Update: You may also want to look at: MySpace Hack: How To View Any Users Private Videos.

Recently Samy [samy at namb dot la] released a worm ["Samy worm" or "JS.Spacehero worm"] in MySpace, popular social networking platform like Friendster, which caused him to be added as hero to millions of MySpace users ("but most of all, samy is my hero.") as well as add him as their friend, all without their explicit permission.

After flooding the Network, MySpace stepped in and fixed the hole. Samy is still "hero" to millions of MySpace users in their profile.

The purpose of this article is to highlight the security issues exposed by this worm. It is definitely not limited to MySpace alone and the worm propagated not due to MySpace's fault but fault of browser like Internet Explorer. And the flaw is waiting to be exploited in several other web applications of similar nature like Ryze or LinkedIn etc.. In the remainder of this article I will summarize the modus-operandi of his script and suggest on ways to protect your web application against such attacks.

Samy used AJAX to add himself as a friend and hero when users visited his page. This requires Javascript to be executed in the browser which does the dirty work.

MySpace dutifully eliminates javascript from users html (which becomes their profile). However Sammy disguised the word javascript with an embedded newline - "java\nscript".

MySpace doesn't allow script tags. So he embedded his javascript in CSS - style="background:url('javascript:eval(document.all.mycode.expr)')"

AJAX can fetch documents from the same domain (or sub-domain) only. So if the user was on profile.myspace.com, he moved them to www.myspace.com which provides the same information but allows him to be added as a friend.
if (location.hostname == 'profile.myspace.com') document.location = 'http://www.myspace.com' + location.pathname + location.search;

After overcoming a trvial hash issue he adds his code and "but most of all, samy is my hero." text to users profile. This causes the worm to propagate not only when users visit his site but also when they visit any of the infected users. Yes, simple exponential spreading.

Samy provides detailed notes and code for his exploit after the exploit was filtered / stopped by MySpace.

How can you protect your web application from such attacks?
First and foremost I assume you have filtering in place like MySpace did filtering scripts and javascript tags etc. However obviously that is not enough; not even close.
Your filtering tags should be intelligent to recognize words separated by newlines as shown above.

Other users profile (or any html content) should be viewable only from a separate sub-domain.

Any actions like adding a link, friend, connection etc. must be done from pages which can never contains any other users code. If you provide a link while viewing others profile to add his as a friend then on clicking you take him to a separate page where the users gets to edit information about his friend and add him after confirmation. This page should not contain any html content from the user being added.

In essence we need to captalize on AJAX security model which prevents code execution from different site.