Unexploitable CORS can lead to Stored XSS?

-


Heeeeeeey guys, this is the last bug I found but I liked it so I wanna share the idea with you let's go.

Find CORS

our target here is a private program on HackerOne so let's call it example.com, this website almost all endpoints is vulnerable to CORS 😂, I found a CORS in an endpoint which changing my name but the response didn't include private information to steal so it was unexploitable.

Find Self-Stored XSS

I spent hours testing the application and I found an interesting thing one of the endpoints display the current user's information in JSON format but the issue here is the Content-Type of the response is text/html and this is the first WOW, I looked to this information and I found that there is a parameter include the name of the user so I can change it and this is the second WOW, I get back and add an XSS payload on the name, after saving the payload I opened the endpoint and as expected the payload executed, and this is an example of the endpoint path

http://example.com/user/info 

Exploit CORS

now we have a CORS and Self-XSS what we can do?! if you asked anyone about what is CORS he/she will say it is a bug we can use to steal the response from an endpoint allow any external domain sending requests to it with cookies, right? this is a good answer but what is actually the bug here I can send requests to this endpoint but there is nothing to steal, what if I just used it to change the user name this will be CSRF so I tried this idea but it didn't work after testing the headers I found that the endpoint is checking the content-type header from the request if it is not application/json it will not be accepted and guess what? we can add headers in the request using CORS vulnerability 😎 so I wrote an exploit to change the user name, and this is the code to make CORS a CSRF

this code is sending the request to change the name of the user.

Get the Stored XSS

now we have a CSRF to change the user name so we can try to add our XSS payload on it and make the user open the endpoint which displays the name of the user and will execute our XSS payload so I added a second part to our exploit, so the next code will send a request with the content-type to add our XSS payload to the name of the user and after 3 seconds the code will open the page which vulnerable to XSS


and this is the full exploit of this bug, I didn't get my reward yet 😢.


GoodBye Guys 👋, See you soon 👋

Comments

Post a Comment

Popular posts from this blog

[BlackHatMEA-CTF 2024] cockatoo PWN challenge

-
Image
 ( بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ ) (إن أحسنت فمن الله، وإن أسأت فمن نفسي والشيطان) Let's check the "cockatoo" pwn challenge from Blackhat MEA CTF 2024. Reverse the Binary we note that the binary takes the input byte by byte and there is a counter (i hate static analysts) Dynamic analysis  Let's jump to GDB and see what happened. I set a breakpoint on the road to get the stack address in which our input will be stored, and the following screenshots show our input increase and the counter before the RIP address. and the payload to overwrite the counter and control where the next write will be in the following screenshots  and we added to the counter (16) and could overwrite the RIP now we have to find our gadgets and do a simple execve, right?!!! NOOOOOO Exploit we don't have gadgets for "rdx, rdi, rsi" and we need to do "execve(rdi, rsi, rdx)", but we have "syscall" and "pop rax" so its time for our SROP attack. we...
Read more

[WEB] ASC Wargame CTF 2024 - Challenge Hot Proxy

-
Image
 ( بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ ) (إن أحسنت فمن الله، وإن أسأت فمن نفسي والشيطان) It was a nice CTF, I got 2nd place with my guys: Hissien Misbah ( Twitter ) Mohamed Bebo ( Linkedin ) Sameh ( Linkedin ) Osama Zidan ( Linkedin ) A picture during solving this challenge in the last 5m of the CTF (thinking that we got 1st place). Let's walk through the Web Challenge Hot Proxy, note that we did not solve it during the time of the CTF it was a minute way, let's start. Note: there is no source code in the challenge attachment, I requested it from the author ( @serWazito0 ) thanks to him, challenges files ( ASCWG_2024_CTF ). Note: the flag file in the server and called "flag_<RANDOM>.txt", so we have to get RCE. From the title I know that there is an "SSRF" vulnerability in this challenge and from the description, we know that there is an internal application called "app1" with a route called "/secret" so our target is to access...
Read more

Lets Analysis STM32F103 Chip Firmware from Attify

-
Image
( بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ ) Let's start our blog. As we know any IoT device should have a firmware to run it and there is a thought that it is secure by default because it is in a board, but we know that we can dump this firmware, our firmware know is already shared with us something like training to learn basics of reversing firmware. you can download the firmware from here . if we run the file command on the firmware we will find this "STM32F103C-firmware.bin: data" and if we try to get the architecture using binwalk it will return empty result "binwalk -A STM32F103C-firmware.bin" but we don't need this because it is a famous chip and we can know what we want from google. After searching for the chip name STM32F103C we will open its default page you will know that it run using "ARM Cortex M3" we will need that later, it is time to analysis using Ghidra. Analysis Dropping the firmware file to Ghidra but it will not detect anything...
Read more