full-disclosure - Flash adverts and XSS (clickTAG revisited)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <116791eb0606070334ge6caa85hacb48b4fb3b46fd1@mail.gmail.com>
Date: Wed Jun  7 11:34:15 2006
From: compromise at gmail.com (Xavier)
Subject: Flash adverts and XSS (clickTAG revisited)

Greetings,

It seems that high profile sites (the likes of MySpace, Xanga, Heiss,
CNN, Yahoo, CNET, FOX, OSTG Network / Slashdot, etc)  are allowing
advertisers to distribute vulnerable Flash objects on their user
pages.

The problem is in a generic user "click tracker" code provided by
Macromedia some odd years ago that has been recycled and redistributed
as time went on. Let me point out that this vulnerability is _nothing
new_ in fact it was reported three years ago:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0208

The reason why the vulnerable code is still affecting a large number
of sites today is because with time it seems advertisers have recycled
their own examples and thus created a network of disinformation. Adobe
has an updated version of the clickTAG guide here:
http://www.adobe.com/resources/richmedia/tracking/designers_guide/

Vulnerable code:
on (release)
{
    getURL(clickTag, "_top");
}

(In the ActionScript code shown above the "clickTag" variable is not sanitized.)

The getURL() function is capable of opening up HTTP pages using GET
(and POST), it can open up FTP connections, and finally execute
JavaScript code. In a situation where an advertiser uploads a
vulnerable Flash file to your server, then proceeds to embed it into
the user pages, a vector of attack is opened; Cross Site Scripting.

Further information, including PoCs, can be found at the following
reference: http://xavsec.blogspot.com/2006/06/your-space-my-flash-his-cookies.html

regards,
Xavier.