Alaina Hardie – I like dogs, robots, brains, and genomes.
Alaina Hardie – I like dogs, robots, brains, and genomes.
Christopher Morton, Psy.D.
Description: G. S. McNamara's technology and art blog
art (55161) photography (49511) news (24502) internet (23721) technology (15838) graphics (5580) reviews (4137) computers (3982) laptops (1897) cellphones (49)
Four days ago the AddThis Email Sharing Button API was vulnerable to cross-site scripting (XSS) and iframe injection. The PHP backend service endpoint that handles form submissions would reflect back payloads sent to one parameter in particular. The “tofriend” parameter got left behind when protections were applied to all others. Payloads sent to other parameters were effectively blocked from executing.
Because values sent to the “tofriend” parameter were embedded in an element’s attribute in the response page, it was possible to terminate this attribute prematurely with a double quote and then write your payload. A little circumvention was also needed because on the server side AddThis was checking for pairs of script tags to block. Read more about different XSS payload forms by following the link at the end of this post.
AddThis Email Sharing Button and Form
Alaina Hardie – I like dogs, robots, brains, and genomes.
Alaina Hardie – I like dogs, robots, brains, and genomes.
Christopher Morton, Psy.D.