Slashdot Mirror

← Back to Stories (view on slashdot.org)

YouTube Hit By HTML Injection Vulnerability

Posted by Soulskill on from the enjoy-the-holiday-google dept.

Virak writes "Several hours ago, someone found an HTML injection vulnerability in YouTube's comment system, and since then sites such as 4chan have had a field day with popular videos. The bug is triggered by placing a <script> tag at the beginning of a post. The tag itself is escaped, but everything following it is cheerfully placed in the page as is. Blacked out pages with giant red text scrolling across them, shock site redirects, and all sorts of other fun things have been spotted. YouTube has currently blocked such comments from being posted and set the comments section to be hidden by default, and appears to be in the process of removing some of these comments, but the underlying bug does not seem to have been fixed yet."

9 of 224 comments (clear)

  1. Series of tubes... by ae1294 · · Score: 5, Funny

    All of your tubes are belonging to US now.

    1. Re:Series of tubes... by KevMar · · Score: 5, Funny

      Somebody set up us the script bomb

      --
      Im a gamer, not a grammer major. This post is full of spelling and grammer mistakes.
    2. Re:Series of tubes... by daremonai · · Score: 5, Funny

      That was actually two words ... Oh no, now we owe you overtime. Sneaky.

  2. I experienced this! by Anonymous Coward · · Score: 5, Funny

    I went to youtube, but all I saw was crap material. Someone had injected a bunch of crap!

  3. Re:Ha ha by bsDaemon · · Score: 5, Funny

    Based on the typical YouTube comment (or video, for that matter), I already hard sort of expected that to be the case.

  4. The very definition of Youtube by Anonymous Coward · · Score: 5, Funny

    Lots of people anonymously "injecting" a bunch of crap into a website for all others to see.

    This exploit is just an alternative to the original "Upload Video" button.

  5. Why natural language needs grouping symbols by Anonymous Coward · · Score: 5, Funny

    a "How to learn PHP in 24 hours!" book

    Does that mean:

    1. It teaches you, over the course of an unspecified period of time, how to learn PHP in 24 hours?
    2. It teaches you, over the course of 24 hours, how to learn PHP? or
    3. After 24 hours have elapsed, it teaches you how to learn PHP?

    Note that it doesn't actually teach you PHP. It just teaches you how to learn it.

    1. Re:Why natural language needs grouping symbols by osu-neko · · Score: 5, Funny

      No, it tells you how you learn the lesser-known language named "PHP in 24 hours" which differs from normal PHP in that the scripts always take 24 hours to run.

      An optimized version, then? ;)

      --
      "Convictions are more dangerous enemies of truth than lies."
  6. Massive rickroll? by mwvdlee · · Score: 5, Funny

    If they didn't redirect ALL videos to a Rick Astley video, they have missed the opportunity of a lifetime.

    --
    Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?