6 ms·
Youtube comments susceptible to XSS
- ComputerGuru 16y agoSolution: Do away with YouTube comments altogether. They're such a brain-drain as it is. Come to think of it - no longer needed. Just use YouTube Feather (beta) to disable comments on the site: http://www.youtube.com/feather_beta http://www.youtube.com/feather_beta
- oscardelben 16y agoIt's not enough apparently, the name of the video is also vulnerable.
- Indyan 16y agoTo make things even worse, those bloody 4chaners are already aware of it. http://boards.4chan.org/b/res/247794166 http://boards.4chan.org/b/res/247794166 (Warning: That page triggered several alerts for drive-by malware downloads (Kaspersky))
- TeHCrAzY 16y agoDon't waste your time linking directly to 4chan posts, especially on high traffic boards like /b/. It only keeps a certain number of threads up at one time, ones that stop being replied to will scroll off the end of the queue and be nuked.
- deleted 16y ago[deleted]
- chime 16y agoXSS is such a huge deal and yet I don't understand why browser makers/w3c etc. haven't agreed on any solutions yet. a. Have a meta-tag (or something in the <head>) that says: do not allow in-line script tags on this page. Only run scripts from external .js files. No onclick/onmouse code allowed in HTML. b. Have a <noscript_within> tag that tells browsers to completely ignore all in-line script tags (including onclick code) within the tag. That way sites can allow all HTML within the <noscript_within><div id="comments">....</div></noscript_within> NoScript sounds like a better and better option these days. I already use FlashBlock to protect against 0-day Flash vulnerabilities.
- deleted 16y ago[deleted]
- deleted 16y ago[deleted]
- chacha102 16y agoBut what if the person simply broke out of the <noscript_within> tag? <noscript_within><div id="comments"><div id="comment"></noscript_within><script src="myfile.js"></script></div></div></noscript_within> Probably the best method for this is giving the amount of characters are in the <noscript_within> tag. I don't believe this would break caching, as the length only changes when the content changes.
- exit 16y agoi suggested that (deleted comment), but it seems easy enough to at least scan for a closing "</noscript_within>" tag in the comment body.
- sounddust 16y agoUntil someone writes </noscript_within > or < /noscript_within> and your script doesn't catch it but the browser accepts it. Or one of hundreds of other small details that neither one of us has thought of yet.
- chime 16y agoThat's why browser makers have to agree on the acceptable usage and suggest what web devs should search/for and sanitize. Right now, browser makers do not recommend anything except "sanitize your input" and that means something completely different for each browser.
- dasil003 16y agoit seems easy enough... Yes, every single XSS vulnerability is pretty easy to fix on its own. The problem is that you'll never get all of them across browsers. It's time that browser makers went back to the drawing board and came up with a base security model to cut the fat away from the basic attack footprint. Some drastic limit on the source of executable JS files, specified in an HTTP header, could be very effective.
- oscardelben 16y agothey disabled comments, but I just read this on /b/: Create video response Name of video = script of choice ??? WORKING, VERIFIED AND UNABLE TO BE FIXED EASILY BY YOUTUBE. So stay away from youtube for now
- deleted 16y ago[deleted]
- deleted 16y ago[deleted]
- tszming 16y agoNow, the hole was blocked by displaying "Error. Try again"
- nphase 16y agoAnd just when you thought youtube comments couldn't get any trashier.
- joeyh 16y agoOne thing I find interesting about youtube's response is they are reportedly going in and removing <script> tags from already posted comments. So.. do this mean they sanitize comments at post time, rather than at display time?
- Indyan 16y agoGoogle's official statement: "We took swift action to fix a cross-site scripting (XSS) vulnerability on youtube.com that was discovered several hours ago. Comments were temporarily hidden by default within an hour, and we released a complete fix for the issue in about two hours. We’re continuing to study the vulnerability to help prevent similar issues in the future." http://techie-buzz.com/online-security/youtube-hack-update.html http://techie-buzz.com/online-security/youtube-hack-update.h...
- steveitis 16y agoWhen I did this same shit to Reddit a year ago (during the time they were doing it to Sears whilst crying 'I'm being oppressed!) they all called me an asshole. http://www.reddit.com/r/reddit.com/comments/9cvvp/why_it_was_a_good_idea_to_remove_the_sears_post/ http://www.reddit.com/r/reddit.com/comments/9cvvp/why_it_was... Now it's because everyone at Google sucks, and this is some unforgivable sin on the content providers behalf, not the jerk users who are exploiting it. Fine internet. Have it both ways.... Sigh.