NoScript creates vulnerability w/ twitter.com logout
Posted: Fri Jun 12, 2009 6:26 am
First, kudos to all involved for a great add-on -- y'all rock. I wanted to give back by reporting an issue:
Using FF 3.0.10 under Win, with NoScript 1.9.3.3, and not allowing scripts on twitter.com makes for an interesting wrinkle when logged into twitter.com: signing out lands you on some clever bloke's new twitter profile page (and doesn't sign you out). [Edit: and no, this doesn't seem to be due to any flaw with twitter.com's code, NoScript is adding a GET request it shouldn't]
By virtue of the NoScript's sanitization somewhere, I just noticed today that attempting to click the Sign Out button to log off of twitter.com, you end up on http://twitter.com/sign_out_form which some clever person either created today, or just started using earlier today. This unfortunately makes using twitter.com with NoScript actually a little less safe than having js enabled.
The twitter.com html for logout is:
and the sign_out_form element is:
which twitter intends to simply POST a single value POST to http://twitter.com/sessions/destroy With NoSCript enabled however, what I see is that in addition to the POST to /sessions/destroy (good) NoScript takes it upon itself to generate a GET request that we don't want:
Sometimes this GET is a HEAD instead of a GET with the same URI. In either case, you end up on the twitter page of some clever guy who chose a username of sign_out_form (presumably a NoScript user who spotted the vulnerability NoScript seems to have created here).
For whatever reason, I just noticed this behavior today, so I'm not sure if there's something new in twitter.com's code, whther the account was just created and the issue now evidences itself, or if noscript changed somehow. It's all rather interesting.
I did some testing with and without Options>dvanced>XSS "Sanitize cross-site suspicious requests" and "Turn cross-site POST requests into data-less GET requests" and didn't see the undesired GET request go away. Only "allow scripts globally" or disabling NoScript seemed to make the issue go away.
Opera, Firefox and IE's behavior with javascript turned off simply make the Sign Out button not work at all, as you might expect from the code since the sign out link's href= clause is just href="#" [Edit: And all 3 of those browsers with JavaScript on behave as designed: they sign you out with the signout button, and do NOT redirect you to the clever user's new profile page. ]
Curious if this has been reported elsewhere or what the real timeline was on this.
Keep up the good work!
Using FF 3.0.10 under Win, with NoScript 1.9.3.3, and not allowing scripts on twitter.com makes for an interesting wrinkle when logged into twitter.com: signing out lands you on some clever bloke's new twitter profile page (and doesn't sign you out). [Edit: and no, this doesn't seem to be due to any flaw with twitter.com's code, NoScript is adding a GET request it shouldn't]
By virtue of the NoScript's sanitization somewhere, I just noticed today that attempting to click the Sign Out button to log off of twitter.com, you end up on http://twitter.com/sign_out_form which some clever person either created today, or just started using earlier today. This unfortunately makes using twitter.com with NoScript actually a little less safe than having js enabled.
The twitter.com html for logout is:
Code: Select all
<a id="sign_out_link" href="#" onclick="document.getElementById('sign_out_form').submit(); return false;"
accesskey="l">Sign out</a>Code: Select all
<form method="post" id="sign_out_form" action="/sessions/destroy" style="display:none;">
<input name="authenticity_token" value="[redacted]" type="hidden" />
</form>Code: Select all
GET http://twitter.com:80/sign_out_form HTTP/1.1For whatever reason, I just noticed this behavior today, so I'm not sure if there's something new in twitter.com's code, whther the account was just created and the issue now evidences itself, or if noscript changed somehow. It's all rather interesting.
I did some testing with and without Options>dvanced>XSS "Sanitize cross-site suspicious requests" and "Turn cross-site POST requests into data-less GET requests" and didn't see the undesired GET request go away. Only "allow scripts globally" or disabling NoScript seemed to make the issue go away.
Opera, Firefox and IE's behavior with javascript turned off simply make the Sign Out button not work at all, as you might expect from the code since the sign out link's href= clause is just href="#" [Edit: And all 3 of those browsers with JavaScript on behave as designed: they sign you out with the signout button, and do NOT redirect you to the clever user's new profile page. ]
Curious if this has been reported elsewhere or what the real timeline was on this.
Keep up the good work!
I am glad it calls attention to the ways attackers could envision using this functionality to target NoScript users uniquely though. We all love NoScript for the attack vectors it takes away via JS, but this appears to be one instance where a preserving-of-functionality feature can create a possible new/interesting means of attack.