Title: eyeOS <= 184.108.40.206 Stored XSS vulnerability using image files Product: eyeOS <= 220.127.116.11 Author: Alberto Ortega @a0rtega alberto[at]pentbox[dot]net http://securitybydefault.com/ - Summary: A stored XSS vulnerability using image files (jpg, png, gif tested) affects to eyeOS 18.104.22.168 version, older versions are probably affected too. eyeOS 2.x branch doesn't seem to be affected. - Attack vector: eyeOS is a virtual desktop where you can store files (besides other amazing stuff). The filetype is determined by the extension (in example .txt or .jpg). When the user opens an image file in eyeOS, a new html frame is opened with the image file. It's ok, the problem is that we can upload files that aren't images with an image extension, and it will be opened in a frame too. That means that we can upload a HTML file (with JS inside, why not?) and it will be opened in a new frame when an user click on it. Stored XSS is done. - PoC file: $ file xss.jpg xss.jpg: HTML document text $ cat xss.jpg <!doctype html> <script>alert("XSS done");</script> - Risks and consequences: Malicious users can inject code inside image files (malware, browser exploits, etc...) to attack other users and compromise the whole system via shared files or internal messages. - Mitigations: Disallow public dirs. Avoid work with images. - Solution: Verify on the server side that the file extension matchs with the filetype before store it in the system.
Related ExploitsTrying to match OSVDBs (1): 72064
Trying to match setup file: c67edde363c9da6087c016bf4f4f87c2
Other Possible E-DB Search Terms: eyeos 22.214.171.124, eyeos
|2006-02-07||EyeOS 0.8.x - Session Remote Command Execution||James Bercegay|
|2011-04-25||eyeOS 126.96.36.199 - Image File Handling HTML Injection||Alberto Ortega|
|2011-04-06||eyeos 2.3 - Multiple Vulnerabilities||AutoSec Tools|