bugtraq - Easy file sharing web server - persist XSS in forum msgs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201407250431.s6P4VVbf017254@sf01web3.securityfocus.com>
Date: Fri, 25 Jul 2014 04:31:31 GMT
From: joseph.giron13@...il.com
To: bugtraq@...urityfocus.com
Subject: Easy file sharing web server - persist XSS in forum msgs

I saw a posting a month or 2 ago for a BOF in an FTP server belonging to EFS Software here: http://www.securityfocus.com/bid/19243
At first there was no additional details provided and I hunted up and down before finding it after some fuzzing (stack smash in password).

While on the hunt, I found one not listed.

Easy file sharing web server - XSS in forum messages. 

Its persistent XSS. Don't see that much these days. The BB code (which looks suspiciously like it was lifted from PHPBB) fails to filter javascript and other html attributes from the posts.

Example exploit in test message:
[IMG]testing123" onmouseover="alert('10000')">[/IMG]

Peeking inside with IDA, we see why:
.data:0055D61C ; char aImgSrcSBorde_0[]
.data:0055D61C aImgSrcSBorde_0 db '<img src=%s border=0>',0 ; DATA XREF: sub_41B930+49F
.data:0055D61C                                         ; sub_41FC10+6B2 ...
Following the subroutine, there's no real formatting or escaping done. I mean the forum posting does attempt some form of filtering, but its bypassed easily.