Slashdot Mirror

← Back to Stories (view on slashdot.org)

YouTube Hit By HTML Injection Vulnerability

Posted by Soulskill on from the enjoy-the-holiday-google dept.

Virak writes "Several hours ago, someone found an HTML injection vulnerability in YouTube's comment system, and since then sites such as 4chan have had a field day with popular videos. The bug is triggered by placing a <script> tag at the beginning of a post. The tag itself is escaped, but everything following it is cheerfully placed in the page as is. Blacked out pages with giant red text scrolling across them, shock site redirects, and all sorts of other fun things have been spotted. YouTube has currently blocked such comments from being posted and set the comments section to be hidden by default, and appears to be in the process of removing some of these comments, but the underlying bug does not seem to have been fixed yet."

14 of 224 comments (clear)

  1. Series of tubes... by ae1294 · · Score: 5, Funny

    All of your tubes are belonging to US now.

    1. Re:Series of tubes... by KevMar · · Score: 5, Funny

      Somebody set up us the script bomb

      --
      Im a gamer, not a grammer major. This post is full of spelling and grammer mistakes.
    2. Re:Series of tubes... by ae1294 · · Score: 4, Funny

      Really? They're really only removing some of them? When they can just do a simple delete query and wipe everythin with a properly escaped script tag at the top of the comment? Wow. Just wow.

      Shhh.... one word... overtime pay.

    3. Re:Series of tubes... by daremonai · · Score: 5, Funny

      That was actually two words ... Oh no, now we owe you overtime. Sneaky.

  2. I experienced this! by Anonymous Coward · · Score: 5, Funny

    I went to youtube, but all I saw was crap material. Someone had injected a bunch of crap!

  3. Re:Ha ha by bsDaemon · · Score: 5, Funny

    Based on the typical YouTube comment (or video, for that matter), I already hard sort of expected that to be the case.

  4. The very definition of Youtube by Anonymous Coward · · Score: 5, Funny

    Lots of people anonymously "injecting" a bunch of crap into a website for all others to see.

    This exploit is just an alternative to the original "Upload Video" button.

  5. Why natural language needs grouping symbols by Anonymous Coward · · Score: 5, Funny

    a "How to learn PHP in 24 hours!" book

    Does that mean:

    1. It teaches you, over the course of an unspecified period of time, how to learn PHP in 24 hours?
    2. It teaches you, over the course of 24 hours, how to learn PHP? or
    3. After 24 hours have elapsed, it teaches you how to learn PHP?

    Note that it doesn't actually teach you PHP. It just teaches you how to learn it.

    1. Re:Why natural language needs grouping symbols by osu-neko · · Score: 5, Funny

      No, it tells you how you learn the lesser-known language named "PHP in 24 hours" which differs from normal PHP in that the scripts always take 24 hours to run.

      An optimized version, then? ;)

      --
      "Convictions are more dangerous enemies of truth than lies."
    2. Re:Why natural language needs grouping symbols by Kreigaffe · · Score: 4, Funny

      The first time I hear anyone ever fucking utter the word "Kibisecond" I'm just going to shoot them in the face. There's no other choice.

      --
      ... still waiting for this free-as-in-beer free beer I keep hearing about. :|
  6. Massive rickroll? by mwvdlee · · Score: 5, Funny

    If they didn't redirect ALL videos to a Rick Astley video, they have missed the opportunity of a lifetime.

    --
    Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
  7. Re:Ha ha by SpeedyDX · · Score: 4, Funny

    YouTube is supposed to be a kid-friendly place. Parents could do their best to try to responsibly monitor and guide their kids' surfing habits, but still fail because of this exploit. This is not funny, nor awesome. This is not someone finding a potential exploit and graciously letting Google know so they can patch it up. Just a bunch of 4channers screwing around, and to hell with the consequences. And people like you encouraging that type of behaviour.

    Just because this is The Internet(TM), it doesn't mean that common courtesy need not apply.

  8. Re:... if you want to keep it by Rallion · · Score: 4, Funny

    *Reads list of filtering options*

    So does it just hide the whole comment section, or show it as being empty?

  9. Re:Ha ha by Johnno74 · · Score: 4, Funny

    Physical age doesn't necessarily correspond to mental age. Personally, I've been getting more immature as years pass.

    "I have abandoned the quest for eternal youth and instead setttled for lifelong immaturity"