Friday, October 06, 2006









Orkut XSS - silently fixed!



On the 14th August , I got a scrap from my friend wishing me happy independence day (15 th).
I noticed one interesting thing, I could see image of Indian flag along with the scrap.

I quickly realized that something was wrong. Same scraps were floating around all over orkut that day. After modifying scrap text a little, I could verify that XSS did infact exist.

When I opened my scrap book that night, I couldn't see images any more. Had the scrap not spread on such a large scale, this XSS would have remained unnoticed I believe.

What concerned me was that this XSS was of persistent type!

Scrap Text that was used to verify this ->

www.orkut.com/%22%3e%3c/a%3e%3Cimg%20src%3D%22http%3A//www.bandeirasanimadas.com/Asia/India/3dflagsdotcom_india_2fawm.gif%22%20onload%3Dalert%281%29%3E%3Ca%20style%3D%22display%3Anone%22%20href%3D%22
Let's greet the independence of India. CHEERS!

No comments: