Aerosol Posted March 26, 2015 Report Share Posted March 26, 2015 Amazon has patched dangerous cross-site scripting (XSS) vulnerability in its website that exposed accounts to hijacking.A Brazilian hacker using the handle @bruteLogic published the then-zero-day flaw to XSSposed.org Saturday without tipping off the book giant.Amazon swatted the flaws two days later. The time between disclosure and patch opened what the hacker told Beta News was a chance for Amazon accounts to be compromised and web browsers exploited.His reasoning for full disclosure was that Amazon did not pay cash for bug bounty reports.He says the vulnerability allowed attacks to view Amazon user credit cards and to purchase items in their name, provided a victim clicked on a crafted malicious link.Amazon has been contacted for comment.Cross-site scripting vulnerabilities are a persistent scourge on internet assets. It allows attackers to quietly target victims using vulnerable web applications that do not properly check input.The Open Web Application Security Project puts XSS as the third worst application security blunder behind broken authentication and injection."An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page."The web hole follows Amazon's September kerfuffle after it reintroduced a flaw in its Kindle management page that could have allowed attackers to inject malcode into a book's title which could have commandeered accounts.Source Quote Link to comment Share on other sites More sharing options...
Die1 Posted March 27, 2015 Report Share Posted March 27, 2015 Ma bucur pentru el, il cunosc personal si e un nenorocit plin de fite de hacker muie lui. Quote Link to comment Share on other sites More sharing options...
1337 Posted March 27, 2015 Report Share Posted March 27, 2015 Bine ca a facut disclosure, sunt niste mari cacati, ca si aia de la Yahoo (care dadeau tricouri pana acu' ceva timp). Quote Link to comment Share on other sites More sharing options...
