There is no form validation in the profile page, allowing for execution of arbitrary JS (think redirects, cookies, etc.). PM me for full details, but I assume anyone who's part of the avatar modifying spree on OT will know what it is.
Arbitrary (javascript) code injection allowed through profile page
- Thread starter Chronoshock
- Start date
Red Squirrel
No Lifer
Yeah while is funny and that thread was fun, this could be dangerous. I am not sure if it escapes < > and " properly but I did not really want to try. 
I have a big feeling it does not.
To put into perspective someone could steal cookies, which means gaining access to any user's session (even a mod or admin). I hope I'm not saying too much here, but just putting into perspective how dangerous this is.
I have a big feeling it does not.To put into perspective someone could steal cookies, which means gaining access to any user's session (even a mod or admin). I hope I'm not saying too much here, but just putting into perspective how dangerous this is.
newnameman
Platinum Member
- Nov 20, 2002
- 2,219
- 0
- 0
Just to note... malicious behavior could be entirely transparent to its victims. It's not easy to detect when this has been abused, so it needs to fixed proactively, not reactively.
Cogman
Lifer
- Sep 19, 2000
- 10,286
- 147
- 106
Originally posted by: RedSquirrel
Yeah while is funny and that thread was fun, this could be dangerous. I am not sure if it escapes < > and " properly but I did not really want to try.
To put into perspective someone could steal cookies, which means gaining access to any user's session (even a mod or admin). I hope I'm not saying too much here, but just putting into perspective how dangerous this is.
agreed, there is a VERY large amount of things that could be done with this. and a lot of them could be implemented in such a way that we would never actually see the code being executed. It is a very dangerous flaw to have (Not like harmless timewarps)
Originally posted by: RedSquirrel
To put into perspective someone could steal cookies, which means gaining access to any user's session (even a mod or admin). I hope I'm not saying too much here, but just putting into perspective how dangerous this is.
Isnt that how LoKe got into the mod account, stealing cookies?
olds
Elite Member
- Mar 3, 2000
- 50,128
- 781
- 126
Originally posted by: mxrider
Originally posted by: RedSquirrel
To put into perspective someone could steal cookies, which means gaining access to any user's session (even a mod or admin). I hope I'm not saying too much here, but just putting into perspective how dangerous this is.
Isnt that how LoKe got into the mod account, stealing cookies?
Why didn't I say that? Oh, wait.
Drakkon
Diamond Member
- Aug 14, 2001
- 8,401
- 1
- 0
I love the reaction - rather than focus on the problem they just don't want us using non-standard avatars - brilliant!
What is to say I save a copy of a "good" avatar - upload it to my own domain - and use it instead? It would look the same but imagine the possibilities....
What is to say I save a copy of a "good" avatar - upload it to my own domain - and use it instead? It would look the same but imagine the possibilities....
- Jun 10, 2004
- 14,608
- 6,094
- 136
Originally posted by: RedSquirrel
Yeah while is funny and that thread was fun, this could be dangerous. I am not sure if it escapes < > and " properly but I did not really want to try.
To put into perspective someone could steal cookies, which means gaining access to any user's session (even a mod or admin). I hope I'm not saying too much here, but just putting into perspective how dangerous this is.
It doesn't, and is a "showstopping" issue. OP even demonstrated a proof of concept, but thankfully did not share how to do it.
GodlessAstronomer
Lifer
- Oct 27, 2007
- 17,009
- 5
- 0
Guys this is a BIG DEAL and goes way beyond off-site avatars. Arbitrary JS leaves every user here potentially exposed to cross site scripting attacks. I haven't looked into the details but this is a major concern if what the OP says is true.
MmmSkyscraper
Diamond Member
- Jul 6, 2004
- 9,472
- 1
- 76
shortylickens
No Lifer
- Jul 15, 2003
- 80,287
- 17,082
- 136
Not to incite any attacks, but I would rather have people (white hats, if you prefer) exploiting the system en masse now with "proof of concept" exploitation and forcing AT staff to fix it rather than someone maliciously exploiting it at any random time.
Assuming it would be fixed quickly by AT staff...
Assuming it would be fixed quickly by AT staff...
Platypus
Lifer
- Apr 26, 2001
- 31,046
- 321
- 136
Easy potential for contained XSS with this, without saying more it'd be quite possible for someone with an admin account to simply view a thread that a malicious user has posted in and it would be all over. I'm sure you guys remember the last time this happened.
This is a SERIOUS serious issue, all kidding and avatar switching aside, and honestly everyone should install something like noscript immediately.
http://noscript.net/
This is a SERIOUS serious issue, all kidding and avatar switching aside, and honestly everyone should install something like noscript immediately.
http://noscript.net/
I agree, but unfortunately there aren't enough people who can fix the problem. I think it's just Derek Wilson, and he apparently has his hands full with vB (Can't confirm this, he might just have his hands full with joints :wink; ).
I'm thinking we should make a big signed petition, and let Anand know that the forums need more support for technical stuff like this and the vB switch. I know he isn't making a huge amount of money from the forums, but many of us do visit the main site, and you would think that a little security would be a big issue on computer forums run by tech experts.
I'd make a petition, but I don't carry enough weight. If it were mod made, and supported by most/all of the forum staff, maybe we could get stuff done.
Platypus
Lifer
- Apr 26, 2001
- 31,046
- 321
- 136
petitions don't do shit, FT is full of awful code and I'm not entirely sure what relationship AT has with FT... if they're a paying client it should be up to FT to release a patch.
Perhaps they can disable avatars for the time being...? Though I'm sure there are other unchecked buffers in it that most likely have the same issue.
I feel sorry for the powers that be here since their hands are kind of bound but seriously this should be a priority or the forums should just be shut down until they can fix it.
Perhaps they can disable avatars for the time being...? Though I'm sure there are other unchecked buffers in it that most likely have the same issue.
I feel sorry for the powers that be here since their hands are kind of bound but seriously this should be a priority or the forums should just be shut down until they can fix it.
TRENDING THREADS
-
Discussion Zen 5 Speculation (EPYC Turin and Strix Point/Granite Ridge - Ryzen 9000)- Started by DisEnchantment
- Replies: 25K
-
Discussion Intel Meteor, Arrow, Lunar & Panther Lakes + WCL Discussion Threads
- Started by Tigerick
- Replies: 24K
-
Discussion Intel current and future Lakes & Rapids thread- Started by TheF34RChannel
- Replies: 23K
-
-
Facebook
Twitter