*Feed2JS v1.7 XSS (Cross-site Scripting) Web Security Vulnerabilities* Exploit Title: Feed2JS v1.7 magpie_debug.php? &url parameter XSS Security Vulnerabilities Product: Feed2JS Vendor: feed2js.org Vulnerable Versions: v1.7 Tested Version: v1.7 Advisory Publication: May 09, 2015 Latest Update: May 09, 2015 Vulnerability Type: Cross-Site Scripting [CWE-79] CVE Reference: * Impact CVSS Severity (version 2.0): CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend) Impact Subscore: 2.9 Exploitability Subscore: 8.6 Writer and Reporter: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing) *Proposition Details:* *(1) Vendor & Product Description:* *Vendor:* feed2js.org *Product & Vulnerable Versions:* Feed2JS v1.7 *Vendor URL & Download:* Feed2JS can be downloaded from here, https://feed2js.org/index.php?s=download *Source code:* http://www.gnu.org/licenses/gpl.html *Product Introduction Overview:* "What is "Feed to JavaScript? An RSS Feed is a dynamically generated summary (in XML format) of information or news published on other web sites- so when the published RSS changes, your web site will be automatically changed too. It is a rather simple technology that allows you, the humble web page designer, to have this content displayed in your own web page, without having to know a lick about XML! Think of it as a box you define on your web page that is able to update itself, whenever the source of the information changes, your web page does too, without you having to do a single thing to it. This Feed2JS web site (new and improved!) provides you a free service that can do all the hard work for you-- in 3 easy steps: Find the RSS source, the web address for the feed. Use our simple tool to build the JavaScript command that will display it Optionally style it up to look pretty. Please keep in mind that feeds are cached on our site for 60 minutes, so if you add content to your RSS feed, the updates will take at least an hour to appear in any other web site using Feed2JS to display that feed. To run these scripts, you need a web server capable of running PHP which is rather widely available (and free). You will need to FTP files to your server, perhaps change permissions, and make some basic edits to configure it for your system. I give you the code, getting it to work is on your shoulders. I will try to help, but cannot always promise answers." *(2) Vulnerability Details:* Feed2JS web application has a computer security bug problem. It can be exploited by stored XSS attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. Several other Feed2JS products 0-day vulnerabilities have been found by some other bug hunter researchers before. Feed2JS has patched some of them. "Openwall software releases and other related files are also available from the Openwall file archive and its mirrors. You are encouraged to use the mirrors, but be sure to verify the signatures on software you download. The more experienced users and software developers may use our CVSweb server to browse through the source code for most pieces of Openwall software along with revision history information for each source file. We publish articles, make presentations, and offer professional services." Openwall has published suggestions, advisories, solutions details related to XSS vulnerabilities. *(2.1)* The first programming code flaw occurs at "&url" parameter in "magpie_debug.php?" page. *References:* http://www.tetraph.com/security/xss-vulnerability/feed2js-v1-7-xss/ http://securityrelated.blogspot.com/2015/05/feed2js-v17-xss-cross-site-scripting.html http://www.inzeed.com/kaleidoscope/computer-web-security/feed2js-v1-7-xss/ https://vulnerabilitypost.wordpress.com/2015/05/08/feed2js-v1-7-xss/ http://whitehatpost.blog.163.com/blog/static/24223205420154810359682/ https://progressive-comp.com/?l=full-disclosure&m=142907534026807&w=2 https://www.bugscan.net/#!/x/21291 http://bluereader.org/article/27452996 http://lists.openwall.net/full-disclosure/2015/04/15/4 -- Jing Wang, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. http://www.tetraph.com/wangjing/ https://twitter.com/justqdjing