[Full-disclosure] The Bug Which Isn't a Bug

[InterN0T Advisories <advisories@xxxxxxxxxxxx>]

Dear "Full Disclosers".


A couple of days ago, I discovered a bug in the Disqus Widget for
Blogger.com (I haven't heard anything from them yet, even though I've
provided them with a permanent solution that fixes the problematic code
entirely. See end of blog entry via the link.)

When a user adds this widget to his or her blog, a few lines of JavaScript
and "Layout Data Tags" are included as well, to offer functionality to the
widget.

One of these lines within a script tag in particular, is even vulnerable:

    var disqus_blogger_current_url = '<data:blog.url/>';


<data:blog.url/>, outputs the current URL "somewhat". You can't submit
custom GET-requests (afaik), but you can use the Search Form to submit data
to this variable aka data:blog.url "Layout Data Tag" (which is often used
in widgets).

This tag does not encode the following characters: ' / ! ( ) ? ; : _ , . -
* $ @

Knowing this, we know that if <data:blog.url/> is used within a javascript
variable, e.g. var x = '...'; Then it will most likely, be possible to
inject javascript into this, as an attacker can simply inject: ';alert(0);'
and the alert(0); statement, will be executed.


For more information and live PoC's please visit:
http://intern0t.blogspot.com/2012/01/bug-which-isnt-bug.html



Best regards,
MaXe

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/