4 ms·
Apple.com XSS attack
- makecheck 17y agoPretty much anything works; such as this. :) http://www.apple.com/itunes/affiliates/download/?artistName=love http://www.apple.com/itunes/affiliates/download/?artistName=...
- NathanKP 17y agoYep you can do just about anything that you want. http://www.apple.com/itunes/affiliates/download/?artistName=the%20meaning%20of%20life http://www.apple.com/itunes/affiliates/download/?artistName=... I'm sure that when Apple finds this they'll close the gap pretty fast though.
- martian 17y agoLooks like they already did. For Posterity, here's a screenshot: http://visualmotive.com/etc/apple_xss.png http://visualmotive.com/etc/apple_xss.png
- white_eskimo 17y agostill works. Jeez that is pretty bad. How does one go about reporting something like this? Wonder how long it will take to fix...
- weaksauce 17y agoThey have a bug reporting mechanism for people who are ADC(free) members or iPhone developers: http://www.devworld.apple.com/bugreporter/ http://www.devworld.apple.com/bugreporter/
- benhoyt 17y agoAs I mentioned on proggit, that URL doesn't actually demonstrate cross-site scripting, but it looks like the page is vulnerable to iframe and scripting insertion too. Example: http://www.apple.com/itunes/affiliates/download/?artistName=<iframe+id%3D"frame"+src%3D"http://www.microsoft.com/"+style%3D"width:+600px;+height:+400px;"></iframe>&thumbnailUrl=http://www.straitstimes.com/STI/STIMEDIA/image/20090501/windows7-microsoft.jpg&itmsUrl=http://www.microsoft.com&albumName=Better+Operating+System
- NathanKP 17y agoThat is really bad. If you can insert code then you can probably do other even worse things.
- axod 17y agoProbably steal session cookies, then hijack sessions and grab any personal data etc :/ Not good.
- NathanKP 17y agoSomeone could make an iframe with what looked like the Apple login and trick people into "logging in". Then they distribute the URL via shortened URLs through Twitter and grab a bunch of Apple logins. Free iTunes until you get caught. Chances are Apple would be able to track who downloaded what onto what Apple devices. I'm sure retribution would be swift and thorough. In my opinion that does count as an XSS attack, though it perhaps does not use the traditional techniques. (This for those who have said that this is actually not an XSS attack.)
- deleted 17y ago[deleted]
- NathanKP 17y agoApple promotes Ubuntu Linux: http://www.apple.com/itunes/affiliates/download/?artistName=the+Open+Source+community&thumbnailUrl=http://i210.photobucket.com/albums/bb99/Cyndaquil-Thrill/ubuntu-logo.png&itmsUrl=http://www.ubuntu.com&albumName=something+other+than+Mac+OS+X http://www.apple.com/itunes/affiliates/download/?artistName=...
- adrinavarro 17y agoIt looks like the "XSS" bug is mostly client-side, I think that the GET contents are presented using JS: http://grab.by/exu http://grab.by/exu (that's with the given URL). It doesn't allows any kind of <script> tag, so yeah, it's fun and a bit insecure (may be used for phishing?? dunno), but it's not the worst at all.
- willwagner 17y agoIt allows you to put javascript in a click handler: http://www.apple.com/itunes/affiliates/download/?artistName=%3Cimg%20src=%22http://cheapestblog.info/wp-content/uploads/2009/06/click-me.jpg%22%20onclick=%22alert%28%27hello%20world%27%29;%22/%3E http://www.apple.com/itunes/affiliates/download/?artistName=...
- adrinavarro 17y agoI was wrong, you're right! Now that's medium-insecure. But still not to panic at this, just XSS and client-side (everything is inserted by JS). Well, there are worst things, right? :)
- chrisbroadfoot 17y ago"just" XSS?
- NathanKP 17y agoOn Safari the click handler works but the image just shows up as an error, not a "Click Me" message.
- geuis 17y agohttp://www.apple.com/itunes/affiliates/download/?artistName=LITTLEST+PET+SHOP+online&thumbnailUrl=http://www.lpso.com/images/logo.png&itmsUrl=http://www.lpso.com&albumName=an+exciting+all-new+world+for+you,+your+friends+and+your+favorite+pets+to+play http://www.apple.com/itunes/affiliates/download/?artistName=...
- gurraman 17y agoLooks like they fixed the glitch.
- 0wned 17y agoComplexity kills. Rich Internet Apps will kill all operating systems... except for OpenBSD.
- NathanKP 17y agoWhy will OpenBSD be immune?
- 0wned 17y agoBecause it does not try to keep up with the fast-paced, complex flaws of Rich Internet Apps written by people who have no knowledge of information security and are only interested in getting attention for themselves and their shitty start-up.
- dasil003 17y agoThereby rendering it unusable by people who want to create RIAs yet have deep knowledge of information security?
- jrockway 17y agoHate to say it, but Firefox on OpenBSD is as vulnerable to this bug as any other browser. Of course, I doubt OpenBSD users have iTunes accounts...
- tedunangst 17y agoI have an iTunes account.
- johndevor 17y agoI think Apple fixed it?
- NathanKP 17y agoIt looks like they just removed the functionality. So it is fixed for now. It was fun while it lasted. ;)
- incomethax 17y agoAnyone have a screenshot? I seem to have missed all the fun.
- deleted 17y ago[deleted]
- deleted 17y ago[deleted]
- borism 17y agohttp://i.imgur.com/OfdDC.png http://i.imgur.com/OfdDC.png
- deleted 17y ago[deleted]
- 1234 17y agotiiiu