Wednesday, April 7, 2010

darkreading.com vulnerable to persistent XSS injected in published articles

...or 'When re-publishing app security material helps discovering vulnerabilities in the publisher's Web application'...

darkreading.com published on 6th of April an article which describes 'meta-information XSS' (see 'Researcher Details New Class of Cross-Site Scripting Attack', available at http://darkreading.com/vulnerability_management/security/app-security/showArticle.jhtml?articleID=224201569").

The original article included a classic XSS test case, namely <script>alert(1)</script>. As a result of an existing XSS vulnerability in the darkreading.com web site, the XSS test case above turned out to be inadvertently a successful one, as shown below:



Following a brief notice I sent today to Timothy Wilson (editor at darkreading.com), he confirmed the issue, also mentioning that it is now fixed.

The HTML code from the original post (including the cited XSS test case):
a DNS TXT record that contains the value "<script>alert(1)</script>" and a service

The HTML code for current version of the article:
a DNS TXT record that contains [a certain value] and a service

With the same article being reproduced by a significant number of online publications, it could be interesting to see how many other are also affected.



161 comments:

  1. This comment has been removed by a blog administrator.

    ReplyDelete
  2. This comment has been removed by the author.

    ReplyDelete
  3. Si vous avez des litiges ou des questions d’ordre juridique, n’hésitez pas à demander les services des conseillers juridiques
    conseil juridique en ligne

    ReplyDelete
  4. Nous vous offrons des serrures toutes enseignes ou réparations de rideaux de fer, et ouverture de portes fortes en pays de porte ensuite effraction blindage de porte pour jugement d'un accès de clés facile ou de sécurité par le serrurier Athis Mons.

    ReplyDelete
  5. http://expresschauffagisteparis.fr/

    ReplyDelete
  6. The field of medical software development requires decades of experience. We as experts, we specifically provide data analysis services to help medical providers make accurate decisions and better understand activities in their medical organizations. We offer a range of software and services for general practitioners and specialists, health centers or healthcare ...

    ReplyDelete
  7. This comment has been removed by the author.

    ReplyDelete
  8. VisagesTunisie est une agence de tourisme médical pour chirurgie de visage telle que la blépharoplastie pour rajeunir les paupières, affiner le nez, greffer cheveux, etc.

    ReplyDelete
  9. <a href ="https://www.chirurgie-tunisie-clinique.com/greffe-cheveux-tunisie/>greffe cheveux Tunisie </a>

    ReplyDelete
  10. <a href="https://www.chirurgie-tunisie-clinique.com/greffe-cheveux-tunisie/>greffe cheveux Tunisie</a>

    ReplyDelete
  11. This comment has been removed by the author.

    ReplyDelete
  12. This comment has been removed by the author.

    ReplyDelete
  13. L'idée du débarras paris libre est facile. Il peut être ambigu chez beaucoup d'êtres humains. En quoi cela a pour objectif et qui peut en profiter ? Telles sont les questions vraiment très classiques sans fréquemment avoir des réponses détaillées. Si vous vous posez de même ces questions, alors vous aurez les explications en poursuivant la lecture.

    ReplyDelete
  14. séjour médical tout compris avec medespoir pour tout intervention de chirurgie esthetique tunisie

    ReplyDelete
  15. This comment has been removed by the author.

    ReplyDelete
  16. Top Services: Entreprise de débarras paris

    Notre entreprise de débarras vous offre, pour les particuliers, un service adapté aux horaires de travail avec intervention même le weekend pour débarrasser votre cave, maison ou appartement.

    Pour les professionnels, nous intervenons rapidement dans tout type de locaux, commerces, bureaux, chantiers... Avec nos déplacements et devis gratuits sans aucun engagement.

    N’hésitez plus à faire le pas pour votre Débarras.

    ReplyDelete
  17. Having read this I believed it was extremely informative. I appreciate you finding the time and energy to put this content together. 파워볼게임

    ReplyDelete
  18. Wohh exactly what I was looking for, regards for posting 릴게임

    ReplyDelete
  19. thanks for sharing great blog article.Thanks Again 스포츠토토


    ReplyDelete
  20. Found your post interesting to read. I can’t wait to see your post soon. Good Luck for the upcoming update. This article is really very interesting and effective.카지노

    ReplyDelete
  21. I’m now not positive the place you are getting your info, however great topic. 바카라사이트

    ReplyDelete
  22. Interesting stuff to read. Keep it up. This is very informative and interesting for those who are interested in blogging field.성인야설

    ReplyDelete
  23. Enjoyed reading the article above , really explains everything in detail, the article is very interesting and effective. Thank you and good luck for the upcoming articles.타이마사지

    ReplyDelete
  24. Found your post interesting to read 안마. I cant wait to see your post soon. Good Luck for the upcoming update. This article is really very interesting and effective.

    ReplyDelete
  25. This comment has been removed by the author.

    ReplyDelete