Vulnerability Note VU#885665
MySpace fails to properly filter user-supplied content
Overview
The MySpace web site fails to properly filter user-supplied content, which may allow for cross-site scripting.
Description
MySpace is a social networking web site that allows users to post blog entries, photos, videos, and other content. MySpace blocks user-supplied <SCRIPT> (JavaScript and VBScript) and <OBJECT> (ActiveX) tags, however it does allow users to post content with <EMBED> tags. EMBED tags are for providing content to Netscape-style plug-ins. Internet Explorer also supports the EMBED tag by checking the MIME type of the content and handing it off to the appropriate ActiveX control for that content type. Because some plug-ins, including Apple QuickTime and Adobe Flash, have scripting support, this means that the MySpace web site indirectly may allow user-supplied scripts to execute within the context of the MySpace web site. This causes a cross-site scripting vulnerability. More information about cross-site scripting is available in CERT Advisory CA-2000-02. |
Impact
A wide range of impacts may be possible, including modification of content on the MySpace web site, disclosure of passwords or other personal information. Likewise, information stored in cookies could be stolen or corrupted. An attacker could also exploit web browser vulnerabilities that require scripting support, either directly or by redirecting to another web site. |
Solution
We are currently unaware of a practical solution to this problem, however the following workarounds may help mitigate the vulnerability: |
Disable scripting |
Systems Affected (Learn More)
Vendor | Status | Date Notified | Date Updated |
---|---|---|---|
MySpace.com | Affected | 12 Dec 2006 | 12 Dec 2006 |
CVSS Metrics (Learn More)
Group | Score | Vector |
---|---|---|
Base | N/A | N/A |
Temporal | N/A | N/A |
Environmental | N/A | N/A |
References
- http://www.cert.org/tech_tips/securing_browser/#how_to_secure
- http://www.gnucitizen.org/blog/myspace-quicktime-worm-follow-up
- http://www.gnucitizen.org/blog/cross-context-scripting
- http://www.gnucitizen.org/blog/backdooring-quicktime-movies/
- http://wp.netscape.com/assist/net_sites/embed_tag.html
- http://msdn.microsoft.com/workshop/author/dhtml/reference/objects/embed.asp
- http://www.mozilla.org/projects/security/components/ConfigPolicy.html#jspolicies
Credit
Thanks to Petko D. Petkov of gnucitizen.org for reporting this vulnerability.
This document was written by Chris Taschner and Will Dormann.
Other Information
- CVE IDs: Unknown
- Date Public: 07 Dec 2006
- Date First Published: 13 Dec 2006
- Date Last Updated: 15 Dec 2006
- Severity Metric: 9.58
- Document Revision: 12
Feedback
If you have feedback, comments, or additional information about this vulnerability, please send us email.