Vulnerability Note VU#885665

MySpace fails to properly filter user-supplied content

Original Release date: 13 Dec 2006 | Last revised: 15 Dec 2006

Overview

The MySpace web site fails to properly filter user-supplied content, which may allow for cross-site scripting.

Description

MySpace is a social networking web site that allows users to post blog entries, photos, videos, and other content. MySpace blocks user-supplied <SCRIPT> (JavaScript and VBScript) and <OBJECT> (ActiveX) tags, however it does allow users to post content with <EMBED> tags. EMBED tags are for providing content to Netscape-style plug-ins. Internet Explorer also supports the EMBED tag by checking the MIME type of the content and handing it off to the appropriate ActiveX control for that content type. Because some plug-ins, including Apple QuickTime and Adobe Flash, have scripting support, this means that the MySpace web site indirectly may allow user-supplied scripts to execute within the context of the MySpace web site. This causes a cross-site scripting vulnerability. More information about cross-site scripting is available in CERT Advisory CA-2000-02.

Impact

A wide range of impacts may be possible, including modification of content on the MySpace web site, disclosure of passwords or other personal information. Likewise, information stored in cookies could be stolen or corrupted. An attacker could also exploit web browser vulnerabilities that require scripting support, either directly or by redirecting to another web site.

Solution

We are currently unaware of a practical solution to this problem, however the following workarounds may help mitigate the vulnerability:

Disable scripting

Disable scripting in your web browser, as specified in the Securing Your Web Browser document and the Malicious Web Scripts FAQ. This can also be accomplished by adding "myspace.com" to the Restricted Sites zone in Internet Explorer. Users of Mozilla-based browsers can use Configurable Security Policies (CAPS) to disable scripting for the "myspace.com" web site.

Validate web site addresses

When interacting with web sites, pay close attention to the web site address displayed by the browser. Especially when providing login information, make sure the web browser is displaying the proper URL, as described in the US-CERT Cyber Security Tip ST04-014.

Validate web site certificates

Web sites may require sensitive information such as passwords or credit card information. In these cases, make sure the web site is using an encrypted (HTTPS) connection. Validate the web site certificate, as described in US-CERT Cyber Security Tip ST05-010.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
MySpace.comAffected12 Dec 200612 Dec 2006
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Petko D. Petkov of gnucitizen.org for reporting this vulnerability.

This document was written by Chris Taschner and Will Dormann.

Other Information

  • CVE IDs: Unknown
  • Date Public: 07 Dec 2006
  • Date First Published: 13 Dec 2006
  • Date Last Updated: 15 Dec 2006
  • Severity Metric: 9.58
  • Document Revision: 12

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.