Reply to thread

Message

<blockquote data-quote="BIOS" data-source="post: 453510" data-attributes="member: 15674">The majority of Habbo retros I've looked at are vulnerable to a simple cross domain hijacking vulnerability due to Flash cross domain policy misconfigurations.What does that mean?Essentially if your users play multiple hotels, the other hotel can hijack their SSO token from your hotel, view or submit forms on any of your pages (i.e. housekeeping / account settings) authenticated as them in the background by simply visiting their site.[ATTACH=full]9610[/ATTACH]How do you know if you're vulnerable?If your crossdomain.xml file looks like the following:[CODE=xml]&lt;cross-domain-policy&gt;&lt;allow-access-from domain=&quot;*&quot; /&gt;&lt;/cross-domain-policy&gt;[/CODE]The fix?At the very least, you should remove &lt;allow-access-from domain=&quot;*&quot; /&gt; from your crossdomain.xml and replace it with config specific to your domain.For example:Lax but generally safe: &lt;allow-access-from domain=&quot;*.habboon.pw&quot; /&gt;Strict: you can restrict it to a specific sub-domain, i.e. &lt;allow-access-from domain=&quot;<a href="http://www.habboon.pw" target="_blank">www.habboon.pw</a>&quot; /&gt;This prevents other domains from reading your site via flash.I won't be sharing the POC, don't ask.More details on the topic can be found <a href="https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/xdomain.html" target="_blank">here</a>.</blockquote>

[QUOTE="BIOS, post: 453510, member: 15674"] The majority of Habbo retros I've looked at are vulnerable to a simple cross domain hijacking vulnerability due to Flash cross domain policy misconfigurations. [B]What does that mean?[/B] Essentially if your users play multiple hotels, the other hotel can hijack their SSO token from your hotel, view or submit forms on any of your pages (i.e. housekeeping / account settings) authenticated as them in the background by simply visiting their site. [ATTACH=full]9610[/ATTACH] [B]How do you know if you're vulnerable?[/B] If your crossdomain.xml file looks like the following: [CODE=xml]<cross-domain-policy> <allow-access-from domain="*" /> </cross-domain-policy>[/CODE] [B]The fix?[/B] At the very least, you should remove <allow-access-from domain="[B]*[/B]" /> from your crossdomain.xml and replace it with config [U]specific to your domain[/U]. For example: Lax but generally safe: <allow-access-from domain="*[B].habboon.pw[/B]" /> Strict: you can restrict it to a specific sub-domain, i.e. <allow-access-from domain="[B][URL='http://www.habboon.pw']www.habboon.pw[/URL][/B]" /> This prevents other domains from reading your site via flash. I won't be sharing the POC, don't ask. More details on the topic can be found [URL='https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/xdomain.html']here[/URL]. [/QUOTE]

Verification

Reply to thread

Connect with us

Newest members