Recently Tumblr was hit by a fast-spreading worm.

How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability in Tumblr? Something else?

Partial information: Sophos has a blog post on the worm. However, it is oddly silent on the exact details of the vulnerability that the worm exploited. Apparently, if you visited a Tumblr page that had been infected (with malicious content), then malicious Javascript on the page would cause your browser to send a request to Tumblr to reblog the infected post on your own Tumblr page... thus propagating the worm further. I still have to wonder, though: how was this possible, without user involvement? Did Tumblr forget to include any CSRF protection in their reblogging feature? And, don't they do any filtering on the content you post to your Tumblr page, to remove Javascript before posting? I saw some speculation that the use of a data:// URL might have bypassed Tumblr's defenses somehow; did they have a HTML filter that tries to remove all Javascript, but inadvertently allowed Javascript if it appeared in a data:// URL, or something? It sounds like it might be a combination of a CSRF vulnerability plus a XSS vulnerability, but I can't find any detailed technical explanation of exactly what's going on. How did this thing work?

  • Yup, sounds like XSS. At that point you don't even need the CSRF, because in-page tokens can be stolen by the injected script. – Polynomial Dec 7 '12 at 9:28
  • @Polynomial, good point! On the other hand, if you look at the de-obfuscated Javascript from the Sophos blog post, it doesn't seem to be doing that: it's just loading an external URL (which won't have the ability to steal in-page tokens any longer, since it's from a different origin) into an iframe. So I still find it puzzling exactly how this worked. – D.W. Dec 7 '12 at 18:52

This story on ehackingnews says it was a result of stored XSS. http://www.ehackingnews.com/2012/12/tumblr-worm-due-to-stored-xss.html?utm_source=dlvr.it&utm_medium=twitter

  • I read those articles but didn't see any technical details. I'm still mystified about exactly how this worked. – D.W. Dec 9 '12 at 7:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.