Using dz as an example to describe an attack method against network image Functions

This vulnerability is caused by a vulnerability that is directly put into the src attribute of the img label without checking the validity of the network image. Currently, most websites on the Internet use similar methods to process network images. The post mainly uses discuz as an example.

Currently, all discuz versions are affected. I won't tell you that freebuf can do the same!

Discus does not verify the validity of the network image when processing the network image, resulting in injecting links. However, Discus are limited in the following scenarios, because discuz itself enables random formhash variables to prevent CSRF attacks, the exploitation of this vulnerability on CSRF still has certain limitations, however, it is not difficult to achieve Trojan, traffic, advertising, and phishing.

Usage:

Use Network images for phishing.

1. Find a post on the discuz forum and insert online images into your own phishing page.

2. Browse the post to view the phishing page.

3. If the security awareness is poor, the account and password will be entered.

4. Attackers can obtain the password and complete phishing.

II. Network images are used for CSRF attacks. discuz uses formhash to prevent CSRF attacks. However, this only solves its own problems and does not take into account the user's website architecture. If the discuz user's main site and Forum use the same domain, it may cause CSRF attacks,Next we will use our own test environment for verification.

1. Post a post in the Forum and insert a new Administrator Account link in the network image.

2. Wait for the site administrator to log on to the main site background. The database administrator data before the post is accessed after logon is shown in figure.

3. log on to the background as an administrator and access the post to view the page requesting to create an administrator.

4. Check the database and find that there are multiple administrators. you can log on to the console of the main site as needed.