full-disclosure - Re: Universal XSS with PDF files: highly dangerous

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 5 Jan 2007 14:03:54 +0000
From: "pdp (architect)" <pdp.gnucitizen@...glemail.com>
To: "Kristina Lein" <kristina@....ee>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	Web Security <websecurity@...appsec.org>
Subject: Re: Universal XSS with PDF files: highly dangerous

as far as I can see this works or builin JavaScript... or JavaScript
emebeded into PDF documents.

On 1/5/07, Kristina Lein <kristina@....ee> wrote:
> On Wednesday 03 January 2007 04:20, pdp (architect) wrote:
> > I will be very quick and just point to links where you can read about
> > this issue.
> >
> > It seams that PDF documents can execute JavaScript code for no
> > apparent reason by using the following template:
> >
> >
> > http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_her
> >e
> >
> > You must understand that the attacker doesn't need to have write
> > access to the specified PDF document. In order to get an XSS vector
> > working you need to have a PDF file hosted on the target and that's
> > all about it. The rest is just a matter of your abilities and desires.
>
> Even more, maybe it is possible to modify content of PDF with this method.
> Some way (I have not tried though) described here;
>
> http://www.planetpdf.com/developer/article.asp?ContentID=6904
>
> Need to write POC
>
> Also I have to tell that my firefox crashed when I appended some random
> document.write('foobar') to exploit. I suppose it wrote it to PDF memory?! In
> this case we maybe can also execute code? Scary.
>
>   Tõnu
>


-- 
pdp (architect) | petko d. petkov
http://www.gnucitizen.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/