RSS and Web Feeds a Risk?

A followup whitepaper [PDF] to a recent talk at the blackhat security conference has been released outlining the risks associated with web based feeds such as RSS and Atom. From the article: "Attackers could exploit the problem by setting up a malicious blog and enticing a user to subscribe to the RSS feed. More likely, however, they would add malicious JavaScript to the comments on a trusted blog, Auger said. "A lot of blogs will take user comments and stick them into their own RSS feeds," he said."

Comments

Huh?

[Umbral Blot]

Seems more like a problem with allowing javascript in comments (a really dumb idea) than a problem with RSS.

Re:Huh?

[Anonymous Coward]

Thread over. :)

Re:Huh?

[StormReaver]

"Seems more like a problem with allowing javascript...."

You could have stopped here, and have been even more correct.

Re:Huh?

[Richy_T]

An RSS feed does not include HTML. The issue is therefore that any reader that interprets the feed directly should not process any HTML tags (and hence not interpret Javascript) and any agregator that takes a feed and inserts it into an HTML page should escape all HTML special characters.

That is not to say that the feed can not contain HTML characters, a deiscription "Microsoft says the <a> tag to be depreciated in Vista" is fully valid but should be treated as plain text, *not* html.

Sites which take formatting from their headlines and/or descriptions and include them in the RSS feed *are* broken but the real security bug lies where the text within is not treated as plain text by whatever reads the feed.

Rich

Old technique, new medium

[fosterNutrition]

Not to be the jerk here, but it really shouldn't be that big of a news story that some people discussed the idea that it might not be the best security practice to allow unvalidated user input.

Nobody would think of performing no kind of checking on things submitted into a plain old text box, so why would it be safe just because it's now in the "synergetic web 2.0 blogosphere of community-driven empowerment through technology"

Oh well, still a moderately interesting article...

So..

[Tracer_Bullet82]

If I trust someone and let them have free access to my house, there's a chance one day they'll swipe every thing from it and load into a truck..

just because something is some kind of "new" technology does not mean any different..

use common sense and intelligence.

Re:So..

[Zelbinian]

Someone wiser than I once said "Common sense is not that common."

What sensible feed aggregator allows javascript?

[jZnat]

That's like allowing javascript in HTML email. Any sensible aggregator (and mail cient) disables all javascript by default.

Someone please reassure me that Vista's aggregator does so as well. In fact, can anyone even refer to an aggregator that parses and enables javascript? I can't begin to think of where to find one.

They saw it coming!

[bruno.fatia]

If I can remote execute code, I can remote execute malicious code. Nothing new please move along

Validation is the only problem

[DivineOmega]

The technology behind web feeds such as RSS and Atom (if you can call an XML file a 'technology') is perfectly safe, it is merely the content of the feed itself which can cause problems.

No one can stop a malicious user from setting up their own feed containing dangerous feeds. However, for existing blogs and weblogs, the validation methods to prevent the input of code and script into comment fields has been around and known about for several years.

Re:What sensible feed aggregator allows javascript

[nwbvt]

From the article:

SPI Dynamics examined a number of online and offline applications used to read RSS and Atom feeds. In many cases any JavaScript code delivered on the feed would run on the user's PC, meaning it could be vulnerable to attack, Auger said.

They don't name names, but it does seem like a number of aggregators do support JavaScript. And when the day comes where someone develops a "Web 2.0 AJAX enabled blog", there will be pressure for more and more aggregators to support JavaScript (likely it will be an option that can be disabled, but who is going to do that if it means they cannot access certain features on certain blogs).

This is just one more reason I hate Javascript.

Simple rule for input

[fractalVisionz]

Never let input go unchecked. If you do, you are already screwed.

You're missing the point - it's about the "reader"

[hutchike]

It doesn't matter whether we're looking at published blog entries or comments, anything that is fed via RSS or Atom can move JavaScript (for good or bad) - and what the article makes clear is that the problem lies in the news reader programs themselves. They simply don't apply the same level of security you might expect from Mozilla (Firefox), Safari, Opera, Internet Explorer, etc...

The bottom line here is that RSS/Atom reader programs need to apply similar security checks to those performed by popular secure web browsers.

RTFA ;-)

Oh God

[The MAZZTer]

I can write virii in C++! It's a C++ vulnerability!

Seriously, this is dumb. It is not a problem with RSS/Atom, it is a problem with RSS/Atom viewers that allow JavaScript code to be executed!

Within the context of a web-based viewer this could be a problem, but then again it's no more of a problem than if you go to a questionable site with bad JavaScript. For a browser-based viewer it's simply a matter of the devs remembering to turn off JavaScript support for RSS/Atom feeds.

And in desktop-based viewers... I mean really, who would be stupid enough to even consider implementing JavaScript in one. And if it only does because the programmer took the lazy route and is using a WebControl in the background, well they might want to consider a different method that will actually give them some measure of CONTROL.

Speaking of poorly coded, I wonder if we'll see IE exploits arising from embedded ActiveX controls in RSS feeds, those would cause far more damage than while (1) { window.print(); window.alert("LOL INTERNET"); }.

Re:Except that it CAN be virii

[xenoandroid]

"No reputable printed dictionary includes them as correct forms. "

VIRII is NOT a word.

Re:Except that it CAN be virii

[Anonymous Coward]

You do realise that Wikipedia isn't an authorative source, don't you? And even if you trust Wikipedia as a source, if you read further:

In the English language, the standard plural of virus is viruses. This is the most frequently occurring form of the plural, and refers to both a biological virus and a computer virus.

The less frequent variations viri and virii are virtually unknown in edited prose, and no major dictionary recognizes them as alternative forms.

Just encode it, that's what I do

[chudik]

This is the case where I subscribe to the school of thought that the RSS description element should have no markup. The original purpose of RSS was not to distribute whole articles but only describe them and provide a link.