From full-disclosure Fri Oct 30 14:48:11 2015 From: Jing Wang Date: Fri, 30 Oct 2015 14:48:11 +0000 To: full-disclosure Subject: [FD] Daily Mail Registration Page Unvalidated Redirects and Forwards & XSS Web Security Problem Message-Id: X-MARC-Message: https://marc.info/?l=full-disclosure&m=144651836427184 KkRhaWx5IE1haWwgUmVnaXN0cmF0aW9uIFBhZ2UgVW52YWxpZGF0ZWQgUmVkaXJlY3RzIGFuZCBG b3J3YXJkcyAmIFhTUyBXZWIKU2VjdXJpdHkgUHJvYmxlbSoKCgoqV2Vic2l0ZSBEZXNjcmlwdGlv bjoqCiJUaGUgRGFpbHkgTWFpbCBpcyBhIEJyaXRpc2ggZGFpbHkgbWlkZGxlLW1hcmtldCB0YWJs b2lkIG5ld3NwYXBlciBvd25lZCBieQp0aGUgRGFpbHkgTWFpbCBhbmQgR2VuZXJhbCBUcnVzdC4g Rmlyc3QgcHVibGlzaGVkIGluIDE4OTYgYnkgTG9yZApOb3J0aGNsaWZmZSwgaXQgaXMgdGhlIFVu aXRlZCBLaW5nZG9tJ3Mgc2Vjb25kIGJpZ2dlc3Qtc2VsbGluZyBkYWlseQpuZXdzcGFwZXIgYWZ0 ZXIgVGhlIFN1bi4gSXRzIHNpc3RlciBwYXBlciBUaGUgTWFpbCBvbiBTdW5kYXkgd2FzIGxhdW5j aGVkCmluIDE5ODIuIFNjb3R0aXNoIGFuZCBJcmlzaCBlZGl0aW9ucyBvZiB0aGUgZGFpbHkgcGFw ZXIgd2VyZSBsYXVuY2hlZCBpbgoxOTQ3IGFuZCAyMDA2IHJlc3BlY3RpdmVseS4gVGhlIERhaWx5 IE1haWwgd2FzIEJyaXRhaW4ncyBmaXJzdCBkYWlseQpuZXdzcGFwZXIgYWltZWQgYXQgdGhlIG5l d2x5LWxpdGVyYXRlICJsb3dlci1taWRkbGUgY2xhc3MgbWFya2V0IHJlc3VsdGluZwpmcm9tIG1h c3MgZWR1Y2F0aW9uLCBjb21iaW5pbmcgYSBsb3cgcmV0YWlsIHByaWNlIHdpdGggcGxlbnR5IG9m CmNvbXBldGl0aW9ucywgcHJpemVzIGFuZCBwcm9tb3Rpb25hbCBnaW1taWNrcyIsIGFuZCB3YXMg dGhlIGZpcnN0IEJyaXRpc2gKcGFwZXIgdG8gc2VsbCBhIG1pbGxpb24gY29waWVzIGEgZGF5LiBJ dCB3YXMgYXQgdGhlIG91dHNldCBhIG5ld3NwYXBlciBmb3IKd29tZW4sIHRoZSBmaXJzdCB0byBw cm92aWRlIGZlYXR1cmVzIGVzcGVjaWFsbHkgZm9yIHRoZW0sIGFuZCBhcyBvZiB0aGUKc2Vjb25k LWhhbGYgb2YgMjAxMyBoYWQgYSA1NC43NyUgZmVtYWxlIHJlYWRlcnNoaXAsIHRoZSBvbmx5IEJy aXRpc2gKbmV3c3BhcGVyIHdob3NlIGZlbWFsZSByZWFkZXJzIGNvbnN0aXR1dGUgbW9yZSB0aGFu IDUwJSBvZiBpdHMgZGVtb2dyYXBoaWMuCkl0IGhhZCBhbiBhdmVyYWdlIGRhaWx5IGNpcmN1bGF0 aW9uIG9mIDEsNzA4LDAwNiBjb3BpZXMgaW4gTWFyY2ggMjAxNC4KQmV0d2VlbiBKdWx5IGFuZCBE ZWNlbWJlciAyMDEzIGl0IGhhZCBhbiBhdmVyYWdlIGRhaWx5IHJlYWRlcnNoaXAgb2YKYXBwcm94 aW1hdGVseSAzLjk1MSBtaWxsaW9uLCBvZiB3aG9tIGFwcHJveGltYXRlbHkgMi41MDMgbWlsbGlv biB3ZXJlIGluCnRoZSBBQkMxIGRlbW9ncmFwaGljIGFuZCAxLjQ0OCBtaWxsaW9uIGluIHRoZSBD MkRFIGRlbW9ncmFwaGljLiBJdHMgd2Vic2l0ZQpoYXMgbW9yZSB0aGFuIDEwMCBtaWxsaW9uIHVu aXF1ZSB2aXNpdG9ycyBwZXIgbW9udGguIiAoV2lraXBlZGlhKQoKCk9uZSBvZiBpdHMgd2Vic2l0 ZSdzIEFsZXhhIHJhbmsgaXMgOTMgb24gSmFudWFyeSAwMSAyMDE1LiBUaGUgd2Vic2l0ZSBpcwpv bmUgb2YgdGhlIG1vc3QgcG9wdWxhciB3ZWJzaXRlcyBpbiB0aGUgVW5pdGVkIEtpbmdkb20uCgoK VGhlIFVudmFsaWRhdGVkIFJlZGlyZWN0cyBhbmQgRm9yd2FyZHMgcHJvYmxlbSBoYXMgbm90IGJl ZW4gcGF0Y2hlZCwgd2hpbGUKdGhlIFhTUyBwcm9ibGVtIGhhcyBiZWVuIHBhdGNoZWQuCgoKCkRp c2NvdmVyIGFuZCBSZXBvcnRlcjoKV2FuZyBKaW5nLCBEaXZpc2lvbiBvZiBNYXRoZW1hdGljYWwg U2NpZW5jZXMgKE1BUyksIFNjaG9vbCBvZiBQaHlzaWNhbCBhbmQKTWF0aGVtYXRpY2FsIFNjaWVu Y2VzIChTUE1TKSwgTmFueWFuZyBUZWNobm9sb2dpY2FsIFVuaXZlcnNpdHkgKE5UVSksClNpbmdh cG9yZS4gKEBqdXN0cWRqaW5nKQpodHRwOi8vd3d3LnRldHJhcGguY29tL3dhbmdqaW5nCgoKCgoK KigxKSBEYWlseSBtYWlsIFJlZ2lzdHJhdGlvbiBQYWdlIFVudmFsaWRhdGVkIFJlZGlyZWN0cyBh bmQgRm9yd2FyZHMgV2ViClNlY3VyaXR5IFByb2JsZW0qCgoKKigxLjEpIFZ1bG5lcmFiaWxpdHkg RGVzY3JpcHRpb246KgpEYWlseSBvbmxpbmUgd2Vic2l0ZXMgaGF2ZSBhIGN5YmVyIHNlY3VyaXR5 IHByb2JsZW0uIEhhY2tlciBjYW4gZXhwbG9pdCBpdApieSBPcGVuIFJlZGlyZWN0IChVbnZhbGlk YXRlZCBSZWRpcmVjdHMgYW5kIEZvcndhcmRzKSBhdHRhY2tzLiBEdXJpbmcgdGhlCnRlc3RzLCBh bGwgRGFpbHkgbWFpbCB3ZWJzaXRlcyAoRGFpbHkgTWFpbCwgTWFpbCBvbiBTdW5kYXkgJiBNZXRy byBtZWRpYQpncm91cCkgdXNlIHRoZSBzYW1lIG1lY2hhbmlzbS4gVGhlc2Ugd2Vic2l0ZXMgaW5j bHVkZSBkYWlseW1haWwuY28udWssCnRoaXNpc21vbmV5LmNvLnVrLCBhbmQgbWFpbG9uc3VuZGF5 LmNvLnVrLgoKCgoKR29vZ2xlIERvcms6CiJQYXJ0IG9mIHRoZSBEYWlseSBNYWlsLCBUaGUgTWFp bCBvbiBTdW5kYXkgJiBNZXRybyBNZWRpYSBHcm91cCIKCgoKVGhlIHZ1bG5lcmFiaWxpdHkgb2Nj dXJzIGF0ICImdGFyZ2V0VXJsIiBwYXJhbWV0ZXIgaW4gImxvZ291dC5odG1sPyIgcGFnZSwKaS5l LgpodHRwOi8vd3d3LmRhaWx5bWFpbC5jby51ay9yZWdpc3RyYXRpb24vbG9nb3V0Lmh0bWw/dGFy Z2V0VXJsPWh0dHAlM0ElMkYlMkZnb29nbGUuY29tCgoKCgoKKigxLjIuMSkgKlVzZSB0aGUgZm9s bG93aW5nIHRlc3RzIHRvIGlsbHVzdHJhdGUgdGhlIHNjZW5hcmlvIHBhaW50ZWQgYWJvdmUuCgpU aGUgcmVkaXJlY3RlZCB3ZWJwYWdlIGFkZHJlc3MgaXMgImh0dHA6Ly9kaWViaXlpLmNvbS9hcnRp Y2xlcyIuIENhbgpzdXBwb3NlIHRoYXQgdGhpcyB3ZWJwYWdlIGlzIG1hbGljaW91cy4KClZ1bG5l cmFibGUgVVJMczoKaHR0cDovL3d3dy5kYWlseW1haWwuY28udWsvcmVnaXN0cmF0aW9uL2xvZ291 dC5odG1sP3RhcmdldFVybD1odHRwJTNBJTJGJTJGZGFpbHltYWlsLmNvLnVrCmh0dHA6Ly93d3cu dGhpc2lzbW9uZXkuY28udWsvcmVnaXN0cmF0aW9uL2xvZ291dC5odG1sP3RhcmdldFVybD1odHRw JTNBJTJGJTJGaGFvMTIzLmNvbS8KaHR0cDovL3d3dy5tYWlsb25zdW5kYXkuY28udWsvcmVnaXN0 cmF0aW9uL2xvZ291dC5odG1sP3RhcmdldFVybD1odHRwJTNBJTJGJTJGcGludGVyZXN0LmNvbQoK ClBPQyBDb2RlOgpodHRwOi8vd3d3LmRhaWx5bWFpbC5jby51ay9yZWdpc3RyYXRpb24vbG9nb3V0 Lmh0bWw/dGFyZ2V0VXJsPWh0dHAlM0ElMkYlMkZkaWViaXlpLmNvbS9hcnRpY2xlcwpodHRwOi8v d3d3LnRoaXNpc21vbmV5LmNvLnVrL3JlZ2lzdHJhdGlvbi9sb2dvdXQuaHRtbD90YXJnZXRVcmw9 aHR0cCUzQSUyRiUyRmRpZWJpeWkuY29tL2FydGljbGVzCmh0dHA6Ly93d3cubWFpbG9uc3VuZGF5 LmNvLnVrL3JlZ2lzdHJhdGlvbi9sb2dvdXQuaHRtbD90YXJnZXRVcmw9aHR0cCUzQSUyRiUyRmRp ZWJpeWkuY29tL2FydGljbGVzCgoKCgoqUE9DIFZpZGVvOioKaHR0cHM6Ly93d3cueW91dHViZS5j b20vd2F0Y2g/dj1BVS1ISkdlNUJXRSZmZWF0dXJlPXlvdXR1LmJlCgoKCipCbG9nIERldGFpbHM6 KgpodHRwOi8vdGV0cmFwaC5jb20vc2VjdXJpdHkvd2Vic2l0ZS10ZXN0L2RhaWx5LW1haWwtdXJs LXJlZGlyZWN0aW9uLwpodHRwOi8vc2VjdXJpdHlyZWxhdGVkLmJsb2dzcG90LmNvbS8yMDE1LzEw L2RhaWx5LW1haWwtcmVnaXN0cmF0aW9uLXBhZ2UuaHRtbAoKCgoKCiooMS4yLjIpKiBUaGUgcHJv Z3JhbSBjb2RlIGZsYXcgY2FuIGJlIGF0dGFja2VkIHdpdGhvdXQgdXNlciBsb2dpbi4gVGVzdHMK d2VyZSBwZXJmb3JtZWQgb24gTWljcm9zb2Z0IElFICg5IDkuMC44MTEyLjE2NDIxKSBvZiBXaW5k b3dzIDgsIE1vemlsbGEKRmlyZWZveCAoMzcuMC4yKSAmIEdvb2dsZSBDaHJvbWl1bSA0Mi4wLjIz MTEgKDY0LWJpdCkgb2YgVWJ1bnR1CigxNC4wNC4yKe+8jGFuZCBBcHBsZSBTYWZhcmkgNi4xLjYg b2YgTWFjIE9TIFggdjEwLjkgTWF2ZXJpY2tzLgoKVGhlc2UgYnVncyB3ZXJlIGZvdW5kIGJ5IHVz aW5nIFVSRkRTIChVbnZhbGlkYXRlZCBSZWRpcmVjdHMgYW5kIEZvcndhcmRzCkRldGVjdGlvbiBT eXN0ZW0pLgoKCgoKCiooMS4yKSBEZXNjcmlwdGlvbiBvZiBPcGVuIFJlZGlyZWN0OioKSGVyZSBp cyB0aGUgZGVzY3JpcHRpb24gb2YgT3BlbiBSZWRpcmVjdDogIkEgd2ViIGFwcGxpY2F0aW9uIGFj Y2VwdHMgYQp1c2VyLWNvbnRyb2xsZWQgaW5wdXQgdGhhdCBzcGVjaWZpZXMgYSBsaW5rIHRvIGFu IGV4dGVybmFsIHNpdGUsIGFuZCB1c2VzCnRoYXQgbGluayBpbiBhIFJlZGlyZWN0LiBUaGlzIHNp bXBsaWZpZXMgcGhpc2hpbmcgYXR0YWNrcy4gQW4gaHR0cApwYXJhbWV0ZXIgbWF5IGNvbnRhaW4g YSBVUkwgdmFsdWUgYW5kIGNvdWxkIGNhdXNlIHRoZSB3ZWIgYXBwbGljYXRpb24gdG8KcmVkaXJl Y3QgdGhlIHJlcXVlc3QgdG8gdGhlIHNwZWNpZmllZCBVUkwuIEJ5IG1vZGlmeWluZyB0aGUgVVJM IHZhbHVlIHRvIGEKbWFsaWNpb3VzIHNpdGUsIGFuIGF0dGFja2VyIG1heSBzdWNjZXNzZnVsbHkg bGF1bmNoIGEgcGhpc2hpbmcgc2NhbSBhbmQKc3RlYWwgdXNlciBjcmVkZW50aWFscy4gQmVjYXVz ZSB0aGUgc2VydmVyIG5hbWUgaW4gdGhlIG1vZGlmaWVkIGxpbmsgaXMKaWRlbnRpY2FsIHRvIHRo ZSBvcmlnaW5hbCBzaXRlLCBwaGlzaGluZyBhdHRlbXB0cyBoYXZlIGEgbW9yZSB0cnVzdHdvcnRo eQphcHBlYXJhbmNlLiIgKEZyb20gQ1dFKQoKCgoKKigxLjMpIFZ1bG5lcmFiaWxpdHkgRGlzY2xv c3VyZToqClRoZXNlIHZ1bG5lcmFiaWxpdGllcyBoYXZlIG5vdCBiZWVuIHBhdGNoZWQuCgoKCgoK CgoKKigyKSBEYWlseSBNYWlsIFdlYnNpdGUgWFNTIEN5YmVyIFNlY3VyaXR5IFplcm8tRGF5IFZ1 bG5lcmFiaWxpdHkqCgoKKigyLjEpIFZ1bG5lcmFiaWxpdHkgZGVzY3JpcHRpb246KgpEYWlseU1h aWwgaGFzIGEgc2VjdXJpdHkgcHJvYmxlbS4gQ3JpbWluYWxzIGNhbiBleHBsb2l0IGl0IGJ5IFhT UyBhdHRhY2tzLgoKVGhlIHZ1bG5lcmFiaWxpdHkgb2NjdXJzIGF0ICJyZXBvcnRBYnVzZUluQ29t bWVudC5odG1sPyIgcGFnZSB3aXRoCiImY29tbWVudElkIiBwYXJhbWV0ZXIsIGkuZS4KaHR0cDov L3d3dy5kYWlseW1haWwuY28udWsvaG9tZS9yZXBvcnRBYnVzZUluQ29tbWVudC5odG1sP2FydGlj bGVJZD0zNDYyODgmY29tbWVudElkPTg3NzAzOAoKClBPQyBDb2RlOgpodHRwOi8vd3d3LmRhaWx5 bWFpbC5jby51ay9ob21lL3JlcG9ydEFidXNlSW5Db21tZW50Lmh0bWw/YXJ0aWNsZUlkPTM0NjI4 OCZjb21tZW50SWQ9Ij48aW1nCnNyYz14IG9uZXJyb3I9cHJvbXB0KCdqdXN0cWRqaW5nJyk+CgoK VGhlIHZ1bG5lcmFiaWxpdHkgY2FuIGJlIGF0dGFja2VkIHdpdGhvdXQgdXNlciBsb2dpbi4gVGVz dHMgd2VyZSBwZXJmb3JtZWQKb24gTW96aWxsYSBGaXJlZm94ICgzNC4wKSBpbiBVYnVudHUgKDE0 LjA0KSBhbmQgTWljcm9zb2Z0IElFICg5LjAuMTUpIGluCldpbmRvd3MgNy4KCgoKKlBPQyBWaWRl bzoqCmh0dHBzOi8vd3d3LnlvdXR1YmUuY29tL3dhdGNoP3Y9T2lnLVpybEpEZjgmZmVhdHVyZT15 b3V0dS5iZQoKCgoqQmxvZyBEZXRhaWw6KgpodHRwOi8vdGV0cmFwaC5jb20vc2VjdXJpdHkvd2Vi LXNlY3VyaXR5L2RhaWx5LW1haWwteHNzLWJ1Zy8KaHR0cDovL3NlY3VyaXR5cmVsYXRlZC5ibG9n c3BvdC5jb20vMjAxNS8xMC9kYWlseS1tYWlsLW9ubGluZS13ZWJzaXRlLXhzcy1jeWJlci5odG1s CgoKCgoKKigyLjIpIFdoYXQgaXMgWFNTPyoKIkNyb3NzLXNpdGUgc2NyaXB0aW5nIChYU1MpIGlz IGEgdHlwZSBvZiBjb21wdXRlciBzZWN1cml0eSB2dWxuZXJhYmlsaXR5CnR5cGljYWxseSBmb3Vu ZCBpbiB3ZWIgYXBwbGljYXRpb25zLiBYU1MgZW5hYmxlcyBhdHRhY2tlcnMgdG8gaW5qZWN0CmNs aWVudC1zaWRlIHNjcmlwdCBpbnRvIHdlYiBwYWdlcyB2aWV3ZWQgYnkgb3RoZXIgdXNlcnMuIEEg Y3Jvc3Mtc2l0ZQpzY3JpcHRpbmcgdnVsbmVyYWJpbGl0eSBtYXkgYmUgdXNlZCBieSBhdHRhY2tl cnMgdG8gYnlwYXNzIGFjY2VzcyBjb250cm9scwpzdWNoIGFzIHRoZSBzYW1lLW9yaWdpbiBwb2xp Y3kuIENyb3NzLXNpdGUgc2NyaXB0aW5nIGNhcnJpZWQgb3V0IG9uCndlYnNpdGVzIGFjY291bnRl ZCBmb3Igcm91Z2hseSA4NCUgb2YgYWxsIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdGllcwpkb2N1bWVu dGVkIGJ5IFN5bWFudGVjIGFzIG9mIDIwMDcuIFRoZWlyIGVmZmVjdCBtYXkgcmFuZ2UgZnJvbSBh IHBldHR5Cm51aXNhbmNlIHRvIGEgc2lnbmlmaWNhbnQgc2VjdXJpdHkgcmlzaywgZGVwZW5kaW5n IG9uIHRoZSBzZW5zaXRpdml0eSBvZgp0aGUgZGF0YSBoYW5kbGVkIGJ5IHRoZSB2dWxuZXJhYmxl IHNpdGUgYW5kIHRoZSBuYXR1cmUgb2YgYW55IHNlY3VyaXR5Cm1pdGlnYXRpb24gaW1wbGVtZW50 ZWQgYnkgdGhlIHNpdGUncyBvd25lci4iIChXaWtpcGVkaWEpCgoKCgoqKDIuMykgVnVsbmVyYWJp bGl0eSBEaXNjbG9zdXJlOioKVGhpcyB2dWxuZXJhYmlsaXR5IGhhcyBiZWVuIHBhdGNoZWQuCgoK CgpCbG9nIERldGFpbHM6Cmh0dHA6Ly90ZXRyYXBoLmNvbS9zZWN1cml0eS93ZWJzaXRlLXRlc3Qv ZGFpbHktbWFpbC1vcGVuLXJlZGlyZWN0LXhzcy8KaHR0cDovL3NlY3VyaXR5cmVsYXRlZC5ibG9n c3BvdC5jb20vMjAxNS8xMC9kYWlseS1tYWlsLXVybC1yZWRpcmVjdGlvbi1hbmQteHNzLWJ1Zy5o dG1sCgoKCgoKCi0tCkppbmcgV2FuZywKRGl2aXNpb24gb2YgTWF0aGVtYXRpY2FsIFNjaWVuY2Vz IChNQVMpLApTY2hvb2wgb2YgUGh5c2ljYWwgYW5kIE1hdGhlbWF0aWNhbCBTY2llbmNlcyAoU1BN UyksCk5hbnlhbmcgVGVjaG5vbG9naWNhbCBVbml2ZXJzaXR5IChOVFUpLCBTaW5nYXBvcmUuCmh0 dHA6Ly93d3cudGV0cmFwaC5jb20vd2FuZ2ppbmcvCmh0dHBzOi8vdHdpdHRlci5jb20vanVzdHFk amluZwoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KU2Vu dCB0aHJvdWdoIHRoZSBGdWxsIERpc2Nsb3N1cmUgbWFpbGluZyBsaXN0Cmh0dHBzOi8vbm1hcC5v cmcvbWFpbG1hbi9saXN0aW5mby9mdWxsZGlzY2xvc3VyZQpXZWIgQXJjaGl2ZXMgJiBSU1M6IGh0 dHA6Ly9zZWNsaXN0cy5vcmcvZnVsbGRpc2Nsb3N1cmUv