bugtraq - Cross Site Scripting exploitation via malformed files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050221162504.23072.qmail@www.securityfocus.com>
Date: 21 Feb 2005 16:25:04 -0000
From: Jerome ATHIAS <jerome.athias@...e.fr>
To: bugtraq@...urityfocus.com
Subject: Cross Site Scripting exploitation via malformed files

It was publicly released on different forums (http://cyruxnet.org/foro/viewtopic.php?t=559); multiple webmail systems and websites are vulnerable to Cross Site Scripting via a malformed file.

A basic PoC :

Build a text file (ie: photo.txt)

&lt;script language="Javascript">
alert('Vulnerable!');
&lt;/script&gt;

then rename the file with the .jpg extension (photo.jpg), and send the renamed file as attachement by mail to the victim.

On many webmail systems, when the JPG file is downloaded, then the script is executed (you can play with javascript, vbscript,...)

It was verified under IE - XP SP2

So it opens a door for virus...

Regards and greetings to: ZaBoo, whitehat.co.il, Class101, Mandragore

Jerome ATHIAS