full-disclosure - The Bug Which Isn't a Bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 17 Jan 2012 19:23:53 -0500
From: InterN0T Advisories <advisories@...ern0t.net>
To: <full-disclosure@...ts.grok.org.uk>
Subject: The Bug Which Isn't a Bug

Dear "Full Disclosers".

A couple of days ago, I discovered a bug in the Disqus Widget for
Blogger.com (I haven't heard anything from them yet, even though I've
provided them with a permanent solution that fixes the problematic code
entirely. See end of blog entry via the link.)

When a user adds this widget to his or her blog, a few lines of JavaScript
and "Layout Data Tags" are included as well, to offer functionality to the
widget.

One of these lines within a script tag in particular, is even vulnerable:

    var disqus_blogger_current_url = '<data:blog.url/>';

<data:blog.url/>, outputs the current URL "somewhat". You can't submit
custom GET-requests (afaik), but you can use the Search Form to submit data
to this variable aka data:blog.url "Layout Data Tag" (which is often used
in widgets).

This tag does not encode the following characters: ' / ! ( ) ? ; : _ , . -
* $ @

Knowing this, we know that if <data:blog.url/> is used within a javascript
variable, e.g. var x = '...'; Then it will most likely, be possible to
inject javascript into this, as an attacker can simply inject: ';alert(0);'
and the alert(0); statement, will be executed.

For more information and live PoC's please visit:
http://intern0t.blogspot.com/2012/01/bug-which-isnt-bug.html

Best regards,
MaXe

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/