4 ms·
> The author is aware. Since the website is vulnerable to XSS, you could inject a script that removes the disclaimer.
by hk__2 3y ago
> The author is aware.
Since the website is vulnerable to XSS, you could inject a script that removes the disclaimer.
- gregsadetsky 3y ago100%. poc: https://joshcsimmons.com/post/eNqzKU4uyiwosUvJTy7NTc0r0UtPLXHNSQUxi50qnXMSi4v9EnNTNdRzMtMzStQ1ow1i9YpSc%2FPLUjU0bfShmrm4lBVKMjKLFYAoKTEFACeDHYg%3D https://joshcsimmons.com/post/eNqzKU4uyiwosUvJTy7NTc0r0UtPLX...
- cengizIO 3y agoVery clever. For those wondering, this won't gunzip since it's compressed using zlib. you must do a chain like this: URL Decode -> Base64 Decode -> Zlib Inflate.
- gregsadetsky 3y agoright on! I used https://bugdays.com/gzip-base64 https://bugdays.com/gzip-base64 to go back and forth. base64 generates slashes, so the site (and I) run encodeURIComponent in the devtools on the resulting base64 to make sure it's completely url-safe. --- the poc "payload" is eNqzKU4uyiwosUvJTy7NTc0r0UtPLXHNSQUxi50qnXMSi4v9EnNTNdRzMtMzStQ1ow1i9YpSc%2FPLUjU0bfShmrm4lBVKMjKLFYAoKTEFACeDHYg%3D which uri-component-decodes to: eNqzKU4uyiwosUvJTy7NTc0r0UtPLXHNSQUxi50qnXMSi4v9EnNTNdRzMtMzStQ1ow1i9YpSc/PLUjU0bfShmrm4lBVKMjKLFYAoKTEFACeDHYg= which un-base64+gzip's to (using the site I posted above): <script>document.getElementsByClassName('light')[0].remove()</script> # this is bad
- joshcsimmons 3y agoHah this is clever. Mixed feelings on patching this but I patched it for now.
- pwdisswordfishc 3y agos/removes the disclaimer/exploits a browser 0-day/
- Dylan16807 3y agoThere are much less weird links you can give someone if you have 0-day. I don't think that's a problem worth worrying about for the author.
- pwdisswordfishc 3y agoIt’s a problem worth worrying about for users who maintain whitelists of domains they allow JavaScript from.