I came across a very interesting case:
- The user uploads a file
- The file contains
- The web app shows the file's content to the user -> the XSS payload is executed
- The file is not stored in any way, shape or form (forget about Stored XSS)
- There's no anti-CSRF token on the file upload
XSS via File Upload, right? Not a big deal.
Now the big question is: how to exploit it without literally asking the victim 'Hey, can you upload this file??'
Initially I dug into "Cross-Site File Upload" and read plenty of literature but I couldn't find any clear example of an XSS being exploited in this way.
The best blog post about this specific scenario is the following: https://www.exploresecurity.com/a-tricky-case-of-xss/ (here the injection is in the filename and not in the content, but it changes very little). The key is that the payload leverages a browser related issue and therefore it is not general-purpose.
The blog post also describes some of the challenges I've already faced: the file upload should not be chosen by the victim, the file upload should also return something to let the victim's browser run the JS payload, the attacker's page should deliver a multipart/form-data encoding, etc...
I've spent a considerable amount of time trying to find the answer to the "Is this even possible?" question and since I have not been lucky so far, I wanted to ask you guys if you've already faced a similar riddle.
This is the demo vulnerable page I'm using for my tests:
<html> <body bgcolor="lightyellow"> <?php echo "The file ". $_FILES["fileToUpload"]["name"] . " has been uploaded."; $fileContent = file_get_contents($_FILES['fileToUpload']['tmp_name']); echo "<p>The file contents are: <hr/><br>$fileContent<br/><hr/>"; ?> <p><p><hr/> <b>Here you can upload your file!</b> <form action="vuln-upload.php" method="post" enctype="multipart/form-data"> <input type="file" name="fileToUpload" id="fileToUpload"> <input type="submit" value="Upload" name="submit"> </form> </body> </html>
Thank you a lot for the help!