Vulnerability Note VU#378688

Google Reader cross-site request forgery vulnerability

Google Reader contains a cross-site request forgery (XSRF) vulnerability that could be used to prevent a user from logging on to the service.

The Google Reader logoff button can be represented as a hyperlink. An attacker may be able to execute this link by supplying it as an image source in a malicious RSS feed. Once a user subscribes to the RSS feed, they will be unable to login to their Google Reader account.

Note that an attacker would have to convince a user to load a malicious RSS feed to exploit this vulnerability.

II. Impact

Do not load images from third party sites

Preventing third party sites from loading images in your web browser may mitigate this vulnerability. See the references section of this document for information on how to block images in specific browsers.

Systems Affected

http://reader.google.com
http://www.gnucitizen.org/blog/persistent-csrf-and-the-hotlink-hell/
http://www.microsoft.com/enable/training/ie6/pictures.aspx
http://kb.mozillazine.org/Permissions.default.image
http://michaeldaw.org/papers/hotlink_persistent_csrf
http://en.wikipedia.org/wiki/Cross-site_request_forgery

Credit

This issue was reported on the GNUCITIZEN blog.

This document was written by Ryan Giobbi.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.