Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: [Full-disclosure] [WEB SECURITY] Universal XSS with PDF files: highly dangerous
From: Amit Klein (aksecuritygmail.com)
Date: Tue Jan 02 2007 - 23:17:44 CST
pdp (architect) wrote:
> I will be very quick and just point to links where you can read about
> this issue.
> apparent reason by using the following template:
> You must understand that the attacker doesn't need to have write
> access to the specified PDF document. In order to get an XSS vector
> working you need to have a PDF file hosted on the target and that's
> all about it. The rest is just a matter of your abilities and desires.
Amazing, and kudos to Sven Vetsch who found this.
Note that from attack categorization perspective, it appears to be a
twisted example of DOM based XSS
(http://www.webappsec.org/projects/articles/071105.shtml). I suppose PDF
retrieves the URL from the browser (probably from a degenerate DOM the
browser provides it - after all, the document object is available to the
payload JS code!), parses it and uses the fragment. Since fragments are
used, the payload doesn't travel to the target web server (!). I
mentioned the possible use of fragments as a particularly nasty attack
vector (impossible to detect on server) in the "DOM based XSS" writeup.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/