RSS Injection in Sage part 2

2 months ago, both pdp any myself released a vulnerability Cross Context Scripting in Sage. This issue was resolved in Sage release 1.3.7 (see: http://mozdev.org/bugs/show_bug.cgi?id=15101). I found a new vulnerability which affects the latest version, Sage 1.3.8. In addition to the XSS vulnerability, it should be noted (as in the previous vulnerability) that this issue occurs within the Local Browser Context.

Background:
A number of popular online RSS readers allow images to be embedded within Feeds. It has been known for some time now, that the amount of people subscribed to your feed can be determined by using the image src functionality. This is interesting from an anonymity point of view. I was curious to know just how well these applications would prevent and/or restrict the img onload features.

Ironically, Sage seems to handle this quite well. It removes any onload attribute within an IMG element. Sage also completely removes offending JavaScript code. However, it fails to remove the script tags when inserted within the IMG element. In addition to this, it will actually end the IMG element for us. For example:

<img src=http://michaeldaw.org/images/jss.jpg <script>alert(blah);</script> ></img>
becomes:
<img src=http://michaeldaw.org/images/jss.jpg > <script>alert(blah);</script> </img>
Notice the trailing > is removed and added before our JavaScript code.

A proof of concept feed can be found here.
This feed will open /etc/passwd for Linux users and ./etc/hosts for MS Windows users. Please note I have not tested the Windows feed.

Join the Conversation

No comments

  1. Press the “Download Now” button to download X-VPN crack version.
    The whole process will just take a few seconds.

    Reroute your Internet traffic via a secure virtual private network that can conceal your real IP address and your geographical location

    Mirror —> X-VPN keygen crack patch

    · Release version: 50.0_643
    · Release date: July 30 2019
    · Developer: Free Connected Limited
    · Downloads: 8230
    · Download type: safety (no torrent/no viruses)
    · File status: clean (as of last analysis)
    · File size: unknown
    · Price: 0
    · Special requirements: no
    · Supported systems: Windows 10 64 bit, Windows 10, Windows 8 64 bit, Windows 8, Windows 7 64 bit, Windows 7
    · Rating:

    Tags:
    x-vpn licence keys, x-vpn full version with keys latest, x-vpn crack install, x-vpn crack latest version, x-vpn crack serial, x-vpn crack serial number, x-vpn crack serial, x-vpn keygen crack, x-vpn crack latest, x-vpn patch

    More software keygens: here

    It may be interesting:
    NHL 17 Be a GM Mode – Goon Squad! –
    повысить процент уникальности текста
    You Won’t Like Me When I’m Hangry |
    Download Sacrifice Full Crack Latest
    KOT CEKET – Makko Jeans
    download google books
    Скачать Folder Password серийный ключ и кряк
    ГДЗ для школы
    Download ext-ms-win-kernel32-errorhandling-l1-1-0.dll to fix missing or corrupted DLL errors

  2. Press the “Download Now” button to download Plagiarism Checker X activate code.
    The whole process will just take a few moments.

    You can select documents you want to scan for plagiarism or check the contents of a webpage to see if it is copied from somewhere else

    Mirror —> https://serial4download.com/crack/plagiarism-checker-x-65483

    · Version: 6.0.8
    · Patch date: Jan 10th 2019
    · Company: Plagiarism Checker X, LLC
    · Downloads: 17425
    · Download type: safety (no torrent/no viruses)
    · Status: clean (as of last analysis)
    · File size: unknown
    · Price: gratis
    · Special requirements: no requirements
    · Supported systems: Windows 8 64 bit, Windows 8, Windows 7 64 bit, Windows 7, Windows Vista 64 bit, Windows Vista, Windows XP 64 bit, Windows XP
    · Rating:

    Tags cloud:
    plagiarism checker x crack new, plagiarism checker x crack patch, plagiarism checker x with license key latest, plagiarism checker x how to ctack, plagiarism checker x keygen crack, plagiarism checker x crack patch, plagiarism checker x serial key, plagiarism checker x and crack, plagiarism checker x crack files, plagiarism checker x crack new

    More keygens: this way

    It may be interesting:
    Informations • Pinta ApartmentsPinta Apartments
    Антиплагиат повышение оригинальности онлайн
    Eyes: a window to your …. health – C C Chui Optical
    Download Silent Hill 2 + Crack Latest
    Hello world! – My Blog
    download google books
    Скачать µTorrent crack и keygen
    How to repair missing or corrupt adptif.dll
    Grow your Business Multifold with Social Media Bookings

Leave a comment

Your email address will not be published. Required fields are marked *