Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
The makers of an open-source web application framework, on which popular programs such as Twitter are constructed, has issued a patch for a major cross-site scripting vulnerability.Ruby on Rails last week issued an advisory that said the flaw lies "in the escaping code for the [framework's] 'form helpers'...Attackers who can inject deliberately malformed Unicode strings into the form helpers can defeat the escaping checks and inject arbitrary HTML." Versions 2.0 and later are impacted.Researcher Brian Mastenbrook, who discovered the bug, said in a blog post that the issue affects at least Twitter and business web applications produced by 37signals, which include Basecamp, Highrise, Backpack and Campfire. He decided to conduct tests on those applications after noticing a vulnerability in the Unicode character encoding standard a few weeks ago."I suddenly had an idea: 'I wonder if there are any web applications which have Unicode handling problems that might be security issues?'" he wrote. "A few minutes later, I had JavaScript from a URL query parameter falling through the escaping routines and running in the main body of Twitter.com. Bingo! Cross-site scripting, the stuff that Twitter worms are made of."Mastenbrook said Twitter fixed the problem itself, but 37signals referred him, after repeated requests, to Ruby on Rails to solve the issue."Web application security is still an immature field, and many of the layers are sufficiently poorly designed that issues like this will pop up for a good long while," Mastenbrook wrote. "Just like buffer overflows have been a weak spot for C [code] security long as the internet has been around, escaping issues will continue to be a weak spot for web security for as long as we're afflicted with this particular architecture."Mastenbrook suggested all browsers should contain cross-site scripting filtering functionality, as is present, at least in a limited form, in Internet Explorer 8.See original article on scmagazineus.com
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.