C9 Advisory: Watch what you click

Posted By: CannotResolveSymbol | Dec 26th, 2008 @ 11:36 PM
page 1 of 3
Comments: 61 | Views: 1834
#Dec 27th, 2008 @ 2:49 AM
Bas
Bas
It finds lightbulbs.


Beautiful.
#Dec 27th, 2008 @ 3:14 AM
TommyCarlier
TommyCarlier
I want my scalps!
If you think that is beautiful, check out TechOff.
#Dec 27th, 2008 @ 3:19 AM
stevo_
stevo_
Human after all
Doesn't really surprise me at all, its such a fundamental flaw that just shouldn't be allowed to pass through to a live site of this magnitude.. I know you guys will have to take this really seriously considering some of the things this can allow..
#Dec 27th, 2008 @ 5:27 AM
ManipUni
ManipUni
Proving QQ for 5 years!
You don't sanitize your thread titles? Really?
#Dec 27th, 2008 @ 6:53 AM
littleguru
littleguru
<3 Seattle
OMG! This is so embarrassing! Sad
#Dec 27th, 2008 @ 6:54 AM
W3bbo
W3bbo
The Master of Baiters
Did you just get the text "echo" placed everywhere on every page?

It seems to have gone now.
#Dec 27th, 2008 @ 7:06 AM
Rowan
Rowan
Look, no errors.
Yes, it seems that a post with no comments will show up in the "Active forum threads" box, which appears in places like the front page.

Wasn't there a very similar issue a while ago on Channel9 where whole messages went unfiltered?

I've been playing around a bit in the less-used forums for shits 'n giggles, staying away from the Coffeehouse so we can at least still communicate.
#Dec 27th, 2008 @ 7:10 AM
ManipUni
ManipUni
Proving QQ for 5 years!
Some made a thread with:
<style type="text/css">div:after { content: "echo"; }</style>

In the title which is appearing in the sidebar.
#Dec 27th, 2008 @ 11:08 AM
mastermine
mastermine
See.Hear.Frag
Looks like some one broke the coffeehouse

O Joy
#Dec 27th, 2008 @ 12:12 PM
Dr Herbie
Dr Herbie
Horses for courses
Well that was f*cking stupid : if you find a vulnerability like that you should at least email the team privately, rather than splattering it all across the site so that any f*cking retard can mess the whole place up.

Thanks a f*cking bundle.


Herbie
#Dec 27th, 2008 @ 12:52 PM
Charles
Charles
Welcome Change
Duncan has fixed this.
C
#Dec 27th, 2008 @ 12:55 PM
jh71283
jh71283
Throw new System.Beverage. OutOfCoffeeException​()
Maybe so, but what about the posts that are already there?

For instance some retard has inserted a blink tag
#Dec 27th, 2008 @ 1:01 PM
Charles
Charles
Welcome Change
Duncan's stopped the bleeding... There's more to do.
C
#Dec 27th, 2008 @ 1:05 PM
jh71283
jh71283
Throw new System.Beverage. OutOfCoffeeException​()
I think whoever has exploited this should be banned outright.

As Herbie says, it's fair enough to find a vulnerability and alert C9, but to exploit it is malicious.
#Dec 27th, 2008 @ 1:05 PM
Charles
Charles
Welcome Change
Agreed. Which threads are flashing (blinking)?
C
#Dec 27th, 2008 @ 1:08 PM
jh71283
jh71283
Throw new System.Beverage. OutOfCoffeeException​()
All of them

They only blink when you are actually raeding them though, the post listings do not blink.

If they're not blinking for you, I'll try flushing my cache.
#Dec 27th, 2008 @ 1:10 PM
jh71283
jh71283
Throw new System.Beverage. OutOfCoffeeException​()
flushing had no effect.

And it is ALL of the text on the page, not just the post text, the headers etc are all blinking.
#Dec 27th, 2008 @ 1:15 PM
jh71283
jh71283
Throw new System.Beverage. OutOfCoffeeException​()
Stopped,. Yay.
#Dec 27th, 2008 @ 2:26 PM
littleguru
littleguru
<3 Seattle
i'm also for banning the guy(s) who messed this stuff up...
#Dec 27th, 2008 @ 3:02 PM
ManipUni
ManipUni
Proving QQ for 5 years!
Meh.

It was fairly harmless and caused no lasting damage. Just leave it now. The problem is fixed, the threads are gone, and everything is fine. If you are that upset about seeing the word "echo" all over the place then go ahead and start a lawsuit.
#Dec 27th, 2008 @ 3:17 PM
littleguru
littleguru
<3 Seattle
Who said anything about lawsuits?

Defacing a website with something so easy is just childish; c'mon entering HTML in a textbox that doesn't do the filtering. On the other hand if it would have been something innovative and new - that would have been at least wicked... even the redirect to yet another linux website was plain boring. or the messagebox that said "all bases belong to us" - how boring was that... 

people who do childish stuff like that shouldn't get our respect! fame to real innovators, blame to stuff like this.
page 1 of 3
Comments: 61 | Views: 1834
Microsoft Communities