A second-order of XSS
Several people have approached me for more information about the spate of search engine iFrame injection attacks that have been occurring for the last few weeks. Dancho Danchev’s blog entry provides a good primer of the threat observed thus far, and lists some of the popular news sites that have been hit with the attack thus far.
While there has been a lot of attention upon the fact that the Google search engine is acting as the conduit for the attack, let’s be clear, the vulnerability itself doesn’t lie within Google (or any of the major search engines). At its heart, this is the widespread exploitation of simple cross-site scripting vulnerabilities situated within the Web sites application parsing of "searched-for" content.
At the Frequency X blog.
[ Read more ]
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.