lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 19 Aug 2009 14:04:52 -0600
Subject: Adobe Flex 3.3 SDK DOM-Based XSS

Adobe Flex 3.3 SDK DOM-Based XSS
Public Release Date: 8/19/2009
Adam Bixby - Gotham Digital Science
Affected Software:  Adobe Flex 3.3 SDK and earlier

1. Summary

Adobe Flex is a software development kit released by Adobe Systems for the development and deployment of cross-platform rich Internet applications based on the Adobe Flash platform.  An instance of a DOM-based Cross Site Scripting (XSS) vulnerability was found in the default index.template.html of the SDK that is an HTML template used by FlexBuilder to generate the wrapper html for all the application files in your project.  The XSS vulnerability appears to affect all user's that download and utilize this HTML wrapper.  You can find more information on DOM-based XSS here:

The vendor (Adobe Systems) was notified of this issue on June 29, 2009.  The vendor responded by releasing version 3.4 on August 19, 2009 and has also issued a security bulletin:

2. Technical Details

File: index.template.html

1) Data enters via URL parameters through the window.location javascript object, is then stored into MMredirectURL variable, and passed to the AC_FL_RunContent() function.

Line 59:
var MMredirectURL = window.location;

Line 63:
            "FlashVars", "MMredirectURL=" MMredirectURL '&MMplayerType=' MMPlayerType '&MMdoctitle=' MMdoctitle "",

2) The MMredirectURL variable with user-controllable input is passed to AC_GetArgs and ultimately to AC_Generateobj, which performs a document.write. Writing the un-validated data to HTML creates the XSS exposure.

File: AC_OETags.js

Line 200:
function AC_FL_RunContent(){
  var ret = 
    (  arguments, ".swf", "movie", "clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"
     , "application/x-shockwave-flash"
  AC_Generateobj(ret.objAttrs, ret.params, ret.embedAttrs);

Line 178:
function AC_Generateobj(objAttrs, params, embedAttrs) 
    var str = '';
    if (isIE && isWin && !isOpera)
  		str  = '<object ';
  		for (var i in objAttrs)
  			str  = i   '="'   objAttrs[i]   '" ';
  		str  = '>';
  		for (var i in params)
  			str  = '<param name="'   i   '" value="'   params[i]   '" /> ';
  		str  = '</object>';
    } else {
  		str  = '<embed ';
  		for (var i in embedAttrs)
  			str  = i   '="'   embedAttrs[i]   '" ';
  		str  = '> </embed>';


NOTE: For the exploit to work, the end user must have installed an older version of Adobe Flash than the value that is set in the Globals variable "requiredMajorVersion" (Line 36).

3. Proof-of-Concept Exploit

This vulnerability can be exploited against any Flex based application that uses the index.template.html wrapper page containing the code above.  In order to exploit this issue, the end user must have Adobe Flash installed, but it must be an older version than the required one set by the application owner (set in Globals variable "requiredMajorVersion"). 

Reproduction Request:

4. Recommendation 

Update to Flex 3.4 SDK or view Adobe's TechNotes on how to manually fix the issue:

5. About Gotham Digital Science 

Gotham Digital Science (GDS) is an international security services company specializing in Application and Network Infrastructure security, and Information Security Risk Management. For more information on GDS, please contact labs (at) or visit

Powered by blists - more mailing lists