lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <000601c23d00$6b827000$e62d1c41@kc.rr.com> From: mattmurphy at kc.rr.com (Matthew Murphy) Subject: Cross-Site Scripting Attacks Possible At Multiple Webspace Provid ers Issue: Multiple web space providers are susceptible to script-based origin validation attacks. Impact: Cookie theft, page manipulation, ... Additional Information: http://www.murphy.101main.net/vulns/2002-24.txt Many web space providers offer their users web space by way of a folder-based URL, something like this: http://www.domain.com/community/uid An interesting scenario occurs when pages are visited on (commonplace) JavaScript-enabled browsers. The same-origin policy that is used to avoid cross-frame security violations is completely compromised, as the only difference in these URLs to the browser is folder/virtual paths, not sufficient for a same-origin violation. This vulnerability allows anyone who can create a webspace account on the host to manipulate the appearance of other hosted sites provided the victim can be coaxed to a page under their control. This allows for typical cross-domain scripting attacks (stealing cookies, reading form data, ...), which could be pretty devastating, as one site instantly has access to the guts of a few thousand (million?) others. I have confirmed that Terra Lycos' AngelFire service is vulnerable, and also Yahoo! Geocities is believed susceptible. It is very likely that others are vulnerable. "The reason the mainstream is thought of as a stream is because it is so shallow." - Author Unknown --------------------------------------------------------------------- This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message and are hereby notified that any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited.
Powered by blists - more mailing lists