W3C home > Mailing lists > Public > public-appformats@w3.org > December 2007

[fwd] [MacOS X] Insecure eval() in Twitgit and Twitterlex dashboard widgets (from: tlr@w3.org)

From: Thomas Roessler <tlr@w3.org>
Date: Tue, 4 Dec 2007 00:07:32 +0100
To: public-appformats@w3.org
Message-ID: <20071203230732.GM12626@iCoaster.does-not-exist.org>

FYI, an incidental observation of security holes introduced by some
real-life widgets.  I was particularly amazed to see that the two
available free widgets for that particular functionality were making
the same (rather severe) mistake.

Regards,
-- 
Thomas Roessler, W3C  <tlr@w3.org>





----- Forwarded message from Thomas Roessler <tlr@w3.org> -----

From: Thomas Roessler <tlr@w3.org>
To: bugtraq@securityfocus.com
Cc: brett@webfroot.co.nz, mail@ben-ward.co.uk
Date: Tue, 4 Dec 2007 00:04:57 +0100
Subject: [MacOS X] Insecure eval() in Twitgit and Twitterlex dashboard
	widgets

Twitgit [1] and Twitterlex [2] are two MacOS X Dashboard widgets
(developed in JavaScript) that can be used to display twitter.com
updates.

Both regularly retrieve data using the Twitter JSON API and parse
whatever is returned with eval().  Both relax the dashboard's
JavaScript sandbox to enable the widget.system() call, which indeed
amounts to the equivalent of system(3); i.e., if an attacker can
take over the widget, the attacker can take over the user's account
(and, quite often, the system).

The data are retrieved through plain HTTP. Therefore, these widgets
are vulnerable to at least:

- cross-site-scripting attacks through Twitter
- subversion of Twitter and, in the case of Twitterlex, also
  subversion of a server used for update notifications
- man-in-the-middle attacks against local networks

(Also, deliberately malicious behavior by either Twitter or the
author of at least Twitterlex is a risk from a security perspective;
if one was to assume malice, then Twitterlex could be classified as
a nifty backdoor.)

What makes this case particularly interesting is that this is a case
in which -- along with the development platform, JavaScrit -- the
borders between Web and local vulnerabilities get increasingly blurry.

It would probably be an interesting exercise to go through some more
dashboard widgets and grep for eval. I'd bet quite a bit that
there's much more out there.

1. http://inner.geek.nz/projects/twitterlex/
2. http://ben-ward.co.uk/widgets/twitgit/

Regards,
-- 
Thomas Roessler, W3C  <tlr@w3.org>



----- End forwarded message -----
Received on Monday, 3 December 2007 23:07:44 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 8 January 2008 14:10:24 GMT