Campaign Sites Full of Vulnerabilities 36
An anonymous reader writes "Bloggers have been buzzing about the new wave of "Web 2.0" campaign sites, but it seems that a lot of presidential candidates haven't bothered to protect themselves from cross-site scripting attacks. A blogger has found a collection of XSS vulnerabilities including the websites of Barack Obama, Joe Biden, John Edwards, Mitt Romney, John Cox, Newt Gingrich, Tom Tancredo, the Democratic National Committee, and even a surprise from Whitehouse.gov. Some of the holes are low-risk, but others would allow a user's accounts on the affected website to be compromised. A victim would simply have to click on a maliciously crafted link that appears to lead to the candidate's site."
There are a lot of things that can be done (Score:5, Interesting)
For example: some discussion boards only check the url endings to see if it ends with jpg or gif before allowing you to specify it as your avatar.
Most url shortening sites allow you to add
So if you pick an expanded URL of http://targetsite.com/do=somethingnaughty&foo=
And the shortened URL is say: http://shorturl.org/s/szxvnf
Then you can specify an image to be http://shorturl.org/s/szxvnf/blah.jpg
and it will expand to http://targetsite.com/do=somethingnaughty&foo=/bl
And so something naughty happens without the victim even needing to click on anything.
If the site signs urls with the user's session cookie, and all urls and forms must have a checksum derived from this, then that makes it harder for the attacker.
However, if the attacker manages to inject javascript somewhere, that javascript could figure out the session cookies and other stuff. And that is why javascript is such a risk.
To reduce such risks, I proposed years ago to the W3C and browser makers to have an HTML tag that disables active content, but nobody really seemed interested.
Example:
<shieldson lock="randomstring" allowed="java,vrml,svg"
disallowed material disabled
<shieldsoff lock="randomstring"/>
The attacker has to guess "randomstring" in order to inject active content that's not specifically allowed between <shieldson> and <shieldsoff>. Otherwise the browser will just ignore it (and/or log an error).
Without such tags, HTML is like driving a car with 100 accelerator pedals, but not a single brake pedal. To stop you need to make sure that ALL 100 accelerator pedals are not pressed.
Various people have said: "Just escape stuff correctly". But I think the evidence is that even though in theory people can make sure all 100 "Go" pedals are "escaped", in practice that doesn't happen well enough.
Furthermore, if someone comes up with a new "Go" tag #101, your old escaping libraries might not escape it correctly. Whereas my proposed "brake" tag will have a "default deny" behaviour, the browser should only allow specified active content. So any new type of active content that slips through escaping will still be ignored.
In my opinion the browser makers and browser language makers are not really interested about security.
Oh well...
Hackers = America hatin' terrorists? (Score:3, Interesting)