ansaurus

Question

What XSS/CSRF attacks (if any) to be aware of when allowing video embeds?

Answer 1

A:

Why don't you just visit all the sites, save their embed code, and then only allow your users to submit the required site's parameters?

St. John Johnson 2010-03-18 17:24:50

Hey, thanks. I thought about this too. But this might get too cumbersome. We'ld like to allow as many video sites a possible. Also, I don't want to bother people with too much technical details (knowing what parameters to put where). So basically we'ld like to keep it as simple as possible for people (copy/paste embed code and be done).

fireeyedboy 2010-03-19 12:49:25

Well, all they would need is choose what site and then copy/paste the resulting URL. This would be safer.

St. John Johnson 2010-03-19 13:10:37

St. John Johnson - have you ever heard about User-Friendliness ? :D Not all users come from IT department ;)

shfx 2010-03-22 22:06:54

@shfx Haha, touché. I was just thinking that let's say you uploaded your file to youtube, well you get a resulting link: youtube.com/8asdja8 Copy that to a text field and then detect what the site is (youtube), which then relates to the specific code they use to embed links, and then combine them together to get a safely embeded video.

St. John Johnson 2010-03-23 00:13:53

@john Oh! ;) Yup! thats the simplest way for the users for sure!

shfx 2010-03-23 11:57:05

Answer 2

+1 A:

First and most dangerous xss (?) is that flash can read your DOM... Don't embed videos on pages where user can input his/hers login data. Login forms should be separated.

Usually flash embeds uses code that looks similar to:

Youtube:

<object width="425" height="350">
  <param name="movie" value="http://www.youtube.com/v/AyPzM5WK8ys" />
  <param name="wmode" value="transparent" />
  <embed src="http://www.youtube.com/v/AyPzM5WK8ys"
         type="application/x-shockwave-flash"
         wmode="transparent" width="425" height="350" />
</object>

Vimeo:

<object width="400" height="225">
  <param name="allowfullscreen" value="true" />
  <param name="allowscriptaccess" value="always" />
  <param name="movie" value="http://vimeo.com/moogaloop.swf?clip_id=10239065&amp;amp;server=vimeo.com&amp;amp;show_title=1&amp;amp;show_byline=1&amp;amp;show_portrait=0&amp;amp;color=&amp;amp;fullscreen=1" />
  <embed src="http://vimeo.com/moogaloop.swf?clip_id=10239065&amp;amp;server=vimeo.com&amp;amp;show_title=1&amp;amp;show_byline=1&amp;amp;show_portrait=0&amp;amp;color=&amp;amp;fullscreen=1" type="application/x-shockwave-flash" allowfullscreen="true" allowscriptaccess="always" width="400" height="225"></embed>
</object>
<p><a href="http://vimeo.com/10239065"&gt;La Fete (HD - 2010)</a> from <a href="http://vimeo.com/animalcolm"&gt;Malcolm Sutherland</a> on <a href="http://vimeo.com"&gt;Vimeo&lt;/a&gt;.&lt;/p&gt;

Metacafe:

<embed src="http://www.metacafe.com/fplayer/4317045/bmx_face_slide.swf" width="400" height="345" wmode="transparent" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash" allowFullScreen="true" allowScriptAccess="always" name="Metacafe_4317045"> </embed>
<br><font size = 1><a href="http://www.metacafe.com/watch/4317045/bmx_face_slide/"&gt;BMX Face Slide</a> - <a href="http://www.metacafe.com/"&gt;Free videos are just a click away</a></font>

Best solution for enabling embeded content is to strip tags with exception for embed, param, object and list of attributes from the the samples that can be used.

Remember, some attributes can run javascript code as well as anchor's href...

Edit: Allowing only trusted sites in src and param's value attribute is kinda good way to prevent hAx0rs from doing bad things but it's not flawles. Another big thing: read more about allowScriptAccess. Its a Param's attribute you should remove or set to sameDomain / never. It will prevent SWF from running javascript :)

shfx 2010-03-18 23:29:51

I think we're gonna have to strip all excess tags such as the `<p>` from Vimeo. And indeed strip excess attributes. Good point also, about the DOM. Wouldn't have thought about this myself. Also: do you think allowing only known video domainnames in the `<embed src=` attribute and `<param name="movie" value=` attribute is enough to prevent rogue flash movies from being embedded in those attributes?

fireeyedboy 2010-03-19 13:04:14

yup, i've edited my answer, hope you get the point

shfx 2010-03-22 21:59:04

there's another way, read about youtube's API and try to embed SWF file just using a given URL... like Facebook does

shfx 2010-03-22 22:02:21

ansaurus

tags:

views:

answers:

What XSS/CSRF attacks (if any) to be aware of when allowing video embeds?

related questions