AOH :: HP Unsorted A :: TB10123.HTM

Another XSS vulnerability in italian

Another XSS vulnerability in italian
Another XSS vulnerability in italian

Permanent Url:  

After the report of Rosario Valotta on this ML, another XSS vulnerability
has been found on, one of the most important italian ISP

Nothing more than a trivial error but, since staff used the
printed media to inform that Rosario's find was just a "spot" issue, it is
important to demonstrate that this kind of errors are quite more
widespread and to let the Libero staff and management realize that a
potential attack must be avoid by a deep check of the portal.

The vulnerability once again can be found in the "Community" section
of Libero portal, and the affected functionality is the profile
creation and retrieval


The implementation of this functionality allows the injection of
malicious code in the profile, so that an attacker by visiting his/her
profile can:

1) steal username (in cookie)
2) steal cookies
3) arbitrary redirection for Phishing purpose

The normal URL would be something linked like this: 

where "Nick" is the name of the nick whose profile has been
manipulated or crafted to add arbitrary code.

This vulnerability closely resemble to those in MySpace and other
So it's nothing really complicated and you can skip on from here on ;)

In admin pages (need to be logged by creating a fake account) on page 

there are two different fields named "I miei difetti:" (my defects)
and "i miei pregi:" (my strong points) that accept arbitrary content.

As stated by Rosario, the web application performs a simple
parsing of the posted content, so that quote and double-quote (' and ")
chars are escaped by putting a \ before of them (both using ASCII and URL

While I already had the Rosario's beautiful implementation of a simple
evasion technique I preferred to encode the single char in an old
snippet of mine.
The aim of the snippet (I don't remember if I made it, stole it, stole
only the main idea or where, sorry)  is to transform a string into a
series of char numbers to be used with a String.fromCharCode command.
Due to the limitation in size, the function which create the
String.fromCharCode sequence is a detached and ascii value is
decreased of 100 to limit the number of digits.
This is the creation snippet:


So URL "" is rendered as: 


Using the tho box we can use the following code for a POC:

 [BOX 1]

 [BOX 2]

The posting url can be easily modified to an http grabber such as:


Just my 2 cents and thanks to:

 for the first report, upon which this is based
 for help in JS ;)
 for consultancy and typo-killing ;)



Permanent Url:  

Matteo G.P. Flora | | 
pgp F3B6BC10 | blog | M1S3c | OPSI 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to