socialmedian: Facebook, MySpace, and crossdomain.xml

User-submitted headlines for this story

Clips

Source: Moderated AppSec Feed - OWASP Foundation's shared items in Google Reader

Nov 06, 2009

Summary

Thanks to the recent recurrence of a vulnerability I wrote about a few years ago and a gentle prod from Simon, I decided it would be good to write about the dangers of cross-domain Ajax with Flash again.

If you read about this story on TechCrunch, note that the "write up explaining all the details" is about an unrelated vulnerability.

I'll try to briefly explain the problem and then show how it relates to Facebook and MySpace. For more background information, please refer to these prior posts:

Cross-Domain Ajax Insecurity, which discusses why true cross-domain Ajax is a bad idea, despite many misinformed Ajax developers claiming it's safe.

Cross-Domain Ajax with Flash, the post that discloses the vulnerability.

The crossdomain.xml Witch Hunt, which mentions other big sites, such as YouTube and Adobe, that suffer from the same vulnerability.

Web technologies that abide by the same-origin policy cannot reside on one site and interact with another. To be a little more specific, if you visit my site, I can't make you update your status on Twitter . If I

...Read the full article

Comments (1)