Could XSS lead us to the Local File Include or Remote File Include? I read article that it's possible to upload shell via XSS vulnerability, but I still have no idea how it had been achieved.

  • Please provide links to the articles you mentioned. Jun 6 '12 at 12:57

Server-side "remote file inclusion" vulnerabilities are sometimes classified as XSS, because they include server-side script from another site. I suggest not to use this classification because most people associate XSS with JavaScript.

That being said, JavaScript XSS may lead to a server side remote include: Assume there is a function which allows administrators to upload plugins. If there is a XSS vulnerability somewhere in the same domain, an attacker can use it, to gain access to the administrator-session and upload arbitrary program code, such as phpshell.

Furthermore the upload function might not even be intended for plugins but just for images. It might not properly validate the upload, and put the uploaded files into a directory in which .php files are executed, for example.

This might either be a bug because the developers were not aware of the risks, or just a dangerous omission based on the assumptions that only trustworthy people upload files. That's were the XSS vulnerability comes into play.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.