[HDDS-2111] XSS fragments can be injected to the S3g landing page

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.5.0
• Component/s: S3
• Labels: pull-request-available
• Target Version/s: 0.4.1
• Flags: Patch, Important
• External issue URL: https://github.com/apache/hadoop/blob/trunk/hadoop-ozone/s3gateway/src/main/resources/webapps/static/index.html
• Assignee: Marton Elek
• Reporter: Aayush
• Created: 11/Sep/19 12:35
• Updated: 24/Feb/20 20:55
• Resolved: 16/Sep/19 22:52

Description

VULNERABILITY DETAILS
There is a way to bypass anti-XSS filter for DOM XSS exploiting a "window.location.href".

Considering a typical URL:

scheme://domain:port/path?query_string#fragment_id

Browsers encode correctly both "path" and "query_string", but not the "fragment_id". 

So if used "fragment_id" the vector is also not logged on Web Server.

VERSION
Chrome Version: 10.0.648.134 (Official Build 77917) beta

REPRODUCTION CASE
This is an index.html page:

aws s3api --endpoint <script>document.write(window.location.href.replace("static/", ""))</script> create-bucket --bucket=wordcount</pre>

The attack vector is:
index.html?#<script>alert('XSS');</script>

• PoC:
  For your convenience, a minimalist PoC is located on:
  http://security.onofri.org/xss_location.html?#<script>alert('XSS');</script>

• References

• DOM Based Cross-Site Scripting or XSS of the Third Kind - http://www.webappsec.org/projects/articles/071105.shtml

reference:- 

https://bugs.chromium.org/p/chromium/issues/detail?id=76796

Issue Links

• links to: GitHub Pull Request #1447