Everyday application security is facing new threats and it challenges the business users. The latest is in the form of XSS attacks; where an application serving PDF files are vulnerable to these attacks.
The Universal PDF XSS issue was discovered by Stefano Di Paola and Giorgio Fedon and it was presented on 23C3 security conference. This vulnerability obviously affects the Adobe Acrobat Reader which is a widely used software among business, non-business organizations and individuals. By abusing Acrobat.s open parameter features well protected sites become vulnerable to Cross-site scripting attacks if they host PDF documents. This is pretty bad and unless you update your reader or change the way your browser handles PDF documents, you may get hacked quite badly. This issue is very serious.
This vulnerability can be exploited by using the URL in the following fashion
It is very clear that any malicious user can write the required code for malicious activity. Can hijack sessionID and thereby the user identity or execute code from another location and thus redirect a user to a phishing site and a lot more.
Try it on your windows OS
Another one for directory listing
OK, now lets go more details from the fun part of the vulnerability.
PDF being widely used, it is important to understand that most of the applications in the internet have this vulnerability. This makes the situation a lot worse because If you happen to be on a malicious site or you click a malicious link, attackers can simultaneously compromise several of your WEB accounts that are currently open/authenticated.
Note the point that, this attack will be effective only if you/victim click on the url.
Now lets see what hackers/crackers/(you name it) do to make use of this vulnerability?
Being an intelligent user, chances are less you click on a suspicious link. However attackers can make use of sneak techniques to force you somehow, by changing the file extension of the PDF document to .mp3 or .mov or even .html. It looks less suspicious, but still when pulled from the server the content will be served as application/pdf:
A slight modification in the htaccess file of http://currentdomain/
RewriteRule *.(jpg|png|css|mp3|mov|avi)$ http://otherdomain/abc.pdf
When a user clicks on the following url
the code will be executed on http://otherdomain and not in the currentdomain. The user has fallen into the trap.
Now you have tiny URL.
One can embed the malicious URL in a tiny URL and send the tiny URL to the victims. This will make the user less suspicious about the URL and has more possibility of clicking on the link.
Using tinyurl you can have
http://tinyurl.com/..Another option is to have the exploit link opening automatically without user action. This can be performed by embedding the link in a site, normally malicious site. When a user visits such sites, the exploit page will automatically opened by using iframes.
his vulnerability will be a solid tool for phishing attackers and they can use this cleaverly to gather personal information and identity thefts.
What are the fixes?
Do not click any url which is not familiar and/or which is not from a trusted source. Always type the URL and then guide through the site links.
Upgrade your Adobe Acrobat reader to version 8
Upgrade the browsers using vendor released patches