lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 03 Jan 2007 07:17:44 +0200
From: Amit Klein <aksecurity@...il.com>
To: "pdp (architect)" <pdp.gnucitizen@...glemail.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	Web Security <websecurity@...appsec.org>
Subject: Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous

pdp (architect) wrote:
> I will be very quick and just point to links where you can read about
> this issue.
>
> It seams that PDF documents can execute JavaScript code for no
> apparent reason by using the following template:
>
>    
> http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here 
>
>
> You must understand that the attacker doesn't need to have write
> access to the specified PDF document. In order to get an XSS vector
> working you need to have a PDF file hosted on the target and that's
> all about it. The rest is just a matter of your abilities and desires.
>
Amazing, and kudos to Sven Vetsch who found this.

Note that from attack categorization perspective, it appears to be a 
twisted example of DOM based XSS 
(http://www.webappsec.org/projects/articles/071105.shtml). I suppose PDF 
retrieves the URL from the browser (probably from a degenerate DOM the 
browser provides it - after all, the document object is available to the 
payload JS code!), parses it and uses the fragment. Since fragments are 
used, the payload doesn't travel to the target web server (!). I 
mentioned the possible use of fragments as a particularly nasty attack 
vector (impossible to detect on server) in the "DOM based XSS" writeup.

-Amit

Powered by blists - more mailing lists