Skype XSS vulnerability

http://www.noptrix.net/advisories/skype_xss.txt

by sp332 • 15 years ago

54 7 15 years ago

nbpoole• 15 years ago

> skype declares my bug as "minor issue", but skype doesn't handle domain scope properly, hence it is possible to own victim's machine

https://twitter.com/#!/noptrix/status/91910866538217472

And the HN discussions about the previous vulnerability: http://news.ycombinator.com/item?id=2522466 and http://news.ycombinator.com/item?id=2522453

Ragnis• 15 years ago

What did you expect from Microsoft?

spjwebster3• 15 years ago

It's common courtesy to at least give the vendor a chance to fix the bug before you go public.

I don't use Skype, and I'm no fan of Microsoft, but this security advisory is just shameless (and harmful) self promotion.

Sidnicious• 15 years ago

Argh, this is at least the second XSS vulnerability that’s been found in Skype in the last few months.

> skype.com has to validate the input characters and sanitize the output

I don’t like this solution. It mostly works for the phone number field, but not for other fields. (I want my status to be “<script>alert('XSS!')</script>”, damnit!)

The right solution is to make sure that when data gets inserted into code, it’s encoded. If you’re inserting text into an HTML document, run it through an HTML encoder. If you’re inserting text into an SQL statement, run it through an SQL encoder.

Or, use something that distinguishes between code and data, like an HTML templating system or parametrized queries.

spjwebster3• 15 years ago

Also, if you hand-code these encoding routines, you're almost certain to miss something out. Please follow the OWASP reference implementations:

https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_P...

ToastOpt• 15 years ago

I think that's what Sidnic meant by templating -- that you have precisely one well tested encoding step in the system, near the end. This reduces the number of failure modes you need to test for.

In a previous project, we didn't even have an effective means of counting all the potential points of failure; you really don't want that, because it takes a lot of effort to fix.

Skype XSS vulnerability

Related Stories