"OpenID" (a.k.a. OpenXSS) implementations...
Thursday, 25. September 2008, 01:47:07
I have just took a quick look at yet another OpenID-related php script which is, just like the others I've seen, open to XSS attacks.
People, be prepared; probably by this weekend[1] I will be disclosing those vulnerabilities in at least three different so-called "products". When will people finally take security and quality seriously? (especially on auth stuff!)
[1] I'll be taking part in a small talk this Saturday (an introduction to GNU, Linux, and Debian; followed by an install fest) so I hope I will have time to review all of the openid-related scripts I'm aware of.
WIDGETIZE
Øyvind Østlund # 25. September 2008, 09:14
- ØØ -
Anonymous # 25. September 2008, 14:39
I bet you'll be talking/posting on how to discover these issues? Not that I'd use OpenID in any of my projects, but I sometimes use OpenID to log in and would like to test the sites I use (but don't tell anyone, German laws made this illegal a while ago - even if you're the developer you're not allowed to use tools that could discover such issues…).
Raphael # 25. September 2008, 18:38
only PHP scripts atm; I'm not keen on python so I don't know if I'll ever take a look at those, but I just noticed there are some openid perl packages already in the Debian archive which I might cover as well.
I may disclose how to exploit them if the code is really ugly and the programmer didn't care at all about security. In other cases I will probably wait a couple of days before providing POC exploits.
yeah, I'm aware of such an, IMO, stupid law. Although developers could detect most of the XSS issues if they actually read the php manual.
Anonymous # 27. September 2008, 23:19
owneds