[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Cross Site Scripting exploitation via malformed files
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Cross Site Scripting exploitation via malformed files
- From: Jerome ATHIAS <jerome.athias@xxxxxxx>
- Date: 21 Feb 2005 16:25:04 -0000
It was publicly released on different forums
(http://cyruxnet.org/foro/viewtopic.php?t=559); multiple webmail systems and
websites are vulnerable to Cross Site Scripting via a malformed file.
A basic PoC :
Build a text file (ie: photo.txt)
<script language="Javascript">
alert('Vulnerable!');
</script>
then rename the file with the .jpg extension (photo.jpg), and send the renamed
file as attachement by mail to the victim.
On many webmail systems, when the JPG file is downloaded, then the script is
executed (you can play with javascript, vbscript,...)
It was verified under IE - XP SP2
So it opens a door for virus...
Regards and greetings to: ZaBoo, whitehat.co.il, Class101, Mandragore
Jerome ATHIAS