Feed Injection in Web 2.0

By | August 1, 2006

One new feature of “Web 2.0”, the movement to build a more responsive Web, is the utilization of XML content feeds which use the RSS and Atom standards. These feeds allow both users and Web sites to obtain content headlines and body text without needing to visit the site in question, basically providing users with a summary of that sites content.

Unfortunately, many of the applications that receive this data do not consider the security implications of using content from third parties and unknowingly make themselves and their attached systems susceptible to various forms of attack.

This white paper discusses various forms of attacks based on Web feeds that follow the RSS, Atom and XML standards. This paper does not extensively cover each XML element and its usage within Web-based feeds, nor does it address other vulnerability scenarios such as buffer overflows and other XMLspecific risks. The goal of this paper is to outline the risks of lesser-known threats which are currently emerging on the Web utilizing Cross-Site Scripting.

Browsers, local readers, Web sites and online portals such as Bloglines all subscribe to feeds. These applications automatically fetch new content at intervals defined either on the receiving client or by the feed itself. Once a user is subscribed, they are alerted to new entries where they can read the story title and usually a brief description of the story body.

Click here to download the full whitepaper

Leave a Reply