Imageshack.us vulnerability by SecWorm.net.

indiansword's Avatar, Join Date: Oct 2008
Security Expert
Here is the white paper that I wrote.
Quote:
SecWorm.net - Advisory
http://Secworm.net/
Cross Site Scripting [XSS] issue in Imageshack.us

--------------------------------------------------------------
1. Advisory Information:
--------------------------------------------------------------
Title:- Cross Site Scripting vulnerability in Imageshack.us
Advisory ID:- SecWormNetwork-2009-1
Advisory URL:-http://secworm.net/showthread.php?tid=23&action=lastpost

--------------------------------------------------------------
2. Vulnerability Information:
--------------------------------------------------------------
Class:- Cross Site Scripting
Remotely Exploitable:- Yes
Locally Exploitable:- Yes

--------------------------------------------------------------
3. Vulnerability Description:
--------------------------------------------------------------
When uploading multiple images, website redirects to an album information page which is vulnerable to cross site scripting. The URL can be modified to execute javascript within the security context of the imageshack.us domain. This can be used to hijack user's cookies and thus their authenticated sessions.

--------------------------------------------------------------
4. POC [Proof of Concept]:
--------------------------------------------------------------
http://img6.imageshack.us/gal.php?g=...9%3C/script%3E
Screenshot:- http://secworm.net/poc/secwormnetwork-2009-1.jpg
--------------------------------------------------------------
5. Credits:
--------------------------------------------------------------
This vulnerability was discovered by Nishant Soni (brainst0rm) from SecWorm Network.

--------------------------------------------------------------
6. Report Timeline:
--------------------------------------------------------------
15th December 2009 - Nishant Soni from SecWorm Network leaves an Email from "Contact Us" page at Imageshack.us
15th December 2009 - Nick from Imageshack.us replies to Nishant's email requesting vulnerability disclosure.
15th December 2009 - Nishant Soni reveals the vulnerability information to Nick.
Further Reply Awaited.

--------------------------------------------------------------
7. About SecWorm Network:
--------------------------------------------------------------
SecWorm Network is a group of Security Researchers & Ethical hackers with the motto of security awareness and helping others to secure themselves.

Everyone can reach to us at http://www.SecWorm.net/

--------------------------------------------------------------
8. Disclaimer & Copyright:
--------------------------------------------------------------
The contents of this advisory are copyright (c) 2009 SecWorm Network, and may be distributed freely provided that and proper credit is given.
0
shabbir's Avatar, Join Date: Jul 2004
Go4Expert Founder
I really liked the report timeline.
0
learn3r's Avatar, Join Date: Dec 2009
Light Poster
awesome finding. XSS is all over on the internet. Seems they have fixed it.
0
indiansword's Avatar, Join Date: Oct 2008
Security Expert
Yes, it has been fixed.
@shabbir :- Yes, I was impressed by their responses too UNLIKE OTHERS.
0
Deadly Ghos7's Avatar, Join Date: Dec 2009
Contributor
Nice finding, bro. It always makes me interested. I remember the pwnage of imageshack.us by antisec guy, RoMeO.