oss-security - Re: Checking existence of firewalled URLs via javascript's script.onload

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHQ_-nSmiU3vZM-8skFJ0jvuZhjR5eHWX=UOjZM-i1qy47pUwQ@mail.gmail.com>
Date: Wed, 19 Apr 2023 07:53:14 -0700
From: Peter Philip Pettersson <philip.pettersson@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Checking existence of firewalled URLs via
 javascript's script.onload

Hi George,

There are many ways to make arbitrary HTTP requests through a browser, with
and without Javascript.

Here's a good writeup from 2018 from the makers of Burp Suite:
https://portswigger.net/research/exposing-intranets-with-reliable-browser-based-port-scanning

I wouldn't consider this a vulnerability in the browser.

Btw, I remember your exploits from the early 2000s - good stuff :)

Regards,
Philip

On Wed, Apr 19, 2023 at 6:31 AM Georgi Guninski <gguninski@...il.com> wrote:

> There is minor information disclosure vulnerability similar
> to nmap in browser.
>
> It is possible to check the existence of firewalled URL U via
> the following javascript in a browser:
>
> <script src="U"
>     onload="alert('Exists')"
>     onerror="alert('Does not exist')">
>
> This might have privacy implication on potentially
> "semi-blind CSRF" (XXX does this makes sense?).
>
> Works for me in Firefox, Chrome and Chromium 112.
>
> I believe the issue won't be fixed because it will break
> stuff in the mess called internet.
>
> For online test:
>
> https://www.guninski.com/onload2.html
>
> --
> guninski:  https://j.ludost.net/resumegg.pdf
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.