Full Disclosure mailing list archives

Re: [0 Day] XSS Persistent in Blogspot of Google


From: Jakub Zoczek <zoczus () gmail com>
Date: Tue, 22 Jan 2013 01:02:38 +0100

Hi,

*Execution of owner-supplied JavaScript on Blogger:* Blogger users are
permitted to place custom JavaScript in their own blog templates and blog
posts; our take on this is that blogs are user-generated content, not
different from any third-party website on the Internet. Naturally, for your
safety, we do employ spam and malware detection technologies - but we
believe that the flexibility in managing your own content is essential to
the success of our blogging platform.

*Therefore, the ability to execute owner-supplied scripts on your own blog
is not considered to be a vulnerability. That being said, the ability to
inject arbitrary JavaScript onto somebody else’s blog would likely qualify
for a reward!

*Source <http://www.google.com/about/appsecurity/reward-program/>*
*


Peace,
JZ


On Tue, Jan 22, 2013 at 12:01 AM, ANTRAX <antrax.bt () gmail com> wrote:

Hi all, I'm ANTRAX from Argentina, and I'm owner of www.underc0de.org
Today, I going to shared with you about XSS in blogger. This is a very
simple, but isn´t fix yet..
This bug could be exploited by bloggers without administrator permissons.

Steps to reproduce the XSS:

1.- Create a new post in the blog and insert some script

[image: Imágenes integradas 1]

2.- When the administrator enter in the administration panel in
"templates" section, blogger automatically executed the script, because
blogger have a mini-preview in "Ahora en el blog", then execute the script

[image: Imágenes integradas 2]

3.- Ready! the script has been executed!

[image: Imágenes integradas 3]

Also, you can steal cookies!

[image: Imágenes integradas 4]

I reported to google about it, but they not fixed yet.

Kind regards partners!

*ANTRAX*

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread: