I'm investigating a vulnerability in an application that echoes a user-supplied filename without sanitizing the filename.
E.g. a file named test-<script>alert("evil");.txt
will result in that text echoed into the XHTML. (In case it matters, this particular document is served as text/html and the doctype is xhtml1-transitional.)
The problem is that the <script>
tag can't be closed because the filename can't contain a /
. This means that the script isn't executed because everything that follows is part of the script, and all that HTML will be invalid JS.
(FWIW, I'm also investigating the use of subdirs as a way of getting the slash into the application, but it appears to trim the dirname from the file before displaying. Heh -- having a file named ./<script>alert("evil subdir?");</script>.txt
makes me feel a little queasy...)
Based on a few XSS cheat sheets, I've tried several ways of encoding the slash so that it can appear in the filename but still be interpreted by the HTML parser as a closing tag. No luck; the characters are inserted literally into the HTML without any intermediate encoding/decoding.
Even without the slash I've found three or four ways of exploiting it, but so far they require user interaction with that element (e.g. onmouseover
). They also make the page ugly because the tag structure falls apart. If I can close the tag, the exploit is both invisible and automatic.
Are there any standard (i.e. XSS filter evasion) techniques for closing a tag without quotes that I'm missing?