Huffington Post UK XSS Flaw (Disclosed & Fixed)
By @edent
· journalism security xss · 150 words
The UK version of the Huffington Post was vulnerable to an XSS flaw. This allowed any malicious user to inject images, video, text, and JavaScript into the page. Although the above image show a very silly use of XSS, it could quite easily be used to craft a page to encourage journalists and readers to enter their passwords - and then send them off to criminals. What's unusual is that it appears to be powered by Google Custom Search - which should really be robust against this source of…
Continue reading →