Attacks/Breaches
7/16/2007
08:30 AM
Connect Directly
RSS
E-Mail
50%
50%

Cross-Site, Cross-Service

New cross-site scripting worm could propagate across Webmail services, user address lists

An Italian researcher has found a way to spread a Webmail worm to every user in a victim's address book, no matter which client they may use.

Rosario Valotta, an independent researcher, has published a proof of concept which demonstrates that Webmail clients from multiple service providers can be exploited simultaneously via cross-site scripting vulnerabilities that they all have in common. The exploit shows that Webmail-borne worms can be propagated at rates much faster than previously thought.

Webmail worms, like many other email attacks, spread by accessing a victim's address book and replicating themselves to addresses that use the same Webmail client. Users who were in the address book, but used a different Webmail client, were previously considered safe -- until Valotta demonstrated the spread of a Webmail worm across clients provided by four different Italian Internet service providers.

The proof of concept, dubbed the "Nduja Connection," is Valotta's first worm. In an email interview, he says he developed the exploit to help stir some action by ISPs, many of which are subject to XSS vulnerabilities.

"At the beginning, I thought that the XSS [vulnerability] I found was an isolated case, but after few searches, I realized that the problem had a bigger 'scope' -- most Websites are affected by some kind of application security vulnerability," Valotta observes. "Furthermore, security people's concerns about XSS were ignored by providers -- they were sure that users' security could never be threatened by XSS.

"So I thought, 'What could scare users and providers more than the risk of seeing their private communications published, in real time, somewhere over the Web?' " Valotta says. "And here is the worm."

Valotta's proof of concept works only for four Italian ISPs' Webmail clients -- Excite, Libero, Lycos, and Tiscali -- but it could be extended to other service providers, he says.

"I'm quite sure that the same kind of (XSS) vulnerabilities that let the worm spread [in Italy] can be found as well in U.S. or other countries' provider Websites," Valotta says. "It's just a question of how much time you want to spend searching for XSS holes."

Like many other researchers, Valotta says he hopes his efforts will help prove that enterprises need to be wary of application security issues.

"XSS is not a new issue, but its severity has always been underestimated," Valotta says. "IT professionals should be aware that in the Web 2.0 era, the worst threats will come from the front door -- public consumer Websites -- not from the back door." (See Beware of the Quiet Ones and Putting App Security to the Test.)

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4840
Published: 2014-07-28
Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW before 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.

CVE-2014-2974
Published: 2014-07-28
Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

CVE-2014-2975
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.

CVE-2014-3303
Published: 2014-07-28
The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug ID CSCuj81713.

CVE-2014-3304
Published: 2014-07-28
The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka Bug ID CSCuj81722.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.