search menu icon-carat-right cmu-wordmark

CERT Coordination Center

MySpace fails to properly filter user-supplied content

Vulnerability Note VU#885665

Original Release Date: 2006-12-13 | Last Revised: 2006-12-15


The MySpace web site fails to properly filter user-supplied content, which may allow for cross-site scripting.


MySpace is a social networking web site that allows users to post blog entries, photos, videos, and other content. MySpace blocks user-supplied <SCRIPT> (JavaScript and VBScript) and <OBJECT> (ActiveX) tags, however it does allow users to post content with <EMBED> tags. EMBED tags are for providing content to Netscape-style plug-ins. Internet Explorer also supports the EMBED tag by checking the MIME type of the content and handing it off to the appropriate ActiveX control for that content type. Because some plug-ins, including Apple QuickTime and Adobe Flash, have scripting support, this means that the MySpace web site indirectly may allow user-supplied scripts to execute within the context of the MySpace web site. This causes a cross-site scripting vulnerability. More information about cross-site scripting is available in CERT Advisory CA-2000-02.


A wide range of impacts may be possible, including modification of content on the MySpace web site, disclosure of passwords or other personal information. Likewise, information stored in cookies could be stolen or corrupted. An attacker could also exploit web browser vulnerabilities that require scripting support, either directly or by redirecting to another web site.


We are currently unaware of a practical solution to this problem, however the following workarounds may help mitigate the vulnerability:

Disable scripting

Disable scripting in your web browser, as specified in the Securing Your Web Browser document and the Malicious Web Scripts FAQ. This can also be accomplished by adding "" to the Restricted Sites zone in Internet Explorer. Users of Mozilla-based browsers can use Configurable Security Policies (CAPS) to disable scripting for the "" web site.

Validate web site addresses

When interacting with web sites, pay close attention to the web site address displayed by the browser. Especially when providing login information, make sure the web browser is displaying the proper URL, as described in the US-CERT Cyber Security Tip ST04-014.

Validate web site certificates

Web sites may require sensitive information such as passwords or credit card information. In these cases, make sure the web site is using an encrypted (HTTPS) connection. Validate the web site certificate, as described in US-CERT Cyber Security Tip ST05-010.

Vendor Information

885665 Affected

Notified:  December 13, 2006 Updated: December 12, 2006



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group Score Vector



Thanks to Petko D. Petkov of for reporting this vulnerability.

This document was written by Chris Taschner and Will Dormann.

Other Information

CVE IDs: None
Severity Metric: 9.58
Date Public: 2006-12-07
Date First Published: 2006-12-13
Date Last Updated: 2006-12-15 18:56 UTC
Document Revision: 13

Sponsored by CISA.