Bugtraq mailing list archives
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous
From: Amit Klein <aksecurity () gmail com>
Date: Fri, 05 Jan 2007 00:58:33 +0200
Guy Podjarny wrote:
Another similar option is to use a single-use random value (notencrypted), that gets invalidated after it's served back.You can save the random value on the (non persistent) session (server-side), and serve the PDF only if the correct random value isprovided. Once a random value has been used, it's cleared (single-use).In any case where the wrong value is provided - recreate a random value, save it on the session, and redirect to the PDF with it (same behavior as when the token isn't provided at all).
Here's an attack against this scheme: Attacker sends the user a link to http://www.attacker.site/script.cgiWhen the user requests http://www.attacker.site/script.cgi, the script.cgi requests file.pdf from vuln.site. It gets back a redirection URL and a session cookie. Then, it creates a Flash object that requests the URL with an injected Cookie header (with the session cookie) and serves this to the victim client. Voila.
Current thread:
- RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous, (continued)
- RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Martin O'Neal (Jan 08)
- Message not available
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Amit Klein (Jan 08)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous RSnake (Jan 08)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Amit Klein (Jan 08)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous RSnake (Jan 08)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Amit Klein (Jan 08)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Brian Eaton (Jan 09)
- RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Marvin Simkin (Jan 09)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Ralph Angenendt (Jan 10)
- RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Guy Podjarny (Jan 08)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Amit Klein (Jan 08)
- RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Tom Spector (Jan 09)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous pdp (architect) (Jan 03)
- Re: Universal XSS with PDF files: highly dangerous ascii (Jan 03)
- Re: Universal XSS with PDF files: highly dangerous Thierry Zoller (Jan 04)
- RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Larry Seltzer (Jan 03)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Jim Manico (Jan 04)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous RSnake (Jan 04)
- Message not available
- Re: [Full-disclosure] [WEB SECURITY] Universal XSS with PDF files: highly dangerous Jim Manico (Jan 09)