Universal Browser PDF XSS vulnerability
Posted on January 5, 2007 - Filed Under Application Security, Phishing | Leave a Comment
Everyday application security is facing new threats and it challenges the business users. The latest is in the form of XSS attacks; where an application serving PDF files are vulnerable to these attacks.
Attackers simply have to add an anchor containing a script, e.g. add #blah=javascript:alert(document.cookie); to ANY URL that ends in .pdf (or streams a [...]
