bugtraq - Cross Site Scripting in Google

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0607042146310.22789@fingers.shocking.com>
Date: Tue, 4 Jul 2006 21:55:01 -0700 (PDT)
From: RSnake <rsnake@...cking.com>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	webappsec@...urityfocus.com, websecurity@...appsec.org
Subject: Cross Site Scripting in Google

Google is vulnerable to cross site scripting attacks.  I found a
function built off their add RSS feed function that returns HTML if a
valid feed is found.  It is intended as an AJAXy (dynamic JavaScript
anyway) call from an inline function and the page is intended to do
sanitation of the function.  However, that's too late, and it returns
the HTML as a query string, that is rendered, regardless of the fact
that it is simply a JavaScript snippet.

Here is the post that explains the whole thing:

http://ha.ckers.org/blog/20060704/cross-site-scripting-vulnerability-in-google/

-RSnake
http://ha.ckers.org/
http://ha.ckers.org/xss.html
http://ha.ckers.org/blog/feed/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/