News for hackers. Stuff that matters.

A comment on Apple.com XSS attack.

Re:Apple.com XSS attack by benhoyt on Tuesday November 03, 2009 @06:25PM (#920504)
As I mentioned on proggit, that URL doesn't actually demonstrate cross-site scripting, but it looks like the page is vulnerable to iframe and scripting insertion too. Example:

   http://www.apple.com/itunes/affiliates/download/?artistName=<iframe+id%3D"frame"+src%3D"http://www.microsoft.com/"+style%3D"width:+600px;+height:+400px;"></iframe>&thumbnailUrl=http://www.straitstimes.com/STI/STIMEDIA/image/20090501/windows7-microsoft.jpg&itmsUrl=http://www.microsoft.com&albumName=Better+Operating+System
[ Parent | on HN ]
Re:Apple.com XSS attack by NathanKP on Tuesday November 03, 2009 @06:31PM (#920512)
That is really bad. If you can insert code then you can probably do other even worse things.
[ Parent | on HN ]
Re:Apple.com XSS attack by axod on Tuesday November 03, 2009 @06:35PM (#920520)
Probably steal session cookies, then hijack sessions and grab any personal data etc :/ Not good.
[ Parent | on HN ]
Re:Apple.com XSS attack by NathanKP on Tuesday November 03, 2009 @06:39PM (#920528)
Someone could make an iframe with what looked like the Apple login and trick people into "logging in". Then they distribute the URL via shortened URLs through Twitter and grab a bunch of Apple logins.

Free iTunes until you get caught. Chances are Apple would be able to track who downloaded what onto what Apple devices. I'm sure retribution would be swift and thorough.

In my opinion that does count as an XSS attack, though it perhaps does not use the traditional techniques. (This for those who have said that this is actually not an XSS attack.)

[ Parent | on HN ]