1

I'm testing CVE-2019-14748 on an example.com with osTicket. I've uploaded a test.html with the basic <script> and <img> XSS payloads which run when a user opens test.html. However, in Firefox, when I click on the test.html file for viewing, I'm prompted the "Open in/Save as" box and I click "Open in Firefox", which opens the file in another tab but the address is file:///tmp/mozilla__0/test.html.

The file is downloaded to and open in a local file://, but the process is still initiated by example.com Can this still be used for XSS, or is it nullified by the fact that the XSS payload is now in a separate local file?

1 Answer 1

1

The file is downloaded to and open in a local file://, but the process is still initiated by example.com Can this still be used for XSS, or is it nullified by the fact that the XSS payload is now in a separate local file?

No,the XSS payload wont work that way.

also in CVE-2019-14748 the step to reproduce is from within the osticket portal itself.

  • Login with another user(agent)
  • Now within the User Directory, go to the user under which the payload has been put.
  • The ticket raised with the name mentioned will be shown under the subject category.
  • Scroll down and the file uploaded will be present below.
  • Click on the file, and the payload gets executed which is persistent

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .