7

I have read a post in thehackernews and searched the net to find how it worked.

How can anyone add javascript in an image such that when the image is displayed it can run a script.

Can this be done with other languages?

  • I have tried to clean up the question, it can be answered but we aren't going to give you code to do it. – Rory Alsop Apr 4 '14 at 17:05
6

In the article you linked to, the Javascript code is not being included inside the image file itself per se, it's manifesting within the HTML page that references the image. Untrusted input is being returned inside the image tag without sufficient validation or sanitisation. This is persistent cross-site scripting since the malicious input is being returned every time someone views the page that includes this image (i.e. it's probably stored in the database as part of the user's profile).

Conventionally, the HTML markup to include a profile picture might look something like this:

<img src="/imagename.jpg">

However, it has to be different for each user, so the application code that generates it might look something like this (example is PHP):

<img src="/<?=$imagename?>">

So if the user Alice uploaded alicespic.jpg, users would see that image when they visited her profile, for example. However, this is where the vulnerability can occur, if the image name is not properly validated or sanitised.

For example, if Mallory could set her profile's image name to inncoent.jpg" onload="alert(1), the following HTML markup would be generated:

 <img src="/inncoent.jpg" onload="alert(1)">

Utilising the onload event means that the arbitrary script will be executed once the image has finished loading. Essentially, this Javascript code will be executed every time someone views the affected profile, but it will run inside their browser.

This would not occur if the developer only allowed safe characters to be included inside the image name.

2

There are 2 ways you can do this, the first is simply writing a script in a text file and saving it as a jpg. This is obviously not an image, but it will work. If you want a real image, you can take your image and use a hexeditor to add your script to the image metadata. This works because the browsers interpret the code as they try to render the image into the HTML.

Images use a header called EXIF that contains information about the image such as camera model, resolution, flash, etc, You can insert a script into this header and if the application is displaying the image metadata it will display the script instead. Check this link for more information, it is injecting PHP code instead of javascript but the idea is the same.

  • can you elaborate about "you can take your image and use a hexeditor to add your script to the image metadata... into the HTML." – elsadek Apr 4 '14 at 23:23
  • 5
    Images use a header called EXIF that contains information about the image such as camera model, resolution, flash, etc, You can insert a script into this header and if the application is displaying the image metadata it will display the script instead. Check this link for more information, it is injecting PHP code instead of javascript but the idea is the same. techyzilla.blogspot.mx/2012/07/… – Kotzu Apr 4 '14 at 23:59
  • I find this answer probably the most interesting. I don't think the answer itself is very clear (I wanted to downvote) until you read the comment. This is a very clever attack, I suggest you add some of the comment details to the answer. – David Houde Apr 6 '14 at 12:41
1

Edit: itscooper's answer is the correct interpretation of the vulnerability in the THN article that the question linked to, in my opinion. The answer below is for the general question of how to hide js and have it be executed inside an image object.

Historically, you could XSS some browsers by inserting "javascript:" URLs as image sources, because they would automatically run the script (https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Image_XSS_using_the_JavaScript_directive). Surprisingly, this is still the case in Firefox although the javascript is sandboxed and has no access to the page objects. Still, it can be used to DOS page loads by running an unterminated loop that freezes the main thread. I've reported this bug to Mozilla but it has yet to be fixed: https://bugzilla.mozilla.org/show_bug.cgi?id=924252.

  • your answer satisfies the question but viewing from the websites perspective they had only allowed the user to upload a image which contains only the name of the image. no tags nothing else . so how can anyone embed a code in an image to cause xss – user38257 Apr 6 '14 at 12:05
  • @user38257 You're right, I was answering the general question and not specifically talking about the THN article. itscooper's answer is basically what I would have said. – Yan Z Apr 6 '14 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.