XSS in IE11 on portswigger.net via Flash
P
PortSwigger Web Security
Submitted None
Team Summary
Official summary from PortSwigger Web Security
@opnsec found a forgotten unlinked Flash video player on portswigger.net that was vulnerable to XSS. Fortunately our use of CSP partially mitigated it, meaning it could only be used to exploit Internet Explorer users.
Actions:
Reported by
opnsec
Vulnerability Details
Technical details and impact analysis
Hello Portswigger Security Team,
There is a reflective XSS vulnerability in portswigger.net. The flash file `https://portswigger.net/burp/tutorials/video-js/video-js.swf` is from an old video.js library (version 3.2.0) which is vulnerable to XSS.
This XSS will be blocked by CSP instruction `object-src https://portswigger.net/knowledgebase/papers/;` but it will execute on browsers that don't enforce this CSP like Internet Explorer 11.
POC link : https://portswigger.net/burp/tutorials/video-js/video-js.swf?readyFunction=alert%28document.domain%2b'%20XSSed!'%29
POC instructions :
- Open the POC link in Internet Explorer 11 with flash active
- The javascript payload executes in `https://portswigger.net`
(Tested on Windows 10)
Mitigation :
To solve this issue, replace the old `https://portswigger.net/burp/tutorials/video-js` library with the updated video.js library from http://videojs.com/. It is also better to host any swf file on a sandbox subdomain.
Regards,
Enguerran @opnsec
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-site Scripting (XSS) - Generic