Hotbot XSS Vulnerability
When I’m bored I watch my logs (you’d be amazed how many hack attempts I get a day - or maybe you wouldn’t given the domain name). I also get a lot of hits to my XSS Cheat sheet with people doing vulnerability assessments. Generally I ignore these types of hits because that’s what the page is built for, but this single log entry caught my eye because it was obvious someone had inadvertanly hit my page, rather than intentional auditing techniques. I saw this page:
So after laughing for about ten minutes I did some research and it turns out that here is what is happening. Using the MSN search someone happend to find a page that was referencing a double-open angle bracket vector. Hotbot didn’t sanitize the HTML because it was incomplete (most likely) and instead rendered it. Because it was linking to a page that didn’t exist “scriptlet.html<BR>” it was redirecting back to my homepage as a 404. Obviously it would be extremely easy to fashion this into a real XSS exploit, but I think this proves the point. If you want to see for yourself follow this link.
June 30th, 2006 at 4:25 pm
[…] Like the Hotbot vuln Rsnake posted about a few weeks ago, this script also seems to suffer from the same thing. […]
July 8th, 2006 at 8:32 pm
Looks like this is now closed. I didn’t hear anything from anyone on when it was closed but as of 7/8/2006 this is now fixed.