1

I found this - can anyone provide me examples of how these issues are exploited?

2

Flash is jailed by the some-origin policy and can only act upon a site that loads the flash applet with scripting access enabled.

However, flash can become a vector for XSS. The demo above lists various XSS vectors. So for example in the extremely unlikely condition where you are loading a flash applet where the attacker can control the loadMovieNumVar variable then an attacker could execute JavaScript in the context of the site by setting this variable to javascript:alert('gotcha!').

XSS is extremely common and there are many ways that this attack can manifest. Flash based XSS is one way, and its also extremely uncommon.

  • So if attacker finds url like this : demo.testfire.net/vulnerable.swf?loadMovieNumVar=XSS he can try to exploit xss issue? – Daniel Dec 6 '12 at 18:43
  • @user1203028 No... flash doesn't usually accept GET parameters like that, that is usually used by server-side code. Flash accepts these parameters defined in the <object> tag. – rook Dec 6 '12 at 18:45
  • So if user input is reflected anywhere inside these dangerous parameters , than XSS can be exploited.Since GET is not an option. – Daniel Dec 6 '12 at 19:07
  • @user1203028 yep – rook Dec 6 '12 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.