Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities :

  1. RFI inside SWF file.

Example: https://www.site.com/opis.swf?sTitle=Vulnerable&sDesc=Again vulnerable&sPrice=Vulnerable&sCoverFront=http://www.neurosciencemarketing.com/blog/wp-content/photos/smiley1.jpg&sCoverBack=http://www.neurosciencemarketing.com/blog/wp-content/photos/smiley1.jpg&sBuyLink=http://www.google.com&sPath=http://www.neurosciencemarketing.com/blog/wp-content/photos/smiley1.jpg

As you can see sTitle and sDesc are text values , sCoverFront and sCoverBack are .jpg, sBuyLink is redirection url (my ideas is XSS vector: data:text/html,alert(document.cookie)) and sPath seems to be url for m4u video. Pick of swf applet: <code>http://www.zaslike.com/files/1jt0kj4ve4cpbifj5qlq.jpg</code>

  1. RFI for image source link.

Example: http://site.com/static/Covers.htm?b=http://www.stringfunction.com/img/url-encode-url-decode.jpg&f=http://www.stringfunction.com/img/url-encode-url-decode.jpg

And here is code for src settings:

<body onload="resizeToCovers()"><div id="resizer"></div>
    <table cellspacing="0" cellpadding="0"><tr><td><img src="" id="frontBoxCover" /></td><td><img src="" id="backBoxCover" /></td></tr></table>
  <script type="text/javascript">
    var boxFront;
    var boxBack;
    boxFront = document.getElementById("frontBoxCover");
    boxBack = document.getElementById("backBoxCover");
    var qs = new Querystring();
    var newF =  qs.get('f','');
    boxFront.src = newF;
    var newB = qs.get('b', '');
    if(newB == ''){
        boxBack.style.displayFormat = "none";
    }   
    boxBack.src = newB;
  </script>

And for Querystring:

/* Client-side access to querystring name=value pairs
    Version 1.2.3
    22 Jun 2005
    Adam Vandenberg
*/
function Querystring(qs) { // optionally pass a querystring to parse
    this.params = new Object()
    this.get=Querystring_get

    if (qs == null)
        qs=location.search.substring(1,location.search.length)

    if (qs.length == 0) return;

// Turn <plus> back to <space>
// See: http://www.w3.org/TR/REC-html40/interact/forms.html#h-17.13.4.1
    qs = qs.replace(/\+/g, ' ')
    var args = qs.split('&') // parse out name/value pairs separated via &

// split out each name=value pair
    for (var i=0;i<args.length;i++) {
        var value;
        var pair = args[i].split('=')
        var name = unescape(pair[0])

        if (pair.length == 2)
            value = unescape(pair[1])
        else
            value = name

        this.params[name] = value
    }
}

function Querystring_get(key, default_) {
    // This silly looking line changes UNDEFINED to NULL
    if (default_ == null) default_ = null;

    var value=this.params[key]
    if (value==null) value=default_;

    return value;
}

Is there any vuln in these, are they worth of reporting. Thank you.

share|improve this question
    
It was confusing for me to understand your question. If you're asking if it's a risk to permit the URL can be altered (sTitle and sDesc) and have that display directly in the flash object, please clarify your question. Also, use this site's editing tools to embed your JPEG that is located on zaslike.com –  makerofthings7 Nov 28 '12 at 17:32
    
Yes that is what I want to know I don't want to tell system admin : "Hey you have vulnerability , I can show my picture on your site" , seems kind of funny :) . Is there any way that this kind of "vulnerability" can be exploited any further. Seems like no other files can be included . –  user1203028 Nov 28 '12 at 17:42
add comment

2 Answers 2

up vote 2 down vote accepted

I wrote a few blog posts about this a while back.

http://erlend.oftedal.no/blog/?blogid=103 http://erlend.oftedal.no/blog/?blogid=99

Especially the XSS is a problem, but also displaying random pictures on a trusted website can be a bad thing. Think political or racist messages or porn. The URL starts with something the users trust, but you end up at something very different.

share|improve this answer
add comment

If I were creating this, I would avoid any type of RFI (whether it can be practically exploited or not doesn't matter). If a hole exists but there seems to be no risk, it's just asking for trouble. I would let the webmaster or whoever you think you should contact know what you found. Linking to some vulnerabilities regarding remote file inclusion will help bring your point across. This is a good resource

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.