Vulnerability Note VU#885665

MySpace fails to properly filter user-supplied content

Overview

The MySpace web site fails to properly filter user-supplied content, which may allow for cross-site scripting.

I. Description

MySpace is a social networking web site that allows users to post blog entries, photos, videos, and other content. MySpace blocks user-supplied <SCRIPT> (JavaScript and VBScript) and <OBJECT> (ActiveX) tags, however it does allow users to post content with <EMBED> tags. EMBED tags are for providing content to Netscape-style plug-ins. Internet Explorer also supports the EMBED tag by checking the MIME type of the content and handing it off to the appropriate ActiveX control for that content type. Because some plug-ins, including Apple QuickTime and Adobe Flash, have scripting support, this means that the MySpace web site indirectly may allow user-supplied scripts to execute within the context of the MySpace web site. This causes a cross-site scripting vulnerability. More information about cross-site scripting is available in CERT Advisory CA-2000-02.

II. Impact

A wide range of impacts may be possible, including modification of content on the MySpace web site, disclosure of passwords or other personal information. Likewise, information stored in cookies could be stolen or corrupted. An attacker could also exploit web browser vulnerabilities that require scripting support, either directly or by redirecting to another web site.

III. Solution

We are currently unaware of a practical solution to this problem, however the following workarounds may help mitigate the vulnerability:

Disable scripting

Disable scripting in your web browser, as specified in the Securing Your Web Browser document and the Malicious Web Scripts FAQ. This can also be accomplished by adding "myspace.com" to the Restricted Sites zone in Internet Explorer. Users of Mozilla-based browsers can use Configurable Security Policies (CAPS) to disable scripting for the "myspace.com" web site.

Validate web site addresses

When interacting with web sites, pay close attention to the web site address displayed by the browser. Especially when providing login information, make sure the web browser is displaying the proper URL, as described in the US-CERT Cyber Security Tip ST04-014.

Validate web site certificates

Web sites may require sensitive information such as passwords or credit card information. In these cases, make sure the web site is using an encrypted (HTTPS) connection. Validate the web site certificate, as described in US-CERT Cyber Security Tip ST05-010.

Systems Affected

Vendor	Status	Date Notified	Date Updated
MySpace.com	Vulnerable	12-Dec-2006

References

http://www.cert.org/tech_tips/securing_browser/#how_to_secure
http://www.gnucitizen.org/blog/myspace-quicktime-worm-follow-up
http://www.gnucitizen.org/blog/cross-context-scripting
http://www.gnucitizen.org/blog/backdooring-quicktime-movies/
http://wp.netscape.com/assist/net_sites/embed_tag.html
http://msdn.microsoft.com/workshop/author/dhtml/reference/objects/embed.asp
http://www.mozilla.org/projects/security/components/ConfigPolicy.html#jspolicies

Credit

Thanks to Petko D. Petkov of gnucitizen.org for reporting this vulnerability.

This document was written by Chris Taschner and Will Dormann.

Other Information

Date Public:	2006-12-07
Date First Published:	2006-12-13
Date Last Updated:	2006-12-15
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	9.58
Document Revision:	12

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader