2

I saw today this report: https://hackerone.com/reports/191380. There, the hacker uploaded a file with JavaScript in it, which he could successfully trigger that code. But I do not understand two things and maybe you can help me to clarify this.

First of all, where does the hacker put in the JavaScript Code. When using the tool dhex, I get this output and I can see also the JavaScript code

<code>dhex</code> output of the uploaded file

The file is also a valid jpeg file, so I can open it and look at it. When looking into the Metatags with exiftool, I do not see any JavaScript Code:

ExifTool Version Number         : 10.23
File Name                       : xss.jpg
Directory                       : .
File Size                       : 57 kB
File Modification Date/Time     : 2017:07:06 19:02:47+02:00
File Access Date/Time           : 2017:07:06 19:06:44+02:00
File Inode Change Date/Time     : 2017:07:06 19:02:47+02:00
File Permissions                : rwxrwxrwx
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.01
Resolution Unit                 : inches
X Resolution                    : 72
Y Resolution                    : 72
Profile CMM Type                : lcms
Profile Version                 : 2.1.0
Profile Class                   : Display Device Profile
Color Space Data                : RGB
Profile Connection Space        : XYZ
Profile Date Time               : 2012:01:25 03:41:57
Profile File Signature          : acsp
Primary Platform                : Apple Computer Inc.
CMM Flags                       : Not Embedded, Independent
Device Manufacturer             : 
Device Model                    : 
Device Attributes               : Reflective, Glossy, Positive, Color
Rendering Intent                : Perceptual
Connection Space Illuminant     : 0.9642 1 0.82491
Profile Creator                 : lcms
Profile ID                      : 0
Profile Description             : c2
Profile Copyright               : IX
Media White Point               : 0.9642 1 0.82491
Media Black Point               : 0.01205 0.0125 0.01031
Red Matrix Column               : 0.43607 0.22249 0.01392
Green Matrix Column             : 0.38515 0.71687 0.09708
Blue Matrix Column              : 0.14307 0.06061 0.7141
Red Tone Reproduction Curve     : (Binary data 64 bytes, use -b option to extract)
Green Tone Reproduction Curve   : (Binary data 64 bytes, use -b option to extract)
Blue Tone Reproduction Curve    : (Binary data 64 bytes, use -b option to extract)
Image Width                     : 882
Image Height                    : 650
Encoding Process                : Progressive DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 882x650
Megapixels                      : 0.573

The second part I want to understand is: Under which condition the javascript can be triggered?

  • link says you have to rename the file to ".htm" and open it as a web page. weak. – dandavis Jul 6 '17 at 18:40
2

First of all, where does the hacker put in the JavaScript Code.

Chances are that the author could just plant the Javascript anywhere in the file as long as it's not corrupted in a way that it gets rejected by the application. This doesn't necessarily have to be an assigned meta data field.

In fact, the ImageMagick tool identify tool detects that the file is malformed:

$ identify xss.jpg
xss.jpg JPEG 882x650 882x650+0+0 8-bit sRGB 58189B 0.010u 0:00.009
identify: Corrupt JPEG data: 25 extraneous bytes before marker 0xdb `xss.jpg' @ warning/jpeg.c/JPEGWarningHandler/351.

These "extraneous bytes" are exactly the Javascript payload.

The second part I want to understand is: Under which condition the javascript can be triggered?

The Javascript is triggered if the image is served as text/html instead of image/jpeg.

The vulnerability which the author discovered was that the application derives the content-type from the file extension instead of the intended media type. So they could just change a .jpg extension to .html and the application would automatically server the same data with Content-type: text/html, no matter if it was originally uploaded as an image file.

This is a bug in the application, and you can't expect that other applications behave that way. To get the same effect, you could rename the PoC JPG file to xss.html and open it in your browser.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.