Is Stegosploit a real concern with modern browsers?

Question

http://stegosploit.info/

I looking into having users upload their images directly to AWS S3 to save on costs (rather than going through a traditional server and re-encoded with mozjpeg), but this would theoretically open up the stegosploit vulnerability based on what I've read.

The part that I don't understand is: does the exploit require the image to be loaded in <script></script> (the website admin must be in on the exploit), or does the image itself contain the <script></script> (a website user can upload the image for the exploit)?

Answer 1

To answer the question: The website admin must be in on the exploit.

The encoding technique is there to obfuscate the actual exploit scripts, thus flying under the radar from current detection methods. It still requires HTML/Javascript to be on the webpage in order to decode and run the exploit.

That is to say, if I had encoded an exploit into pleasedontrunthis.jpg, I (the web admin), would still need to open the image like so:

<script src="pleasedontrunthis.jpg">

To answer the question in the title: Not really.

This is an encoding technique, not an exploit. It requires the would-be attacker to serve malicious Javascript in order to... server malicious Javascript. This technique could provide sufficient obfuscation to hide itself from both automated and human scanners for a potentially longer period of time than exploits which offer huge walls of text simply by hitting F12.

In practice this means that someone could hack a website (ie, through a Wordpress vulnerability), and deliver a silent exploit that would take longer to find.

In reality, if an exploit in the toolkit was capable of pwning your machine, it would have most likely pwned your machine either way. The reality being that not all malicious code is going to make itself glaringly obvious, so there's always an inherent risk when deciding to allow it.

Answer 2

There are two parts on http://stegosploit.info/

The first one is about hosting the javascript exploit in an image file loaded through canvas. As such, it's not really interesting since in order to be exploited, the attacker would already need to be able to insert javascript into the webpage.

The second part involves also including the html into the image file, which is the typical case of polyglot abuse. What you need to take into account is that the file is really interpreted by the client as the type you expect it to be. This means providing a Content-Type and not having the browser guess the content type on its own.

This is much less messy nowadays, and the MIMESNIFF spec defines what should be done by the user agents. Still, there will be differences, and how old do you consider to still be modern will be important (mainly Internet Explorer versions). X-Content-Type-Options: nosniff is available since IE 8, though.