I'm testing CVE-2019-14748 on an example.com
with osTicket. I've uploaded a test.html
with the basic <script>
and <img>
XSS payloads which run when a user opens test.html
. However, in Firefox, when I click on the test.html
file for viewing, I'm prompted the "Open in/Save as" box and I click "Open in Firefox", which opens the file in another tab but the address is file:///tmp/mozilla__0/test.html
.
The file is downloaded to and open in a local file://
, but the process is still initiated by example.com
Can this still be used for XSS, or is it nullified by the fact that the XSS payload is now in a separate local file?