FirstBlood-#149 — Reflective XSS through the vulnerable ref header on /register.php endpoint
This issue was discovered on FirstBlood v1.0.0
On 2021-05-10, holybugx reported:
I found out that there is a reflected XSS on the
/register.phpendpoint through the vulnerable
refparameter which leads to account takeover.
Steps to reproduce
If you open the following link and hover your mouse over on
Return to the previous pagethe XSS executes:
An attacker can craft a payload to steal cookies (due to no
httponlycookie attribute), an example of such payload is:
http://attacker.comis the attacker's domain, opening the above link and hovering the mouse on
Return to previous pageresults in a redirection to the attacker's domain and the cookies will be sent over to the attacker's server in the URL.
No user-interaction payload
I also built a payload that works without any user interaction, the following payload works on all browsers except for firefox:
http://firstbloodhackers.com/register.php?ref='id='x' tabindex='1' autofocus onfocus='alert(document.cookie)
An attacker can craft a payload to steal cookies (due to no httponly cookie attribute), an example of such payload is:
http://attacker.comis the attacker's domain, opening the above link can result in the redirection of the victim to an attacker's domain and leaking the
drpscookie along with it.
An attacker can set this cookie on his browser to access
drAdmin(Administrator). This happens because of two cookies misconfiguration:
Cookies are not set as
Cookies are not deleted/expired as they meant to be after logging out, which makes it possible for an attacker to re-use the cookies whenever he wants to.
Set-Cookie: drps=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
refparameter should not be controlled by users.
- Preferably set
- Admin account takeover
FirstBlood ID: 4
Vulnerability Type: Reflective XSS
The parameter "ref" is vulnerable to XSS on register.php. The developer made use of htmlentities but this is inadequate as the HREF is wrapped in single quotes.