Video subs challenge

[supra08]

In this PR I've added the video subtitles challenge. I had to use jade as the template because the real scenario is understood by seeing the <script> of the rendered html. The basic flow is as follows:

• The attacker needs to find the /promotion route. (Possibility of implementing the easter egg here!)
• Once the attacker is in the video page, he observes that there is only a upload subtitle form to perform the xss.
• He uploads an infected subtitle file containing the prescribed payload <script>alert('xss')</script> to successfully solve the challenge.

Now, here the catch is, simply entering <script>alert('xss')</script> won't work here. The subs are rendered in a special <script type=text/vtt> tag. This practice is found in a few websites to evade cross origin policies. An ideal infected subs file would contain:

• A closing </script> tag to escape the original <script type=text/vtt>.
• Then the attack <script>alert('xss')</script>

So the attacker needs to inspect the js of the page first to observe what's going on.

TODO:

• Convert Upload Subs to Upload Correct Subs and a fake review system to finally upload them.
• e2e tests and units tests for challenge

Your views on this, @bkimminich , @J12934 , @CaptainFreak

[bkimminich]

How about we don't add an upload button for the subtitles, but instead put them somewhere on the backend side where they can be overwritten with the same attack used for Arbitrary File Write?

[supra08]

Yep that I believe would be a better idea. Uploading of subs looks a bit unrealistic too 😅 .

[supra08]

@bkimminich, I've made the subs to load from a file in ftp/assets. Since this file will be visible through the localhost:3000/ftp route, the user needs to overwrite the file using the zipper vulnerability. Upon visiting the video page(now with infected subs), the challenge will be solved. I'll try to fix the failing tests asap.

[bkimminich]

One of the failing tests was on me when I did some refactoring, should be fixed with next build. Can you put the subs into some folder that is not in /ftp? As the Aribtrary File Write challenge is already about overwriting a file in there, it would be nice to show with this that even a seemingly less exposed file can be overwritten with ZipSlip.

[supra08]

Now shifted the subs file to the dist directory in the assets folder, because normally a website would maintain it this way. But now I guess, the user must be given more hints for locating the subs file as it has now become very tough to even guess the location. Sorry for the delay, got some chromedriver related problems that took time.
@bkimminich ^

[bkimminich]

This should be pulled out of userProfile.js and be reused by both Jade pages in order to avoid code duplication.

[supra08]

So should I put this into the data directory in a new file themes.js? @bkimminich

[bkimminich]

I'd probably put it into /views because it's only for the Jade screens.

[supra08]

Alright 👍

[bkimminich]

@supra08, are any further changes coming in for this PR? Pulling out the theme for all Jade screens is still open. @J12934, do you have any additional remarks for this PR?

[supra08]

I'm really sorry for the delay. This just slipped out. I've made the changes. Please do tell if more modifications are requires. @bkimminich, @J12934

[lock]

This thread has been automatically locked because it has not had recent activity after it was closed. 🔒 Please open a new issue for regressions or related bugs.