¹ãƒˆã‚’è¿½åŠ ã—ãŸè¦ªè¦ç´ ã® HTML ãŒã€å…¥åŠ›ã•ã‚ŒãŸãƒ†ã‚ã‚¹ãƒˆã«ã‚ˆã£ã¦ã©ã†ãªã‚‹ã®ã‹æ°—ã«ãªã‚Š
drupa 2015/02/27
JavaScriptã«ã¦ã€DOM Based XSS ã‚’é˜²ãã«ã¯ã€DOMæ“ä½œãƒ¡ã‚½ãƒƒãƒ‰ã‚’ä½¿ç”¨ã™ã‚‹ã¨è‰¯ã„ã¨ã•ã‚Œã¦ã„ã¾ã™ã€‚å®Ÿéš›ã«å®‰å…¨ã‹ã©ã†ã‹ã‚’ createTextNode ã«å¯¾ã—ã¦æ¤œè¨¼ã—ã¾ã—ãŸã€‚

DOM Based XSS

HTML

JavaScript

XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ï¼šJavaScriptã§HTMLæ“ä½œã‚’ã™ã‚‹äººã¯å¿…èªï¼IPAãƒ†ã‚¯ãƒ‹ã‚«ãƒ«ã‚¦ã‚©ãƒƒãƒã€€ã€ŽDOM Based XSSã€ã«é–¢ã™ã‚‹ãƒ¬ãƒãƒ¼ãƒˆ
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ï¼šJavaScriptã§HTMLæ“ä½œã‚’ã™ã‚‹äººã¯å¿…èªï¼IPAãƒ†ã‚¯ãƒ‹ã‚«ãƒ«ã‚¦ã‚©ãƒƒãƒã€€ã€ŽDOM Based XSSã€ã«é–¢ã™ã‚‹ãƒ¬ãƒãƒ¼ãƒˆ ã‚¤ãƒ³ãƒˆãƒãƒ€ã‚¯ã‚·ãƒ§ãƒ³ èª°ã§ã‚‚æ‰‹è»½ã«ä½¿ãˆã¦ä¾¿åˆ©ãª JavaScript ã§ã™ãŒã€æ›¸ãæ–¹ã‚’é–“é•ãˆã‚‹ã¨é‡å¤§ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®å•é¡Œï¼ˆè„†å¼±æ€§ï¼‰ã‚’å¼•ãèµ·ã“ã—ã¦ã—ã¾ã„ã¾ã™ã€‚ ãã‚“ãª JavaScript ã‚’ä½¿ã£ãŸãƒ—ãƒã‚°ãƒ©ãƒ ã®è„†å¼±æ€§ã®ä¸ã§ã‚‚ã€ã†ã£ã‹ã‚Šä½œã‚Šã“ã‚“ã§ã—ã¾ã„ãŒã¡ãªã®ãŒã€ã€ŒDOM Based XSSã€ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ï¼Ÿ DOM Based XSS ã¯ã€JavaScript ã‚’ä½¿ç”¨ã—ã¦ã€ãƒ–ãƒ©ã‚¦ã‚¶ã§è¡¨ç¤ºã—ã¦ã„ã‚‹ HTML æ§‹é€ ã«æ‰‹ã‚’åŠ ãˆã‚‹ã¨ãã«åŸ‹ã‚è¾¼ã‚“ã§ã—ã¾ã„ãŒã¡ãªè„†å¼±æ€§ã§ã™ã€‚ ä¾‹ãˆã°ã€ãƒ–ãƒ©ã‚¦ã‚¶ã§è¡¨ç¤ºã—ã¦ã„ã‚‹ç”»é¢ã‚’ã€document.write ã‚„ element.innerHTML ãªã©ã§æ›¸ãæ›ãˆã¦ã„ã¾ã›ã‚“ã‹ï¼Ÿ ï¼ˆãã‚Œã‚‰ä»¥å¤–ã«ã‚‚ã€å±é™ºãªãƒ¡ã‚½ãƒƒãƒ‰ãƒ»ãƒ—ãƒãƒ‘ãƒ†ã‚£ã¯ã‚ã‚Š
drupa 2015/02/27
JavaScriptã§HTMLæ“ä½œã‚’ã™ã‚‹äººã¯ã€IPAãƒ†ã‚¯ãƒ‹ã‚«ãƒ«ã‚¦ã‚©ãƒƒãƒã€€ã€ŽDOM Based XSSã€ã«é–¢ã™ã‚‹ãƒ¬ãƒãƒ¼ãƒˆã¯å¿…èªã§ã™ï¼å®‰å…¨ãªã‚³ãƒ¼ãƒ‰ã‚’æ›¸ã‘ã‚‹ã‚ˆã†ã«ã—ã¾ã—ã‚‡ã†ã€‚

DOM Based XSS

HTML

JavaScript

Mutation-based XSS

XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
mXSS - Mutation-based Cross-Site-Scripting ã®ã¯ãªã— - è‘‰ã£ã±æ—¥è¨˜
ã“ã“æ•°å¹´ã€XSSæ¥ç•Œã®æœ€å…ˆç«¯ã§ç››ã‚Šä¸ŠãŒã£ã¦ã„ã‚‹è©±é¡Œã¨ã—ã¦ mXSS ã¨ã„ã†ã‚‚ã®ãŒã‚ã‚Šã¾ã™ã€‚mXSS - Mutation-based XSS ã¨ã¯ã€ä¾‹ãˆã° innerHTML ãªã©ã‚’çµŒç”±ã—ã¦ã™ã§ã«æ§‹ç¯‰ã•ã‚Œã¦ã„ã‚‹DOMãƒ„ãƒªãƒ¼ã‚’å‚ç…§ã—ãŸã¨ãã«ã€æœ¬æ¥ã®DOMæ§‹é€ ã¨ã¯ç•°ãªã‚‹çµæžœã‚’å¾—ã¦ã—ã¾ã„ã€ãã®ãŸã‚ã«HTMLæ§‹é€ ã®ç ´å£Šã‚’å¼•ãèµ·ã“ã™ã¨ã„ã†é¡žã®DOM based XSSã®äºœç¨®ã¨ã‚‚è¨€ãˆã¾ã™ã€‚ mXSSã«é–¢ã—ã¦ã¯ä»¥ä¸‹ã®è³‡æ–™ãªã©ãŒå‚è€ƒã«ãªã‚Šã¾ã™ã€‚ The innerHTML Apocalypse mXSS Attacks: Attacking well-secured Web-Applications by using innerHTML Mutations ã©ã¡ã‚‰ã®è³‡æ–™ã«ã‚‚æŽ²è¼‰ã•ã‚Œã¦ã„ã¾ã™ãŒã€mXSSã®ãã£ã‹ã‘ã¨ãªã£ãŸã®ã¯ ã€Œæ•™ç§‘æ›¸ã«è¼‰ã‚‰ãªã„Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ï¼ˆ1ï¼‰ï¼šï¼»ã“ã‚Œã¯ã²ã©ã„ï¼½IEã®
drupa 2015/02/27
XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

HTML

JavaScript
ãƒªãƒ³ã‚¯
è„†å¼±æ€§ç™ºè¦‹ã®ãƒ—ãƒã€Œã‚ãƒŒã‚¬ãƒ¯ ãƒžã‚µãƒˆã€ã•ã‚“ã¯æ—¥æœ¬äººã ã£ãŸ
è„†å¼±æ€§ã‚’è¦‹ã¤ã‘ã¦ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã«è²¢çŒ®ã—ã¦ã„ã‚‹ã®ãŒã€ã€Œãƒã‚°ãƒãƒ³ã‚¿ãƒ¼ã€ã¨å‘¼ã°ã‚Œã‚‹å˜åœ¨ã ã€‚Googleãªã©ãƒ™ãƒ³ãƒ€ãƒ¼ã®å ±å¥¨é‡‘ã§ç”Ÿè¨ˆã‚’ç«‹ã¦ã¦ã„ã‚‹ã¨ã„ã†ã€Œã‚ãƒŒã‚¬ãƒ¯ ãƒžã‚µãƒˆã€ã•ã‚“ãŒã€ãƒ—ãƒã®ãƒã‚°ãƒãƒ³ã‚¿ãƒ¼ã¨ã—ã¦ã®â€œæ„‰ã—ã¿â€ã‚’ç´¹ä»‹ã—ã¦ãã‚ŒãŸã€‚ ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®ãƒã‚°ã‚„è„†å¼±æ€§ã¯ã€è»½å¾®ãªä¸å…·åˆã‹ã‚‰ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®æ·±åˆ»ãªå•é¡Œã‚’å¼•ãèµ·ã“ã™ã‚‚ã®ã¾ã§ã€æ§˜ã€…ãªã‚‚ã®ãŒã‚ã‚‹ã€‚é–‹ç™ºè€…ãŒå¹¾ã‚‰æ³¨æ„ã—ã¦ã‚‚è„†å¼±æ€§ã‚’ãªãã™ã“ã¨ã¯éžå¸¸ã«é›£ã—ã„ãŒã€å¤–éƒ¨ã®ç«‹å ´ã‹ã‚‰è„†å¼±æ€§ã‚’è¦‹ã¤ã‘ã¦ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã«è²¢çŒ®ã™ã‚‹ã€Œãƒã‚°ãƒãƒ³ã‚¿ãƒ¼ã€ã¨ã„ã†å˜åœ¨ã‚’ã”å˜ã˜ã ã‚ã†ã‹ã€‚ Googleã‚„Microsoftã€ã‚µã‚¤ãƒœã‚¦ã‚ºãªã©ä¸€éƒ¨ã®ãƒ™ãƒ³ãƒ€ãƒ¼ã¯ã€è„†å¼±æ€§ã‚’å ±å‘Šã—ãŸãƒã‚°ãƒãƒ³ã‚¿ãƒ¼ã«å ±å¥¨é‡‘ãªã©ã‚’æ”¯æ‰•ã†åˆ¶åº¦ã‚’é‹å–¶ã€‚ãã®å ±å¥¨é‡‘ã§ç”Ÿè¨ˆã‚’ç«‹ã¦ã‚‹ãƒ—ãƒã®ä¸€äººãŒã€Œã‚ãƒŒã‚¬ãƒ¯ ãƒžã‚µãƒˆã€ã•ã‚“ã ã€‚12æœˆ18ã€19æ—¥ã«è¡Œã‚ã‚ŒãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã€ŒCODE BLUEã€ã§ã¯ã€ã‚ãƒŒã‚¬ãƒ¯ã•ã‚“ãŒãƒ—ãƒã®ãƒã‚°ãƒãƒ³ã‚¿
drupa 2014/12/21
XSS

google

ãƒã‚°

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

web
ãƒªãƒ³ã‚¯
Masato Kinugawa Security Blog: ãŸã¶ã‚“XSSãŒç†ç”±ã§ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãŒã¨ã¾ã£ãŸ
æ˜”è‡ªåˆ†ãŒåˆ©ç”¨è€…ã ã£ãŸã‚µã‚¤ãƒˆã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œ(XSS)ã‚’ã„ãã¤ã‹å ±å‘Šã—ã¦ã„ãŸã®ã§ã™ãŒã€ãŠãã‚‰ããã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’ç†ç”±ã«ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãŒä½¿ãˆãªããªã‚Šã¾ã—ãŸã€‚ãƒ—ãƒãƒã‚¤ãƒ€ã«æŽ¥ç¶šã‚’æ¢ã‚ã‚‰ã‚ŒãŸã®ã§ã™ã€‚ ãã®ã‚µã‚¤ãƒˆã§å•é¡Œã‚’ã¿ã¤ã‘ãŸã¨ãã€ã‚µãƒ¼ãƒ“ã‚¹æä¾›è€…å´ã®åå¿œã‚’ç¤ºã™å…†å€™ãŒã‚ã‚Šã¾ã—ãŸã€‚ å•é¡Œã‚’ç™ºè¦‹å¾Œã€ã—ã°ã‚‰ãã—ã¦ã‚¢ã‚¯ã‚»ã‚¹ã—ã‚ˆã†ã¨ã™ã‚‹ã¨ã€ã‚¢ã‚¯ã‚»ã‚¹ã‚’æ‹’å¦ã•ã‚ŒãŸã‹ã‚‰ã§ã™ã€‚ ã‚µãƒ¼ãƒ“ã‚¹æä¾›è€…ã«ã¯å•é¡Œã‚’å ±å‘Šã—ã€ã‚¢ã‚¯ã‚»ã‚¹æ‹’å¦ã«ã¤ã„ã¦ã‚‚ã€ä¸€å¿œã€ä»Šå ±å‘Šã—ã¦ã‚‹é€šã‚Šã“ã‚Œã¯æ”»æ’ƒã§ã¯ãªã„ã®ã§èª¤è§£ãªãã‚ˆã†ã‚ˆã‚ã—ãã¨ãƒ¡ãƒ¼ãƒ«é€£çµ¡ã—ãŸã¨ã“ã‚ã€å•é¡Œã¯ä¿®æ£ã•ã‚Œã¾ã—ãŸã€‚ ã“ã‚Œã§çœŸæ„ã¯ä¼ã‚ã‚Šã€ã‚¢ã‚¯ã‚»ã‚¹ã¨é–¢é€£ä»˜ã‘ã‚‰ã‚Œã€ã‚¢ã‚¯ã‚»ã‚¹æ‹’å¦ã«å¯¾ã™ã‚‹èª¤è§£ã‚‚è§£æ±ºã—ãŸã ã‚ã†ã¨æ€ã£ãŸã®ã§ã™ãŒã€ãã®å¾Œæ€¥ã«ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãŒä½¿ãˆãªã„äº‹æ…‹ã«ã¾ã§ãªã‚‹ã¨ã¯ã ã‚ŒãŒäºˆæƒ³ã§ããŸã§ã—ã‚‡ã†ã‹â€¦ã€‚(ä»Šã¯æºå¸¯ã®å›žç·šã‚’ä½¿ã£ã¦ã„ã¾ã™) ãƒ—ãƒãƒã‚¤ãƒ€ã‹ã‚‰æ›¸é¢ãŒå±Šãã€æ›¸é¢ã«ã¯å•é¡Œã®å ±å‘Šæ™‚ã¨ã»ã¼åŒã˜æ—¥ä»˜ã«
drupa 2014/12/21
XSS

ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆ

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
è¦‹ç¿’ã„ãƒã‚°ãƒãƒ³ã‚¿ãƒ¼ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ–ãƒã‚°: Amazon.co.jpã«ã‚ã£ãŸXSSã®è„†å¼±æ€§ãŒä¿®æ£ã•ã‚Œã¾ã—ãŸ
2014å¹´11æœˆ7æ—¥é‡‘æ›œæ—¥ Amazon.co.jpã«ã‚ã£ãŸXSSã®è„†å¼±æ€§ãŒä¿®æ£ã•ã‚Œã¾ã—ãŸ Amazonã®è„†å¼±æ€§ã‚’è¦‹ã¤ã‘ã¦Amazonã‚®ãƒ•ãƒˆåˆ¸ã‚’ã‚²ãƒƒãƒˆã™ã‚‹ã¨ã„ã†å¤¢ãŒã‚ã‚‹â€” ã‚‰ã¾ã£ã“ (@llamakko_cafe) 2014, 10æœˆ 17 æ—©é€Ÿå¤¢ã‚’å¶ãˆã‚‹ã¹ãAmazon.co.jpã®è„†å¼±æ€§ã‚’æŽ¢ã™ã“ã¨ã«ã€‚ æ•°åˆ†å¾Œâ€¦ã€‚ ã†ã‘ã‚‹â€” ã‚‰ã¾ã£ã“ (@llamakko_cafe) 2014, 10æœˆ 17 è¦‹ã¤ã‘ã¡ã‚ƒã„ã¾ã—ãŸã€‚ ã“ã®é–“4åˆ†ã€‚ è¦‹ã¤ã‘ãŸè„†å¼±æ€§ã¯XSSã§ã™ã€‚ ä»¥ä¸‹ãã®XSSã®è„†å¼±æ€§ã®è§£èª¬ã§ã™ã€‚ ä»Šå›žã¯ä¾‹ã¨ã—ã¦ã“ã®URLã‚’ä½¿ç”¨ã—ã¾ã™ã€‚ http://www.amazon.co.jp/%E3%83%A4%E3%82%AC%E3%82%A4-%E3%81%8A%E3%82%84%E3%81%A4%E3%82%AB%E3%83%AB%E3%83%91%E3%82%B9-50%E6%
drupa 2014/11/08
ãã‚“ãªè„†å¼±æ€§ãŒæ®‹ã£ã¦ã„ãŸã®ã‹ã€‚ã†ã£ã‹ã‚Šãƒªãƒ³ã‚¯è¸ã‚€ã®ã¯æ€–ã„

Amazon

è„†å¼±æ€§

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

JavaScript

XSS
ãƒªãƒ³ã‚¯
1