Using dz as an example to describe an attack method against network image Functions

Source: Internet
Author: User

This vulnerability is caused by a vulnerability that is directly put into the src attribute of the img label without checking the validity of the network image. Currently, most websites on the Internet use similar methods to process network images. The post mainly uses discuz as an example.

Currently, all discuz versions are affected. I won't tell you that freebuf can do the same!

Discus does not verify the validity of the network image when processing the network image, resulting in injecting links. However, Discus are limited in the following scenarios, because discuz itself enables random formhash variables to prevent CSRF attacks, the exploitation of this vulnerability on CSRF still has certain limitations, however, it is not difficult to achieve Trojan, traffic, advertising, and phishing.

Usage:

Use Network images for phishing.

1. Find a post on the discuz forum and insert online images into your own phishing page.

2. Browse the post to view the phishing page.

3. If the security awareness is poor, the account and password will be entered.

4. Attackers can obtain the password and complete phishing.

II. Network images are used for CSRF attacks. discuz uses formhash to prevent CSRF attacks. However, this only solves its own problems and does not take into account the user's website architecture. If the discuz user's main site and Forum use the same domain, it may cause CSRF attacks,Next we will use our own test environment for verification.

1. Post a post in the Forum and insert a new Administrator Account link in the network image.

2. Wait for the site administrator to log on to the main site background. The database administrator data before the post is accessed after logon is shown in figure.

3. log on to the background as an administrator and access the post to view the page requesting to create an administrator.

4. Check the database and find that there are multiple administrators. you can log on to the console of the main site as needed.

 

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.