I would often keep abreast of new vulnerabilities and exploits via my RSS feeds. Visiting page after page was just never fun. RSS allowed me to categorise, organise and track the security mayhem on the Internet. What was the point of employing a security analyst who was outdated and outgunned?
I decided to play with Sage, which is a popular RSS extension for Mozilla Firefox. It had a friendly interface and a nice option to turn HTML tags on and off. This was a feature I was certainly interested in. It meant I could prevent a number of attacks outlined by SPI Dynamicâ€™s recent RSS Injection whitepaper. The recommendation given in this paper was the typical recommendation given to XSS attacks. Escape â€œ<>â€ to â€œ< >â€
Second: Logical mental progression put forward the question, what if we reversed it? â€œ<, >â€ became â€œ<>â€ when HTML tags were turned on (THE DEFAULT). This means we can effectively hack the latest version of Sage via RSS Injection regardless of which mode is set.
Thirdly: Sage converts the feed into an HTML file and stores it on the local system. This means we were now in the browserâ€™s local zone policy. From here we could read any file from the local system.
See GNUCITIZEN more proof of concept example.