wtorek, 3 lutego 2015

evercookie.swf - Stored Cross-Site Scripting

Today @samykamkar released new version of evercookie that fixes Stored Cross-Site Scripting issue that I reported. Here is how it works in details.

First of all - we should check vulnerable code: evercookie.as

So - the flash file takes flashVar parameter everdata and puts it to SharedObject (something like Local Storege but for Flash). If some data already was in SharedObject - it pass its value to javascript function called _evercookie_flash_var() without any checks. So the proof of concepts for this version looks simple:

http://vulnerable-hostname/evercookie.swf?everdata=f');alert('XSS');// 

After visiting this and then visiting page that embeds evercookie.swf - we'll see wonderful alert box ;-) and the best part - it's stored one.

Few weeks ago someone made pull request for fixing some issues (not security related) with QQBrowser and simply replaced getURL() function with ExternalIterface.call(). So - someone accidentally fixed old bug and created new one ;-) Here's the code: evercookie2.as

+ 2nd PoC:

http://vulnerable-hostname/evercookie.swf?everdata=f\\"))}catch(e){}alert(1);//

...and life goes on. :)

If you're using evercookie - please update to newest version. You can also check the video demonstration: https://www.youtube.com/watch?v=kWAiV6Bjm2s


38 komentarzy:

  1. This is most informative and also this post most user friendly and super navigation to all posts... Thank you so much for giving this information to me.
    rpa training in chennai
    rpa training in bangalore
    rpa course in bangalore
    best rpa training in bangalore
    rpa online training

    OdpowiedzUsuń
  2. Well researched article and I appreciate this. The blog is subscribed and will see new topics soon.
    python course in pune
    python course in chennai
    python course in Bangalore

    OdpowiedzUsuń
  3. I am really impressed with your efforts and really pleased to visit this post.
    python course in pune
    python course in chennai
    python course in Bangalore

    OdpowiedzUsuń
  4. Thanks you for sharing this unique useful information content with us. Really awesome work. keep on blogging
    Online DevOps Certification Course - Gangboard
    Best Devops Training institute in Chennai

    OdpowiedzUsuń
  5. Hmm, it seems like your site ate my first comment (it was extremely long) so I guess I’ll just sum it up what I had written and say, I’m thoroughly enjoying your blog. I as well as an aspiring blog writer, but I’m still new to the whole thing. Do you have any recommendations for newbie blog writers? I’d appreciate it.
    Advanced AWS Course Interview Questions And Answers, Top 250+AWS Jobs Interviews Questions and Answers 2018
    Advanced AWS Jobs Interview questions and answers |Best Top 110 AWS Interview Question and Answers – india

    OdpowiedzUsuń
  6. Hmm, it seems like your site ate my first comment (it was extremely long) so I guess I’ll just sum it up what I had written and say, I’m thoroughly enjoying your blog. I as well as an aspiring blog writer, but I’m still new to the whole thing. Do you have any recommendations for newbie blog writers? I’d appreciate it.
    Advanced AWS Course Interview Questions And Answers, Top 250+AWS Jobs Interviews Questions and Answers 2018
    Advanced AWS Jobs Interview questions and answers |Best Top 110 AWS Interview Question and Answers – india

    OdpowiedzUsuń
  7. Some us know all relating to the compelling medium you present powerful steps on this blog and therefore strongly encourage
    contribution from other ones on this subject while our own child is truly discovering a great deal.
    Have fun with the remaining portion of the year.

    Selenium training in bangalore | best selenium training in bangalore

    OdpowiedzUsuń
  8. I think this is the best article today about the future technology. Thanks for taking your own time to discuss this topic, I feel happy about that curiosity has increased to learn more about this topic.Artificial Intelligence Training in Bangalore. Keep sharing your information regularly for my future reference.

    OdpowiedzUsuń
  9. I ReGreat For Your Information The Information U have Shared Is Fabulous And Interesting So Please keep Updating Us The Information Shared Is Very Valuable Time Just Went On Reading The Article Python Online Course AWS Online Course Data Science Online Course Hadoop Online Course

    OdpowiedzUsuń
  10. Thanks for sharing valuable information. Your blogs were helpful to Azure learners. I request to update the blog through step-by-step. Also, find the Azure news at
    Such an ideal piece of blog. It’s quite interesting to read content like this. I appreciate your blog
    Data Science Course

    OdpowiedzUsuń
  11. simply superb, mind-blowing, I will share your blog to my friends also
    I like your blog, I read this blog please update more content on hacking,Nice post
    Tableau online Training

    Android Training

    Dot net Course

    iOS development course

    OdpowiedzUsuń
  12. very informative blog and useful article thank you for sharing with us , keep posting learn more about aws with cloud computing
    AWS Online Training

    OdpowiedzUsuń
  13. A bewildering web journal I visit this blog, it's unfathomably heavenly. Oddly, in this present blog's substance made purpose of actuality and reasonable. The substance of data is informative
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  14. A bewildering web journal I visit this blog, it's unfathomably heavenly. Oddly, in this present blog's substance made purpose of actuality and reasonable. The substance of data is informative
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  15. A bewildering web journal I visit this blog, it's unfathomably heavenly. Oddly, in this present blog's substance made purpose of actuality and reasonable. The substance of data is informative
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  16. Thanks for sharing valuable article having good information and also gain worth-full knowledge.


    Oracle ICS Online Training

    OdpowiedzUsuń
  17. Thank you for sharing your awesome and valuable article this is the best blog for the students they can also learn.

    Workday Online Training

    OdpowiedzUsuń
  18. A befuddling web diary I visit this blog, it's incredibly grand. Strangely, in this present blog's substance made motivation behind fact and sensible. The substance of information is instructive
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  19. Really appreciate this wonderful post that you have provided for us.Great site and a great topic as well i really get amazed to read this. Its really good.
    data science course malaysia

    OdpowiedzUsuń
  20. Very informative post and you are obviously very knowledgeable in this field. Very useful and solid content. Thanks for sharing

    ExcelR Data Science in Bangalore

    OdpowiedzUsuń
  21. I feel very grateful that I read this. It is very helpful and very informative and I really learned a lot from it.
    date analytics certification training courses

    OdpowiedzUsuń
  22. Attend The Python training in bangalore From ExcelR. Practical Python training in bangalore Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Python training in bangalore.
    python training in bangalore

    OdpowiedzUsuń












  23. It has fully emerged to crown Singapore's southern shores and undoubtedly placed her on the global map of residential landmarks. I still scored the more points than I ever have in a season for GS. I think you would be hard pressed to find somebody with the same consistency I have had over the years so I am happy with that.

    BIG DATA COURSE MALAYSIA

    OdpowiedzUsuń
  24. I would recommend my profile is important to me, I invite you to discuss this topic...
    Data Science Course in Pune

    OdpowiedzUsuń
  25. I am looking for and I love to post a comment that "The content of your post is awesome" Great work!





    Big Data Course

    OdpowiedzUsuń
  26. I finally found great post here.I will get back here. I just added your blog to my bookmark sites. thanks.Quality posts is the crucial to invite the visitors to visit the web page, that's what this web page is providing.data science course in dubai

    OdpowiedzUsuń
  27. I just got to this amazing site not long ago. I was actually captured with the piece of resources you have got here. Big thumbs up for making such wonderful blog page!data science course in dubai

    OdpowiedzUsuń
  28. Attend The Python Training in Bangalore From ExcelR. Practical Python Training in Bangalore Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Python Training in Bangalore.
    Python Training in Bangalore

    OdpowiedzUsuń
  29. Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.
    rpa training in malaysia

    OdpowiedzUsuń