Minify And Related Plugins DOM-Based XSS Vulnerability
26 Mar. 2012
Summary
DOM Based XSS (or as it is called in some texts, type-0 XSS ) is an XSS attack wherein the attack
payload is executed as a result of modifying the DOM environment in the victim s browser used
by the original client side script, so that the client side code runs in an unexpected manner.
Credit:
The information has been provided by Ayoub Aboukir, Independent Security Researcher.
A specially formed URL could cause a user's web browser to run arbitrary Javascript on a
domain where the Minify Builder application is accessible. If a host serves the "Minify
URI Builder" application at http://example.org/min/builder/, the host is vulnerable
By adding "#g=<script>alert("XSSed ");</script>" after /min/builder/ the attacker can
execute an arbitrary code, in this case it's the classical alert box.
Example: http://localhost/min/builder/#g=<script>alert(document.cookie)</script>
This shows the current sessions cookies which might be sent to third parties' attacker pages.
Vendor Status:
Minify had issued an update for this Vulnerability
Disclosure Timeline:
Date of found : 03/01/2012
Date of report : 03/03/2012
Developer response : 03/03/2012
Upgrade release : 03/10/2012
Disclosure date : 03/21/2012
