1

http://stegosploit.info/

I looking into having users upload their images directly to AWS S3 to save on costs (rather than going through a traditional server and re-encoded with mozjpeg), but this would theoretically open up the stegosploit vulnerability based on what I've read.

The part that I don't understand is: does the exploit require the image to be loaded in <script></script> (the website admin must be in on the exploit), or does the image itself contain the <script></script> (a website user can upload the image for the exploit)?

2 Answers 2

2

To answer the question: The website admin must be in on the exploit.

The encoding technique is there to obfuscate the actual exploit scripts, thus flying under the radar from current detection methods. It still requires HTML/Javascript to be on the webpage in order to decode and run the exploit.

That is to say, if I had encoded an exploit into pleasedontrunthis.jpg, I (the web admin), would still need to open the image like so:

<script src="pleasedontrunthis.jpg">

To answer the question in the title: Not really.

This is an encoding technique, not an exploit. It requires the would-be attacker to serve malicious Javascript in order to... server malicious Javascript. This technique could provide sufficient obfuscation to hide itself from both automated and human scanners for a potentially longer period of time than exploits which offer huge walls of text simply by hitting F12.

In practice this means that someone could hack a website (ie, through a Wordpress vulnerability), and deliver a silent exploit that would take longer to find.

In reality, if an exploit in the toolkit was capable of pwning your machine, it would have most likely pwned your machine either way. The reality being that not all malicious code is going to make itself glaringly obvious, so there's always an inherent risk when deciding to allow it.

3
  • Could you talk a bit about/debunk the canvas method?
    – davidtgq
    Jun 7, 2016 at 23:59
  • There's nothing to debunk. Canvas happens to be a portion of the decryption method.
    – user41341
    Jun 8, 2016 at 0:00
  • So if your code allows for users to not only upload to a server, but run the image on a webpage, you could run an exploit? It seems that as long as Images are allowed to be run, you don't exactly need Web Admin approval after the fact... or am I missing something?
    – XaolingBao
    Jun 8, 2016 at 1:21
1

There are two parts on http://stegosploit.info/

The first one is about hosting the javascript exploit in an image file loaded through canvas. As such, it's not really interesting since in order to be exploited, the attacker would already need to be able to insert javascript into the webpage.

The second part involves also including the html into the image file, which is the typical case of polyglot abuse. What you need to take into account is that the file is really interpreted by the client as the type you expect it to be. This means providing a Content-Type and not having the browser guess the content type on its own.

This is much less messy nowadays, and the MIMESNIFF spec defines what should be done by the user agents. Still, there will be differences, and how old do you consider to still be modern will be important (mainly Internet Explorer versions). X-Content-Type-Options: nosniff is available since IE 8, though.

4
  • "The first one is about hosting the javascript exploit in an image file loaded through canvas." I think the javascript library I'm using fineuploader.com/index.html loads the image into a HTML5 canvas to resize it, would that be vulnerable to the first one?
    – davidtgq
    Jun 7, 2016 at 23:53
  • @DavidTan no. This only involves using a canvas to load the javascript from the image, something that would be done on purpose (or using a library that was compromised to do that).
    – Ángel
    Jun 7, 2016 at 23:56
  • This is perhaps beyond the scope of the question, but for some background info, what occurs when an image is loaded into a canvas? Does it add a base64 string to the HTML inside the <canvas> tags or something?
    – davidtgq
    Jun 8, 2016 at 0:04
  • canvas is an element allowing javascript to access the pixels. This allows javascript to perform many advanced actions, but would also allow to store secrets/virii in the images.
    – Ángel
    Jun 8, 2016 at 0:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .