'age' exploit

Azz · 05-11-2011, 08:49 AM

Hey,

I found something that might be a XSS exploit (didn't try it) but worth reporting. When creating a new thread in the Slave/Master Area there is an "age" input. This has the readonly attribute so you cannot edit it. But when removing this readonly attribute or directly changing the value of the input client sided it will post that value to the server without validating it.

This means people are able to change their age to whatever they like and maybe even to strings instead of an integer.

Greetings,
Azz

Stardares · 05-11-2011, 09:12 AM

I'd suggest emailing this directly to depp.

Star Shadows · 05-11-2011, 09:33 AM

Quote:

Originally Posted by Stardares

I'd suggest emailing this directly to depp.

Yea I'd suggest emailing depp to see if he can fix it

Azz · 05-11-2011, 11:02 AM

Maybe one of you can point Depp to this thread? I've been member for a long time but never really been active so he'll probably ignore my private message.

Star Shadows · 05-11-2011, 12:38 PM

Quote:

Originally Posted by Azz

Maybe one of you can point Depp to this thread? I've been member for a long time but never really been active so he'll probably ignore my private message.

I am sure he wouldn't he takes matters like this seriously however I will pass this message along for you

Azz · 05-11-2011, 01:37 PM

Thanks, Star Shadows

chubbsman7 · 05-11-2011, 01:59 PM

@Azz, false about Depp.

I reported the inappropriate adds that were on the site. (the ones that were showing full body coverage, no hiding anything)

He cares about this site, and the last thing he wants is for it to be exploited and taken down by the Government for providing pornography for minors and allowing them access to explicit adult content.

depp · 05-11-2011, 08:35 PM

I'm investigating this issue now. I'll have it solved tonight. I need to sober up a bit first though

depp · 05-11-2011, 09:46 PM

Before I respond to this issue let me say that the the Slave/Master posting form is not meant to be bullet proof. It's there to avoid 90% of the problems we had to deal with on a regular basis in the past.

I've investigated the problem and XSS is not possible in this instance. A knowledgeable user could game their age or change it to text but they would have to first be within the age range we allow (the form won't load if you are under 18) and their text would be properly escaped anyways (I verified this). It's also very likely someone would report them too.

I'll investigate a hook location for doing one last validation pass but am not super concerned about people over 18 faking their age. I originally was going to let people edit it anyways.

Also, please report vulnerabilities via PM. Posting issues that could have security ramifications here in the open forums is not cool. I know I'm not always super quick to respond but I do check my private messages for important communications.

05-11-2011, 08:49 AM	#1
Azz Junior Member Join Date: Oct 2008 Posts: 7	'age' exploit Hey, I found something that might be a XSS exploit (didn't try it) but worth reporting. When creating a new thread in the Slave/Master Area there is an "age" input. This has the readonly attribute so you cannot edit it. But when removing this readonly attribute or directly changing the value of the input client sided it will post that value to the server without validating it. This means people are able to change their age to whatever they like and maybe even to strings instead of an integer. Greetings, Azz Last edited by Azz; 05-11-2011 at 11:09 AM. Reason: typo

05-11-2011, 09:12 AM	#2
Stardares Senior Member Join Date: Oct 2009 Location: UK. Posts: 193	I'd suggest emailing this directly to depp. __________________ The above message does not necessarily represent the views of Stardares or any of his associates in any way. Likes: Dominating, feet, pleasure. Dislikes: Walnut cake, time wasters. I'm currently looking for a submissive or a slave, I'm sure I have an advert somewhere.

05-11-2011, 01:59 PM	#7
chubbsman7 Senior Member Join Date: Jun 2009 Location: Kingdom of Talossa Territory, Antarctica. Posts: 231	@Azz, false about Depp. I reported the inappropriate adds that were on the site. (the ones that were showing full body coverage, no hiding anything) He cares about this site, and the last thing he wants is for it to be exploited and taken down by the Government for providing pornography for minors and allowing them access to explicit adult content. __________________ ...And So Summer Starts (Sean's View) ...And So Summer Starts (Lauren's View) With these stories, I'll try to update every Monday or so. It depends on my work schedule, really. But I'll post as often (as appropriate, definitely not everyday!) as I can! Also: A side project of mine: The In The Black Fedora

05-11-2011, 08:35 PM	#8
depp SysOp Join Date: Feb 2005 Location: Here, now Posts: 3,532 Blog Entries: 51	I'm investigating this issue now. I'll have it solved tonight. I need to sober up a bit first though __________________ The border between the two isn't all that clear. I'll be able to enter it soon. In full range. Full motion. I'll translate myself into it.

05-11-2011, 09:46 PM	#9
depp SysOp Join Date: Feb 2005 Location: Here, now Posts: 3,532 Blog Entries: 51	Before I respond to this issue let me say that the the Slave/Master posting form is not meant to be bullet proof. It's there to avoid 90% of the problems we had to deal with on a regular basis in the past. I've investigated the problem and XSS is not possible in this instance. A knowledgeable user could game their age or change it to text but they would have to first be within the age range we allow (the form won't load if you are under 18) and their text would be properly escaped anyways (I verified this). It's also very likely someone would report them too. I'll investigate a hook location for doing one last validation pass but am not super concerned about people over 18 faking their age. I originally was going to let people edit it anyways. Also, please report vulnerabilities via PM. Posting issues that could have security ramifications here in the open forums is not cool. I know I'm not always super quick to respond but I do check my private messages for important communications. __________________ The border between the two isn't all that clear. I'll be able to enter it soon. In full range. Full motion. I'll translate myself into it.

05-11-2011, 11:02 AM	#4
Azz Junior Member Join Date: Oct 2008 Posts: 7	Maybe one of you can point Depp to this thread? I've been member for a long time but never really been active so he'll probably ignore my private message.

05-11-2011, 01:37 PM	#6
Azz Junior Member Join Date: Oct 2008 Posts: 7	Thanks, Star Shadows