Attacks/Breaches
7/16/2007
08:30 AM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Cross-Site, Cross-Service

New cross-site scripting worm could propagate across Webmail services, user address lists

An Italian researcher has found a way to spread a Webmail worm to every user in a victim's address book, no matter which client they may use.

Rosario Valotta, an independent researcher, has published a proof of concept which demonstrates that Webmail clients from multiple service providers can be exploited simultaneously via cross-site scripting vulnerabilities that they all have in common. The exploit shows that Webmail-borne worms can be propagated at rates much faster than previously thought.

Webmail worms, like many other email attacks, spread by accessing a victim's address book and replicating themselves to addresses that use the same Webmail client. Users who were in the address book, but used a different Webmail client, were previously considered safe -- until Valotta demonstrated the spread of a Webmail worm across clients provided by four different Italian Internet service providers.

The proof of concept, dubbed the "Nduja Connection," is Valotta's first worm. In an email interview, he says he developed the exploit to help stir some action by ISPs, many of which are subject to XSS vulnerabilities.

"At the beginning, I thought that the XSS [vulnerability] I found was an isolated case, but after few searches, I realized that the problem had a bigger 'scope' -- most Websites are affected by some kind of application security vulnerability," Valotta observes. "Furthermore, security people's concerns about XSS were ignored by providers -- they were sure that users' security could never be threatened by XSS.

"So I thought, 'What could scare users and providers more than the risk of seeing their private communications published, in real time, somewhere over the Web?' " Valotta says. "And here is the worm."

Valotta's proof of concept works only for four Italian ISPs' Webmail clients -- Excite, Libero, Lycos, and Tiscali -- but it could be extended to other service providers, he says.

"I'm quite sure that the same kind of (XSS) vulnerabilities that let the worm spread [in Italy] can be found as well in U.S. or other countries' provider Websites," Valotta says. "It's just a question of how much time you want to spend searching for XSS holes."

Like many other researchers, Valotta says he hopes his efforts will help prove that enterprises need to be wary of application security issues.

"XSS is not a new issue, but its severity has always been underestimated," Valotta says. "IT professionals should be aware that in the Web 2.0 era, the worst threats will come from the front door -- public consumer Websites -- not from the back door." (See Beware of the Quiet Ones and Putting App Security to the Test.)

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web