lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 30 Sep 2007 15:26:44 +0200
From: "avivra" <avivra@...il.com>
To: "'Guy Mizrahi'" <guy@...king.org.il>,
	<full-disclosure@...ts.grok.org.uk>, <bugtraq@...urityfocus.com>
Cc: <toomas@...dreader.com>
Subject: RE: feedreader3 has XSS vulnerability

Hi,

This is a cross-zone scripting vulnerability.
FeedReader uses the IE browser control to render HTML.
The RSS reader converts the RSS item data to a formatted HTML file and
caches it locally. 
When the user clicks on the RSS item, the RSS reader displays the local
cached file, and any script in that file (or external references) will run
in Local Zone.
Therefore, an attacker can create/manipulate an RSS feed that will execute
arbitrary code on the user's machine.

Btw, according to Bugtrag (http://www.securityfocus.com/bid/25849/exploit)
an attacker must convince the victim into subscribing a malicious RSS feed.
As I've already discussed this in my blog post
(http://aviv.raffon.net/2007/08/16/VistaGadgetsGoneWild.aspx) regarding the
Windows Vista's RSS gadget, this claim is not true. In today's Web2.0 era,
if a remote code execution vulnerability exists in RSS readers, it is very
easy to create an RSS based worm.

--Aviv.

-----Original Message-----
From: Guy Mizrahi [mailto:guy@...king.org.il] 
Sent: Friday, September 28, 2007 3:02 PM
To: bugtraq@...urityfocus.com
Subject: feedreader3 has XSS vulnerability

Hello,

I have found that feedreader3 has XSS vulnerability in its internal browser.
When I post a script into wordpress( like <script>alert("XSS")</script>, the

RSS feed in the internal browser is vulnerable and show an alert box.
POC movie here:
http://www.hacking.org.il/demos/feedreader3.wmv

Guy Mizrahi (ZuLL)
Hebrew blog: http://www.hacking.org.il 


Powered by blists - more mailing lists