Log storage XSS-4 caused by a function defect in the QQ space

It is still a functional defect, and I am sorry for some old filtering errors made by developers.

1. The template log shows that there is such a player. Add a song to the player, send a log at will, and capture packets at the same time.

 

2. We searched MusicPlayer.swf to locate the http://ctc.qzs.qq.com/qzone/app/blog/v6/script/content_templateblog_parser.js

Check the log source code. We can see that this is actually a <div data = "xxxxx" name = "xxxxx"> </div>

This can give us some inspiration when locating the code. Search for "data" or 'data'

We can see that Music. Parser calls the data in the data attribute and returns it,

 

3. Where can I call Music. Parser? Search for "Music. Parser ("

 

We can see that the data goes further to TemplateBlogParser. music

 

4. Where can TemplateBlogParser. music be used?

 

 

We can see that the data goes further to aData. content

 

5. Further, we can see that aData enters an eval, but the eval cannot be used here.

 

 

For example, the code here is equivalent to executing

 

AObj = new MusicPlayer (itemId, aData );

 

6. Further trace and find the definition of the MusicPlayer object. Search for "function MusicPlayer"

 

After finding MusicPlayer, we can observe the flow of its 2nd parameters (that is, data.

Data. content enters this. data. content.

 

7. Continue to read the following code.

 

Next, this. data. content enters the this. convertKorean () function, which looks like a conversion.

 

8. Let's take a look at how the this. convertKorean function processes the data.

 

This. convertKorean = function (str ){
Var div = document. createElement ("div ");
Div. innerHTML = str;
Str = div. innerText | div. textContent;
Return str;
};

 

When I saw this code, I suddenly thought it was amazing !! Our str is passed into div. innerHTML.

 

The function of this Code is to remove the html Tag in str,

 

However, this Code actually makes a classic "filter error". The developer creates a temporary div and then retrieves innerText/textContent. However, whether or not the div is appended to the DOM, innerHTML = "

 

9. Here, we go back to it. Our str actually comes from our initial data value.

 

The next step is easy! We found the data we caught at the beginning, modified and sent the packet.

 

<Div class = "blog_details_20120222"> <div name = "title"> xxxxxxxxxxx </div> <div name = "text"> <br/> x <br/> xxxxxxx </div> <div name = "title"> xxxxxx </div> <div name = "title"> xxxx </div> <div name = "title"> xxxx </div> <div name = "MultiImageController" data = ""> </ div> <div name = "music" data = "http://stream16.qqmusic.qq.com/31303066.mp3 | | A-Ha | 0 "> </div>

11. The cookies are displayed successfully.

 


 

 

 

IE.

Solution:

Before the data enters this. convertKorean, or after the data is retrieved from getAttribute ("data"), HTMLEncode the data.