Did you know that tagcloud.swf allows CrossSite Scripting?

I would like to warn you about security vulnerabilities in plugin WP-Cumulus for WordPress. These are Full path disclosure and Cross-Site Scripting vulnerabilities. Which is a web-application vulnerabilities which allow attackers to bypass client-side security mechanisms normally imposed on web content by modern web browsers. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user.

Full path disclosure:

http://site/wp-content/plugins/wp-cumulus/wp-cumulus.php

XSS:

http://site/wp-content/plugins/wp-cumulus/tagcloud.
swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:
alert(document.cookie)'+style='font-size:
+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E

Code will execute after click. It's strictly social XSS. There are a lot of vulnerable tagcloud.swf file in Internet (according to Google): 

http://www.google.com.au/search?q=filetype:swf+inurl:tagcloud.swf

So to all flash developers, I recommend you to attend to security of their flash files. And for the owners of sites, with vulnerables flashes like tagcloud.swf, fix them  or turn over to your development team  to fix it. 

 

Kind Regards,

 

Alfredo Cedeno

IT Security Analyst & Advisor
http://ajcborges.blogspot.com 

Microsoft warns of major Patch Tuesday update

Covers 25 flaws, five rated 'critical'.

Microsoft has released its advanced notification for April's Patch Tuesday update, which will address 25 problems in 11 security bulletins. Five of the vulnerabilities are rated 'critical', and apply to enterprise applications including Microsoft Office and Exchange. Affected operating systems include Windows 2000, XP, Vista, 2003, 2008 and Windows 7.  You can read more about it at: http://www.itnews.com.au/News/171753,microsoft-warns-of-major-patch-tuesday-update.aspx

Facebook Platform Vulnerability Enabled

"The technique allowed one to create a seemingly innocent web page that would invisibly and silently steal a visitor’s private Facebook content. Facebook has now disabled the attack by modifying one of the exploited behaviors." If you would like to read more about this, visit the follow URL: http://theharmonyguy.com/2010/04/10/facebook-platform-vulnerability-enabled-silent-data-harvesting/   Remember that there is no such thing as 100% security.