Microsoft Word Document Upload to Stored XSS: A Case Study

Posted by vuln on Thursday May 10, 2018 @04:03PM
from the coalfire.com dept.

https://www.coalfire.com/Solutions/Coalfire-Labs/The-Coalfire-LABS-Blog/may-2018/microsoft-word-document-upload-to-stored-xss

( 3 comments | 41 points | on HN )

Re:Microsoft Word Document Upload to Stored XSS: A Case Study by darshitpp on Monday May 14, 2018 @09:15AM (#17065177)

I'm curious if the same can be done via an Excel .xls or .xlsx file

[ Parent | on HN ]

Re:Microsoft Word Document Upload to Stored XSS: A Case Study by yardshop on Monday May 14, 2018 @11:29AM (#17066306)

It would possibly work with XLSX or PPTX or any of the newer Office file formats that rely on zipping a folder of XML files. Open Document Format files like those from Libre Office might be capable of this too.

XLS, PPT, DOC or other old style Office files don't follow this format so this specific approach wouldn't work on those.

[ Parent | on HN ]

Re:Microsoft Word Document Upload to Stored XSS: A Case Study by sebazzz on Monday May 14, 2018 @10:15AM (#17065698)

I would say it is because it appeared that in the end he relied on renaming a filename in the zip to a script tag with contents.

[ Parent | on HN ]