 |
 |
 |
|
| SecurityProNews > News > Security News > MySpace Zero Day Shows XSS Vulnerability |
[ news_security_news ]MySpace Zero Day Shows XSS Vulnerability
David Utter Staff Writer 2006-10-25  Security News RSS Feed
A cross-site scripting (XSS) issue demonstrated with MySpace as a guinea pig should be noted by security administrators due to its potential for evading XSS filters. Several people writing in response to the post about the XSS fragmentation attack vector with MySpace and its interest sections complimented poster kuza55 for finding this particular exploit. In the description of this particular exploit, the creator noted that "the actual MySpace hole could be fixed at any time, it is merely included here to illustrate that this is more than just (a) theoretical idea." As a fragmentation attack, several innocuous fragments pass through an application, in this case going through filters used for its forms. The form used as an example in MySpace provides the typical site user several fields to enter information about their interests, like music and films. After showing how to encapsulate text and pass the XSS exploit through the form, kuza55 noted how the attack can not only work on MySpace, but other sites "where input is not cleaned up and dangling tags are allowed to be posted." That could mean sites that permit user comments on articles may be vulnerable to this attack as well, he noted: ...this is probably a corner case of XSS filter evasion, but it is a corner case that could possibly be applied to many situations since we seem to be able to post html comments in many places these days. I also hope it helps illustrate how security mechanisms such as XSS filters cannot be used as simple drop in modules, but have to be integrated into your design for them to work effectively.
It may be worth checking your site to see if this trick works on it. --- Tags: MySpace, Zero Day Add to  Del.icio.us |  Digg |  Reddit |  Furl
Bookmark SecurityProNews - 
About the Author: David Utter is a business and technology writer for SecurityProNews, WebProNews, and InternetFinancialNews. More news_security_news Articles Security News RSS Feed
|
|
 |
iEntry Featured Services: Jayde Member Services | Forums | Freeware | Advertise with Us |
 |
| Contact
Us | Advertise
| Newsletter
Archive | Sitemap
| Submit an
Article | News
Feeds SecurityProNews is an iEntry, Inc.® publication - 1998-2008 All Rights Reserved | Privacy Policy and Legal |
Join the WebProWorld Forums: Click Here |
|
