Vulnerability Note VU#885665

MySpace is a social networking web site that allows users to post blog entries, photos, videos, and other content. MySpace blocks user-supplied <SCRIPT> (JavaScript and VBScript) and <OBJECT> (ActiveX) tags, however it does allow users to post content with <EMBED> tags. EMBED tags are for providing content to Netscape-style plug-ins. Internet Explorer also supports the EMBED tag by checking the MIME type of the content and handing it off to the appropriate ActiveX control for that content type. Because some plug-ins, including Apple QuickTime and Adobe Flash, have scripting support, this means that the MySpace web site indirectly may allow user-supplied scripts to execute within the context of the MySpace web site. This causes a cross-site scripting vulnerability. More information about cross-site scripting is available in CERT Advisory CA-2000-02.

A wide range of impacts may be possible, including modification of content on the MySpace web site, disclosure of passwords or other personal information. Likewise, information stored in cookies could be stolen or corrupted. An attacker could also exploit web browser vulnerabilities that require scripting support, either directly or by redirecting to another web site.

We are currently unaware of a practical solution to this problem, however the following workarounds may help mitigate the vulnerability:

Disable scripting

Disable scripting in your web browser, as specified in the Securing Your Web Browser document and the Malicious Web Scripts FAQ. This can also be accomplished by adding "myspace.com" to the Restricted Sites zone in Internet Explorer. Users of Mozilla-based browsers can use Configurable Security Policies (CAPS) to disable scripting for the "myspace.com" web site.

Validate web site addresses

When interacting with web sites, pay close attention to the web site address displayed by the browser. Especially when providing login information, make sure the web browser is displaying the proper URL, as described in the US-CERT Cyber Security Tip ST04-014.

Validate web site certificates

Web sites may require sensitive information such as passwords or credit card information. In these cases, make sure the web site is using an encrypted (HTTPS) connection. Validate the web site certificate, as described in US-CERT Cyber Security Tip ST05-010.