GoDaddy, the largest domain name registrar, has eliminated a dangerous vulnerability in its system, reports ThreatPost. The vulnerability was discovered by researcher Matthew Bryant that is GoDaddy’s client. He discovered that the customer support section on GoDaddy’s webpage is vulnerable to so-called blind XSS attacks – one of the versions of cross-site scripting. This attack allows criminal to integrate into a webpage a random script; it operates as a “time bomb”: it remains inactive and invisible till someone visits the page and activates the script.
When checking the discovery, Bryant implemented the script into his own account. The attack was activated when support staff of GoDaddy visited the page. According to Metthew Bryant’s estimations, the vulnerability is critical. It potentially allowed to gain control over GoDaddy’s support staff accounts. Later, using his rights of administrator criminals would be able to make any changes in domain names administrators’ accounts up to elimination.
