I've recently joined a security project, and received a task to demonstrate the risk related to an end-user uploading an image containing embedded (malicious) JavaScript code.

I used EXIFeditor to inject JavaScript code in an image's imgdescription tag, then uploaded the image to the ASP.NET web server using the following C# code:

protected void Upload_File(object sender, EventArgs e)
    var postedFile = Upload_fu.PostedFile;
    string fileName=new FileInfo(postedFile.FileName).Name;
    string path = Server.MapPath("~/images/" + fileName);
    Success_msg.Text = "successfully saved";
    img_sr.ImageUrl = "~/images/" + fileName;

Note: img_sr is a <asp:Image/> element, and Upload_fu is a <asp:UploadFile/> element.

The JavaScript code I've embedded int the image is a simple alert("Hello world"). However, the code isn't executed (I tried this with FireFox 21 and Internet Explorer 9).

What am I doing wrong?

  • 1
    One way to exploit the wrong content sniffing implementation of old MSIE. Another way to serve the exif information along the image without escaping HTML. – inf3rno May 27 '14 at 8:47
  • can u explain more please – Sora May 27 '14 at 9:03
  • 1
    Use google, it is really not hard to find... – inf3rno May 27 '14 at 10:31
  • You might try this method: wikihow.com/Hide-Text-Within-an-Image You can hide the js inside the actual jpg – k1DBLITZ May 27 '14 at 19:21

Create a HTML page where you display the photo, and next to it you display the EXIF info. The EXIF javascript should probably be enclosed in HTML script tags. If you don't escape the EXIF info when you display it in the page, it should execute the javascript.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.