Mutation XSS By Adithya Raj

Contents 1 INTRODUCTION 3 NAMESPACES 5 MUTATION USING NESTED FORM TAGS 2 WHAT IS A SANITIZATION 4 MUTATION IN AMMONIA 6 THE FIX!!! LIBRARY?

Introduction Everyone knows what XSS is and how much impact this holds. What if the user input is reflected on to the DOM but it is filtered. That’s where mutation XSS comes into play. Mutation XSS happens when a safe html is parsed into an unsafe html because of bugs in browser parsing.

Let’s check something shall we. What will be the output of the html code? Will an alert pop up? <form><math><mtext></form><form><mglyph> <style></math><img src onerror=alert(1)> No, It won’t pop up an alert

Now how about the serialized html code of the previously parsed Dom->

<form><math><mtext><form><mglyph> <style></math><img src onerror=alert(1)> </style></mglyph></form></mtext></math> </form> Wow, this pops up an alert!!!

Yes, the Second html code pops up an alert box but WHY?? Before we ponder into that que stion let’s look at some things that you sh ould know.

y r a r b i L n o i t a z i t i n a S ? s k r o w y f i r u p m o D e k i ) l l y m r t a H r t b i u l p n n i o ( i t e z a i z t i i t i n n a s a . S y f a i r s u e p o M d O w D = Ho l m t h r e n n div.i s p e e t e s r t e s M e O h D t a s e o o t e g n i r e r e d p t d e u n s k M u r r O a a t e D I p h m t s s i l i h s l m t e t m s s h t r e H o a z i t t p t u n i i r n k e a inp c s s a w y b o f e i r d h r b t e u z p i e l o h M t a i t O r , d l D e e s n m d t s e n i h h e r e T p e e p r n t a n i M s i e O h D h t c i e o h h t w t n e e e r Then t m t n g i M s O s a D e a h t o t r n i k Afte c a b p u k r a m l . e e htm r t M O D t n e m u doc

y r a r b i L n o i t a z i t i n a S : r e d r o s i h t w o l l o f g s n i n s o i r t a a p r e p ➡️ o g n i z i The l t a i i r t e u s p t u ➡️ o g e n i h t s t a par h t n . o i e t p m a m s u e s s h t a e e b h l t l i n w o g k r n i o s r w a s p e i r r e a s r b w i l o r n b o i e t h a t z . i r e t i e n t m i f a t a s y r e e e e s v r e e t h T e M u O r t D e e b h t t o d n n t a h s g e i v i m g s i h t . S s r S X e s n o w i o t r a b t u in M s o g t u s b d o a t e l e u s D Thi

MathML INtegration Points HTML Integrati on Points <annotat ion-xml> <foreignO bject> <desc> <title> <mglyph> Namespa ces <mtext> <mi> <mo> <mn> <ms> <malignmar k>

Mutation In Ammonia

Mutation using From Tags <form><math><mtext></form><form> <mglyph><style></math><img src onerror=alert(1)> Payload Parsed

Mutation using From Tags <form><math><mtext><form><mglyph><style> </math><img src onerror=alert(1)></style></mglyph> </form></mtext></math></form> Serialized parsed

Nested <form> <form id=”first”>inside form1 <form id=“second”> inside form2 Mis-nested <form>

<form id=”first” >inside form1 <div></form> <form id=”second”> inside form2

Now if the mis-nested forms are parsed and serialized again then it will give. <form id=”first”>inside form1<div><form id=”second”>inside form2</form></div> </form> If it is parsed again it will give the following dom tree

n i a g a e c n o d a o l y a p e h t t a k o o l s ’ t e l Now t> x e t m < > h t a m < > > m r m r o <fo f < > m r o f > / < e l y t <s > h p y l c r <mg s g m <i > h t a > ) 1 ( </m t r e l a = r o r oner d a o l y Pa

e l y t s < > h p y l g <m > > m e r l y o t f < s / < > xt> ) e 1 ( t t r m e < l > > a h = t m r r a o o r m f r < e </ > h t a <form> ><img src on /m < > t x e h t m / < > </mat m or f / < > h p </mgly e l y t s < > h p y l g <m > t x e t > t m x < > e t h t a /m < m > < h > p m y )> l 1 ( g t r m <for / e l < a > = e l r y o t r s r / e < n o c r s mg i < > h t </ma d e s r a P d e z i l a i Ser d e s r a P XSS

The Fix

Referen ces https:// researc h.secur com/mu itum. tation-x ss-viamathm l-mutat dompur ionify-2-0 -17-bypa ss/ https:// researc h.securi um.com t /helping -secure dompur ify-part -1/ t s a e B g n i t a t A Mu https:/ /resea rch.sec um.com u rit /dompu rifybypass -usingmxss/ https://cure53.de/fp170. pdf