Full Disclosure mailing list archives
Re: [0 Day] XSS Persistent in Blogspot of Google
From: Jakub Zoczek <zoczus () gmail com>
Date: Tue, 22 Jan 2013 01:02:38 +0100
Hi, *Execution of owner-supplied JavaScript on Blogger:* Blogger users are permitted to place custom JavaScript in their own blog templates and blog posts; our take on this is that blogs are user-generated content, not different from any third-party website on the Internet. Naturally, for your safety, we do employ spam and malware detection technologies - but we believe that the flexibility in managing your own content is essential to the success of our blogging platform. *Therefore, the ability to execute owner-supplied scripts on your own blog is not considered to be a vulnerability. That being said, the ability to inject arbitrary JavaScript onto somebody else’s blog would likely qualify for a reward! *Source <http://www.google.com/about/appsecurity/reward-program/>* * Peace, JZ On Tue, Jan 22, 2013 at 12:01 AM, ANTRAX <antrax.bt () gmail com> wrote:
Hi all, I'm ANTRAX from Argentina, and I'm owner of www.underc0de.org Today, I going to shared with you about XSS in blogger. This is a very simple, but isn´t fix yet.. This bug could be exploited by bloggers without administrator permissons. Steps to reproduce the XSS: 1.- Create a new post in the blog and insert some script [image: Imágenes integradas 1] 2.- When the administrator enter in the administration panel in "templates" section, blogger automatically executed the script, because blogger have a mini-preview in "Ahora en el blog", then execute the script [image: Imágenes integradas 2] 3.- Ready! the script has been executed! [image: Imágenes integradas 3] Also, you can steal cookies! [image: Imágenes integradas 4] I reported to google about it, but they not fixed yet. Kind regards partners! *ANTRAX*
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [0 Day] XSS Persistent in Blogspot of Google ANTRAX (Jan 22)
- Re: [0 Day] XSS Persistent in Blogspot of Google Jakub Zoczek (Jan 22)
- Re: [0 Day] XSS Persistent in Blogspot of Google ANTRAX (Jan 22)
- Re: [0 Day] XSS Persistent in Blogspot of Google Gynvael Coldwind (Jan 25)
- Re: [0 Day] XSS Persistent in Blogspot of Google ANTRAX (Jan 25)
- Re: [0 Day] XSS Persistent in Blogspot of Google Elfius (Jan 27)
- Re: [0 Day] XSS Persistent in Blogspot of Google Michal Zalewski (Jan 28)
- Re: [0 Day] XSS Persistent in Blogspot of Google Guifre (Jan 29)
- Re: [0 Day] XSS Persistent in Blogspot of Google antisnatchor (Jan 29)
- Re: [0 Day] XSS Persistent in Blogspot of Google ANTRAX (Jan 22)
- Re: [0 Day] XSS Persistent in Blogspot of Google Jakub Zoczek (Jan 22)