Apple.com XSS attack

As I mentioned on proggit, that URL doesn't actually demonstrate cross-site scripting, but it looks like the page is vulnerable to iframe and scripting insertion too. Example:

   http://www.apple.com/itunes/affiliates/download/?artistName=<iframe+id%3D"frame"+src%3D"http://www.microsoft.com/"+style%3D"width:+600px;+height:+400px;"></iframe>&thumbnailUrl=http://www.straitstimes.com/STI/STIMEDIA/image/20090501/windows7-microsoft.jpg&itmsUrl=http://www.microsoft.com&albumName=Better+Operating+System

NathanKP9• 17 years ago

That is really bad. If you can insert code then you can probably do other even worse things.

axod• 17 years ago

Probably steal session cookies, then hijack sessions and grab any personal data etc :/ Not good.

NathanKP9• 17 years ago

Apple promotes Ubuntu Linux:

http://www.apple.com/itunes/affiliates/download/?artistName=...

adrinavarro2• 17 years ago

It looks like the "XSS" bug is mostly client-side, I think that the GET contents are presented using JS: http://grab.by/exu (that's with the given URL).

It doesn't allows any kind of <script> tag, so yeah, it's fun and a bit insecure (may be used for phishing?? dunno), but it's not the worst at all.

willwagner• 17 years ago

It allows you to put javascript in a click handler:

http://www.apple.com/itunes/affiliates/download/?artistName=...

adrinavarro2• 17 years ago

I was wrong, you're right! Now that's medium-insecure. But still not to panic at this, just XSS and client-side (everything is inserted by JS). Well, there are worst things, right? :)

NathanKP9• 17 years ago

On Safari the click handler works but the image just shows up as an error, not a "Click Me" message.

geuis• 17 years ago

http://www.apple.com/itunes/affiliates/download/?artistName=...

gurraman2• 17 years ago

Looks like they fixed the glitch.

NathanKP9• 17 years ago

No they haven't, not as of yet.

gurraman2• 17 years ago

You are absolutely right. Sorry about the false alarm.

Seems like it doesn't work in latest WebKit?

0wned2• 17 years ago

Complexity kills. Rich Internet Apps will kill all operating systems... except for OpenBSD.

NathanKP9• 17 years ago

Why will OpenBSD be immune?

0wned2• 17 years ago

Because it does not try to keep up with the fast-paced, complex flaws of Rich Internet Apps written by people who have no knowledge of information security and are only interested in getting attention for themselves and their shitty start-up.

johndevor• 17 years ago

I think Apple fixed it?

NathanKP9• 17 years ago

It looks like they just removed the functionality. So it is fixed for now. It was fun while it lasted. ;)

incomethax• 17 years ago

Anyone have a screenshot? I seem to have missed all the fun.

1234• 17 years ago

tiiiu

Apple.com XSS attack

Related Stories