Attacks/Breaches
7/16/2007
08:30 AM
Connect Directly
RSS
E-Mail
50%
50%

Cross-Site, Cross-Service

New cross-site scripting worm could propagate across Webmail services, user address lists

An Italian researcher has found a way to spread a Webmail worm to every user in a victim's address book, no matter which client they may use.

Rosario Valotta, an independent researcher, has published a proof of concept which demonstrates that Webmail clients from multiple service providers can be exploited simultaneously via cross-site scripting vulnerabilities that they all have in common. The exploit shows that Webmail-borne worms can be propagated at rates much faster than previously thought.

Webmail worms, like many other email attacks, spread by accessing a victim's address book and replicating themselves to addresses that use the same Webmail client. Users who were in the address book, but used a different Webmail client, were previously considered safe -- until Valotta demonstrated the spread of a Webmail worm across clients provided by four different Italian Internet service providers.

The proof of concept, dubbed the "Nduja Connection," is Valotta's first worm. In an email interview, he says he developed the exploit to help stir some action by ISPs, many of which are subject to XSS vulnerabilities.

"At the beginning, I thought that the XSS [vulnerability] I found was an isolated case, but after few searches, I realized that the problem had a bigger 'scope' -- most Websites are affected by some kind of application security vulnerability," Valotta observes. "Furthermore, security people's concerns about XSS were ignored by providers -- they were sure that users' security could never be threatened by XSS.

"So I thought, 'What could scare users and providers more than the risk of seeing their private communications published, in real time, somewhere over the Web?' " Valotta says. "And here is the worm."

Valotta's proof of concept works only for four Italian ISPs' Webmail clients -- Excite, Libero, Lycos, and Tiscali -- but it could be extended to other service providers, he says.

"I'm quite sure that the same kind of (XSS) vulnerabilities that let the worm spread [in Italy] can be found as well in U.S. or other countries' provider Websites," Valotta says. "It's just a question of how much time you want to spend searching for XSS holes."

Like many other researchers, Valotta says he hopes his efforts will help prove that enterprises need to be wary of application security issues.

"XSS is not a new issue, but its severity has always been underestimated," Valotta says. "IT professionals should be aware that in the Web 2.0 era, the worst threats will come from the front door -- public consumer Websites -- not from the back door." (See Beware of the Quiet Ones and Putting App Security to the Test.)

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3594
Published: 2014-08-22
Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

CVE-2014-4197
Published: 2014-08-22
Multiple SQL injection vulnerabilities in Bank Soft Systems (BSS) RBS BS-Client 3.17.9 allow remote attackers to execute arbitrary SQL commands via the (1) CARDS or (2) XACTION parameter.

CVE-2014-5097
Published: 2014-08-22
Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) get or (2) set action to rate.php.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.