MagpieRSS XSS 0day

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052314 漏洞类型
发布时间 2008-12-31 更新时间 2008-12-31
漏洞平台 N/A CVSS评分 N/A

I have found a Cross Site Scripting vulnerability in MagpieRSS, an RSS parser written in PHP, basically, this piece of software enables users to add their own RSS feeds to be parsed, so they can keep up to date with their favourite feeds, as well as the pre-defined ones.

I crafted my own RSS feed, which contains XSS inside the CDATA.

Here is the XML file I used:

If for example, I ask a user to subscribe to my feed, after disguising it as a real feed, I then go and update it with malicious content, the RSS parser will then parse the updated content and the user will end up loading an Iframe with a cookie stealer inside.

The reason this happens is because the CDATA is not getting escaped, it is a simple fix: htmlentities() around the parsed CDATA.

This is a potentially harmful exploit if you can convince users to add your feed.

Thanks for reading,