eyeos <= 1.9.0.2 - Stored XSS vulnerability using image files

🗓️ 01 Jul 2014 00:00:00Reported by RootType

EyeOS 1.9.0.2 Stored XSS vulnerability using image files. Malicious users can inject code inside image files to compromise the system


                                                Title: eyeOS &#60;= 1.9.0.2 Stored XSS vulnerability using image files
Product: eyeOS &#60;= 1.9.0.2
Author: Alberto Ortega @a0rtega alberto[at]pentbox[dot]net
        http://securitybydefault.com/

- Summary:

A stored XSS vulnerability using image files (jpg, png, gif tested) affects to eyeOS 1.9.0.2 version, older versions are probably affected too. eyeOS 2.x branch doesn&#39;t seem to be affected.

- Attack vector:

eyeOS is a virtual desktop where you can store files (besides other amazing stuff). The filetype is determined by the extension (in example .txt or .jpg).

When the user opens an image file in eyeOS, a new html frame is opened with the image file.

It&#39;s ok, the problem is that we can upload files that aren&#39;t images with an image extension, and it will be opened in a frame too. That means that we can upload a HTML file (with JS inside, why not?) and it will be opened in a new frame when an user click on it.

Stored XSS is done.

- PoC file:

$ file xss.jpg
xss.jpg: HTML document text
$ cat xss.jpg
&#60;!doctype html&#62;
&#60;script&#62;alert(&#34;XSS done&#34;);&#60;/script&#62;

- Risks and consequences:

Malicious users can inject code inside image files (malware, browser exploits, etc...) to attack other users and compromise the whole system via shared files or internal messages.

- Mitigations:

Disallow public dirs.

Avoid work with images.

- Solution:

Verify on the server side that the file extension matchs with the filetype before store it in the system.

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1