Monday, 18 June 2012

YUI <v2.8.2 Reflective XSS Flash swf

Couldn't find an example POC for this exploit, so had to do some diggin.

'Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to charts/assets/charts.swf.'

 I eventually found where the parameters were being passed to the Flash SWF. 'Use FlashVars to pass variables to SWF files'.

For future reference I would just do a search for "flashvars". 

<object width="100%" height="100%" id="yuigen1" classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000">

<param name="movie" value="./Scripts/Yahoo/charts/assets/charts.swf"/>

<param name="quality" value="high"/>

<param name="allowScriptAccess" value="always"/>

<param name="wmode" value="opaque"/>

<param name="flashvars" value="allowedDomain="/>

These arguments can also be passed to the SWF in a GET request e.g.


Now I just have to work out whick parameter causes the XSS, so using any decompiler available I did a search for the parameter names, 'allowedDomain', 'elementID', and 'eventHandler':

protected function initializeComponent() : void


this.elementID = this.loaderInfo.parameters.elementID;

this.javaScriptEventHandler = this.loaderInfo.parameters.eventHandler;

var allowedDomain:* = this.loaderInfo.parameters.allowedDomain;



and, this.elementID, event);

This passes elementID as the first parameter to the javaScriptEventHandler.

The following example shows how you can use the ExternalInterface class

(flash.external.ExternalInterface) to send a string from Flash Player to the HTML container where it is displayed using the JavaScript alert() function.

function button_click(evt:MouseEvent):void {"alert", xmlResponse);


Brilliant, the example from Adobe shows us exactly how to do an ALERT msg box.

I just change the eventHandler from YAHOO.Widget.FlashAdapter.eventhandler to alert and I get a popup for 'yuigen1'.

I can then change the elementID to be 'XSS' and I have my XSS popup proof of concept:

Similarly for uploader.swf (I didn't have swfstore.swf on the server to test but I believe the following would also work) :

No comments:

Post a Comment