1

I'm testing CVE-2019-14748 on an example.com with osTicket. I've uploaded a test.html with the basic <script> and <img> XSS payloads which run when a user opens test.html. However, in Firefox, when I click on the test.html file for viewing, I'm prompted the "Open in/Save as" box and I click "Open in Firefox", which opens the file in another tab but the address is file:///tmp/mozilla__0/test.html.

The file is downloaded to and open in a local file://, but the process is still initiated by example.com Can this still be used for XSS, or is it nullified by the fact that the XSS payload is now in a separate local file?

Improve this question

1 Answer 1

Reset to default
1

The file is downloaded to and open in a local file://, but the process is still initiated by example.com Can this still be used for XSS, or is it nullified by the fact that the XSS payload is now in a separate local file?

No,the XSS payload wont work that way.

also in CVE-2019-14748 the step to reproduce is from within the osticket portal itself.

  • Login with another user(agent)
  • Now within the User Directory, go to the user under which the payload has been put.
  • The ticket raised with the name mentioned will be shown under the subject category.
  • Scroll down and the file uploaded will be present below.
  • Click on the file, and the payload gets executed which is persistent
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .