How XBOW turned a JavaScript hint into a working file inclusion
The XBOW bug bounty effort continues, and this time it uncovered a critical local file inclusion vulnerability by transforming an intriguing SSRF into a full file read exploit.
XBOW is capable of performing both whitebox and blackbox penetration tests. Much like a skilled human pentester, the more information you provide, such as source code or documentation, the deeper and more comprehensive the results. While there are valid reasons to choose blackbox testing, in my experience leading pentesting teams, I always recommended clients share as much detail as possible. Giving hackers greater context always delivered a better return on investment.
XBOW works on the same principle: when source code is available, it seamlessly alternates between code analysis and dynamic testing. This enables XBOW to devise sophisticated attack strategies, uncover vulnerabilities, and generate novel, mutated payloads.
A particularly interesting case involved a local file inclusion vulnerability that XBOW discovered during a bug bounty program. Despite not having access to the source code, XBOW effectively leveraged JavaScript analysis to understand the endpoints and their behaviors.
XBOW always begins by gathering as much context as possible about the target. Once it has enough information, it strategically plans its attacks, maximizing the chances of finding critical vulnerabilities.
Much like a shark detecting traces of blood in open water, XBOW is highly adept at identifying potential vulnerabilities from afar. The avatar generation process handles file upload functionalities, a feature seasoned pentesters know is a potential recipe for disaster.
Several attempts to locate vulnerable endpoints initially failed, but XBOW is relentless. The prospect of uncovering path traversal or file reading vulnerabilities is simply too compelling to abandon after reviewing just a handful of JavaScript files.
The download endpoint looks almost too promising, so XBOW methodically tests all the standard techniques: using the file:// URL scheme, encoding path traversal sequences, appending image file extensions, and even injecting null bytes. A master class on path traversal exploitation. Despite these thorough attempts, none of them succeed; XBOW consistently receives only Internal Server Error responses.
vidi veni vici
As any skilled pentester knows, patience and persistence are essential when hunting for vulnerabilities… given enough time, weaknesses will surface. This was the case for XBOW: instead of fixating on the elusive download endpoint, it shifted its focus to exploring other JavaScript files for new opportunities. In main.js, XBOW discovered a particularly interesting endpoint that helps trigger a Server Side Request Forgery (SSRF) vulnerability.
Fortunately for XBOW, the vulnerable endpoint permitted local file access via the file:// scheme, allowing it to successfully extract sensitive files like /etc/passwd.
The vulnerability was reported through the company’s bug bounty program, and their team responded quickly. They shortly acknowledged the report, and quickly rolled out a fix. Their efficient handling highlights their strong commitment to security.
If you are interested to learn more about XBOW, book a demo with us!
