NeverStopExploiting用户9473
Stored Cross-Site Scripting (XSS) via File Upload in MediaController
输入“/”快速插入内容
Stored Cross-Site Scripting (XSS) via File Upload in MediaController
Stored Cross-Site Scripting (XSS) via File Upload in MediaController
用户9473用户94732月3日修改
BUG_Author: ChengxinXu
Affected Version: cskefu v8
Vulnerability Files:
•
com/cskefu/cc/controller/resource/MediaController.java
Description:
1.
Unrestricted File Upload & MIME Type Manipulation:
◦
In the file MediaController.java, the upload function (mapped to /res/image/upload) accepts file uploads via the multipart parameter.
◦
The application blindly trusts the Content-Type header provided by the user in the upload request and stores it directly in the database using sf.setMime(multipart.getContentType()).
2.
Lack of Validation:
◦
There is no server-side validation to check if the uploaded file is actually an image. The code does not verify the file extension or the magic bytes of the file content.
3.
Exploiting the Stored XSS:
◦
When a user requests the file via the /res/image endpoint, the application retrieves the stored MIME type and sets it as the response header: response.setContentType(sf.getMime()).
◦
If an attacker uploads a file containing malicious JavaScript and sets the Content-Type to text/html, the server will serve this file back to any user (including admins) as an HTML page. This causes the browser to execute the attacker's JavaScript within the context of the application's origin.
Proof of Concept:
1.
Prepare the Malicious Payload: Create a file named xss.html with the following content:
代码块
<!DOCTYPE html>
<html>
<head><title>XSS Test</title></head>
<body>
<h1>XSS Vulnerability Test</h1>
<script>
alert('XSS Triggered! Cookie: ' + document.cookie);
console.log('XSS executed successfully');
console.log('Cookie:', document.cookie);
</script>
<p>If you see an alert box, the XSS vulnerability is confirmed.</p>
</body>
</html>
2.
Upload the Payload (The Injection): Send a POST request to the upload endpoint.