Tumblr worm proliferated due to XSS flaw
Posted on 04 December 2012.
Yesterday's worm rampage that left many a Tumblr site "defaced" with a message by Internet troll group GNAA was the result of improper input sanitation.


"It appears that the worm took advantage of Tumblr's reblogging feature, meaning that anyone who was logged into Tumblr would automatically reblog the infectious post if they visited one of the offending pages," explained Sophos' Graham Cluley.

Those who weren't logged in would be redirected to the standard login page. Once logged in, the offending post would the continued to do its thing and reblog the post on their Tumblr.

"It shouldn't have been possible for someone to post such malicious JavaScript into a Tumblr post - our assumption is that the attackers managed to skirt around Tumblr's defences by disguising their code through Base 64 encoding and embedding it in a data URI," concluded Cluley.

In the meantime, Tumblr has disabled posting for a couple of hours and proceeded to clear the affected accounts. According to a Twitter post by the company, the issue has been resolved.

Security researcher Janne Ahlberg saw the tweet but decided to check for himself whether the root-cause - the XSS vulnerability - was resolved as well, since Tumblr is not exactly famous for fixing issued quickly.

"I created a temporary Tumblr account using different browser, submitted a public post with stored XSS payload and visited the profile from another PC & different account. The vulnerability seems to be valid," he pointed out.





Spotlight

The synergy of hackers and tools at the Black Hat Arsenal

Posted on 27 August 2014.  |  Tucked away from the glamour of the vendor booths and the large presentation rooms filled with rockstar sessions, was the Arsenal - a place where developers were able to present their security tools and grow their community.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Aug 29th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //