Re: Help with referer issues in XSS

Here's a couple things to try that I've learned in my experience.

First you can find out more about how the application is checking the REFERER.
Find out if the application is only verifying parts of the REFERER or
the entire URL. Try taking parts of the REFERER out and see if the
request is still valid, for example:
1. www.example.com/profile.jsp [original]
2. www.example.com/arbitrary_page.jsp
3. [no referrer]
4. www.attacker.com/www.example.com/profile.jsp

If you find a redirector on the site, you can use [2].
If the request is allowed with no REFERER, the attack site can be
hosted on HTTPS since HTTPS->HTTP won't send the REFERER [3].
Create a new folder on the attack site with the URL of the victim site.

If the referrer checking is strict [1], then the attack might now be
as easy. Either way, vuln is still vuln.

Phil

On Mar 2, 2012, at 10:43 AM, Tim <[email protected]> wrote:

>
> Hello,
>
>
>> Suppose there is a reflect XSS vulnerability in a pop SNS, but this
>> site is "concerned" about security, so they check the referer field of
>> certain POST request to make sure that they are normal and correct. Is
>> it possible for me to bypass this check within javascript? It seems
>> that I can't set this parameter like this:
>>
>> xmlHttp.setRequestHeader("Referer","http://expected.target");
>>
>> It would be appreciated if someone can give me a clue.
>
>
> I'm always interested to see what the community's response is to this
> question.  It comes up relatively frequently in the context of CSRF
> (since this kind of checking can mitigate CSRF).  Often most people
> are skeptical that this kind of checking is sufficient to prevent CSRF
> and reflected XSS, but in recent times, I am not aware of a way around
> it in the general case.
>
> Old versions of Flash do allow one to set Referer cross-domain, but it
> is my impression this was fixed quite some time ago.  Various XHR API
> vulnerabilities have also existed in the past to allow for injection
> of restricted headers, like Referer, but these could be seen as
> browser vulnerabilities.
>
> Recently [1] it was pointed out how headers containing '-' can be
> spoofed due to foolishness in CGI-compatible APIs that transliterate
> header names, but Referer of course doesn't have a '-'.
>
> Can anyone give an example of how one would get around Referer
> checking?
>
> tim
>
>
> 1. http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2012-January/008170.html
>
> _______________________________________________
> The Web Security Mailing List
>
> WebSecurity RSS Feed
> http://www.webappsec.org/rss/websecurity.rss
>
> Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA
>
> WASC on Twitter
> http://twitter.com/wascupdates
>
> [email protected]
> http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

[email protected]
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org