By SecWorm.net - Cross Site Scripting vulnerability in Imageshack.us

 

SecWorm.net - Advisory
http://Secworm.net/
Cross Site Scripting [XSS] issue in Imageshack.us

--------------------------------------------------------------
1. Advisory Information:
--------------------------------------------------------------
Title:- Cross Site Scripting vulnerability in Imageshack.us
Advisory ID:- SecWormNetwork-2009-1
Advisory URL:- http://secworm.net/showthread.php?tid=23

--------------------------------------------------------------
2. Vulnerability Information:
--------------------------------------------------------------
Class:- Cross Site Scripting
Remotely Exploitable:- Yes
Locally Exploitable:- Yes

PATCHED :-  NO [not as if now].

--------------------------------------------------------------
3. Vulnerability Description:
--------------------------------------------------------------
When uploading multiple images, website redirects to an album information
page which is vulnerable to cross site scripting. The URL can be modified to
execute javascript within the security context of the imageshack.us domain.
This can be used to hijack user's cookies and thus their authenticated
sessions.

--------------------------------------------------------------
4. POC [Proof of Concept]:
--------------------------------------------------------------
http://img6.imageshack.us/gal.php?g=%3Cs.../script%3E
<http://img6.imageshack.us/gal.php?g=%3Cscript%3Ealert%28document.cookie%29%
3C/script%3E> 
Screenshot:- http://secworm.net/poc/secwormnetwork-2009-1.jpg
--------------------------------------------------------------
5. Credits:
--------------------------------------------------------------
This vulnerability was discovered by Nishant Soni (brainst0rm) from SecWorm
Network.

--------------------------------------------------------------
6. Report Timeline:
--------------------------------------------------------------
15th December 2009 - Nishant Soni from SecWorm Network leaves an Email from
"Contact Us" page at Imageshack.us
15th December 2009 - Nick from Imageshack.us replies to Nishant's email
requesting vulnerability disclosure.
15th December 2009 - Nishant Soni reveals the vulnerability information to
Nick.
Further Reply Awaited.

--------------------------------------------------------------
7. About SecWorm Network:
--------------------------------------------------------------
SecWorm Network is a group of Security Researchers & Ethical hackers with
the motto of security awareness and helping others to secure themselves.
Everyone can reach to us at http://www.SecWorm.net/

--------------------------------------------------------------
8. Disclaimer & Copyright:
--------------------------------------------------------------
The contents of this advisory are copyright C 2009 SecWorm Network, and may
be distributed freely provided that and proper credit is given.

 

Thanks & Regards,

Nishant Soni (brainst0rm).