A Security researcher, Riyaz Ahemed Walikar, has posted evidence of a serious persistent Cross Site Scripting(XSS) vulnerability on Tumblr, the popular microblogging platform.
XSS flaws are highly common on websites these days, but most of them are non-persistent and implicitly less dangerous.
"XSS can cause a lot of serious problems. An attacker can steal cookies, redirect users to fake or malicious sites, control a user's browser using automated frameworks like BeEF and download and execute exploits on the victim's computer," Researcher said in the blog post.
"Stored XSS is even more dangerous since the script is stored on the server and is executed everytime user visits an infected page."
Researcher found vulnerability on the 'Register Application' page at http://www.tumblr.com/oauth/apps. The application was not sanitizing user input when a user would create a new application. An XSS attack vector like tester "><img src='x' onerror="alert(document.cookie)"/> would trigger an alert box, displaying the user's cookie, in the browser.
Tumblr were notified more than three weeks ago on the issue. Finally, they fixed the vulnerability Today(july 14).
If you don't know what XSS is, you can read this article "Xss For Beginners".
