Security issues with Swedish news sites

Some time ago I wrote about a German site that provides a list of web sites vulnerable to XSS-attacks. The owner of the site found the link and asked me to translate it into English so he could understand.

During our discussion I told him that it would be interesting to see how secure Swedish web sites are. The security expert who calles himself "beNi" asked my to make a list of some well known sites. I choosed some that were in my current memory and has been in focus lately.

News sites:

Aftonbladet.se
DN.se
SvD.se

Blog portals:

Bloggportalen.se
Twingly.se
Knuff.se

A great disappointment

I got reply from beNi and he tells me he has done some research. He only investigated DN, SvD and Twingly. The other three sites on the list loaded to slowly for him to works with (even though he has an 6MBit-connection).

He found a whole bunch of insecure pages within a few minutes. Both DN and SvD contains some holes as you can read on his blog. There are also five examples of urls showing how this issues can be abused.

Examples of XSS-vulnerabilities

This is the examples. I have also uploaded some screenshots of how the pages looks when you visit them at the moment. These links are not dangerous to visit. But if you see something similar anywhere else I would strongly suggest not to try them.

Security problem 1 - DN.se (issue secured) (sceendump)

Security problem 2 - DN.se (issue secured) (sceendump)

Security problem 3 - Koll.se (issue secured) (sceendump)

Security problem 4 - SvD.se (issue secured) (sceendump)

Security problem 5 - SvD.se (issue secured) (sceendump)

Twingly was safe from sequrity issues. The site uses ASP.NET which has a lot of build in protection. Microsoft has realised the importance of protecting against XSS and has also released special API's for protection. I will write about these at a later time.

DN that uses Java and SvD that are running on classic ASP was not so succesful in the test.

Developers must wake up

Is is quite embarrasing to see that news sites of this size doen't has complete control of their web app sequrity. Web masters must wake up and realise. You are not only risking the sequrity of your own sites. The main thing about cross-site-scripting is that it can be used to target other sites than the domain they are found on.

Update: There has been some responses to the Swedish version of this post where I have documented the developments more in depth. In short the following has happended.

Two of the links above were indexed by Twingly which is a ping service connected to the news sites. That meant that this post were linked to from both of the news sites in connection to some articles, and received quite a lot of visitors.

I would like to thank Martin working on Twingly for pointing out that the urls were normalized before they entered there system. If these links should have been indexed at all by the blog portal is still questionable.

I also temporarily removed the links since I felt a bit guilty of publishing them without giving the site owners a warning first. I did email both of the news sites rather quickly after I wrote the blog-post. SvD replied and thanked me for letting them know. They have now secured the issues and I congratulate them for their swift action.

The issues on DN.se still remains unfixed and I have not heard anything from them. I will give them some time to fix the problems before I publish the links on my site again.

I want to keep these XXS-links on my site as a reference to other developers. The might be useful for web masters to realise what kind of threat they are up against. The other reason I would like to keep the links on my site is because I would like to study how the search engines will respond to them. Will they for example be indexed by Google? Will they still work in the cached versions? It will be interesting to find out.

Update 2: We are happy to notice that DN also has fixed their security problems. Both sites managed to shut down their XSS-flaws in only 1-2 days which is really good.