File Upload XSS

Brute The Art of XSS Payload Building

A file upload is a great opportunity to XSS an application. User restricted area with an uploaded profile picture is everywhere, providing more chances to find a developer’s mistake. If it happens to be a self XSS, just take a look at the previous post.

Basically we have the following entry points for an attack.

1) Filename

The filename itself may be being reflected in the page so it’s just a matter of naming the file with a XSS.

xss-gif-filename

#hack2learn
Although not intended, it’s possible to practice this XSS live at W3Schools.

2) Metadata

Using the exiftool it’s possible to alter EXIF metadata which may lead to a reflection somewhere:

$ exiftool -FIELD=XSS FILE

Example:
$ exiftool -Artist=’ “><img src=1 onerror=alert(document.domain)>’ brute.jpeg

exif-brute-collage

3) Content

If the application allows the upload of a SVG file extension (which is also an image type), a file with the following content can be used to trigger a XSS:

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>

A PoC (Proof of Concept) is available live at brutelogic.com.br/poc.svg.

4) Source

It’s easy to build a GIF image to carry a javascript payload for use as a source of a script. This is useful to bypass the CSP (Content Security Policy) protection “script-src ‘self’ ” (which doesn’t allow <script>alert(1)</script>, for example) if we are able to successfully inject in the same domain, as shown below.

xss-gif-source

To create such an image just use this as content and name it with .gif extension:

GIF89a/*<svg/onload=alert(1)>*/=alert(document.domain)//;

The signature of a GIF file, GIF89a, is used as a javascript variable assigned to the alert function. Between them however, there’s a commented XSS vector just in case the image can be retrieved as the text/HTML MIME type, thus allowing payload execution by just requesting the file.

As we can also see below, the file UNIX-like command along with the PHP functions exif_imagetype() and getimagesize() recognize it as a GIF file. So if an application is using just these to validate the image, the file will be uploaded (but may be sanitized later).

xss-gif

For more file types that can have its signature as ASCII characters used for a javascript variable assignment, check this.

There are more elaborated examples of XSS using image files, usually bypassing filters like the GD library ones. A good example of that is here.

#hack2learn

fb-share-icon
Tweet
Pin Share

31 thoughts on “File Upload XSS”

    • It’s an issue with the quotes. Type them manually if you are copying and pasting, encapsulating double with single quotes. If you are on a different system try to escape < also, with \ (backslash).

  7. Greetings from Los angeles! I’m bored at work
    so I decided to check out your blog on my iphone during lunch break.
    I love the knowledge you present here and can’t wait to take a
    look when I get home. I’m amazed at how fast your blog loaded on my cell phone ..

    I’m not even using WIFI, just 3G .. Anyhow, amazing blog!

  9. Is there any way you know to make this work when the image is displayed as background in a CSS rule? I couldn’t get it right in this context, and I couldn’t find any change to make these attacks work.
    Thank you for this great article anyway!

  10. Hi Brute,

    Very first thing I am glad to read your blogs, You’re awesome.

    I have one case where I am unable to convert [File uploading xss only] a self xss to stored xss. I’ve tried almost all possibilities, is there any other stuff to be try..?!

    Thanks

  11. Hi Man , Big thanks for your efforts 🙂 🙂
    I would like to ask about the span tag , in some site while I’m testing for XSS , i watch my payload were injected and see it in span tag payload
    ,with no interaction or loaded is there a trick in that ?
    thanks alot again

Leave a Reply