The CIA Freedom of Information website had the dumbest security hole in it. With all the recent hoo har about the “Family Jewels” documents, you’d expect they’d do a quick once over on this stuff. All the textual content on the document view pages is generated directly from variables passed in the url - with no input validation.
This opens them up to cross site scripting attacks (XSS) and really is just stupid. Lucky they aren’t the GUARDIANS OF THE LARGEST CACHE OF SENSITIVE INFORMATION IN THE WORLD or anything - *phew*.
Anyway, using this bug, I made a website where you can write your own documents and publish them on the CIA FOIA website:
I guess that from tomorrow, any mail for me should be addressed to Guantanamo Bay.
Actually, technically you’re the ones doing the exploiting by using the links my site provides - so, you know, at your own risk and all that.
I’m talking about Ruby on Rails at the West Yorkshire Linux User Group on Monday 11th June 2007. I’ll be covering what Rail is, how it works, and how you use it. Starts at 1900hrs at the E.C Stoner (snigger) Building at the University of Leeds. There follows a talk about Sun’s ZFS file system by Tom Hall, then we retire to The Victoria Hotel pub for some real ale and whatnot.
John Leach is a human being living in Leeds, UK.