[Full-Disclosure] Misuse of Macromedia Flash Ads clickTAG Option May Lead to Privacy Breach
aviram at beyondsecurity.com
Mon Apr 14 07:30:51 BST 2003
This advisory is available online at:
Misuse of Macromedia Flash Ads clickTAG Option May Lead to Privacy
"Over 497 million Internet users now use Macromedia Flash Player to
seamlessly view content created with Macromedia Flash, the solution for
developing rich Internet content and applications."
A vulnerability discovered in Macromedia Flash ad user tracking field
allows a remote user to perform Cross-Site-Scripting attacks and
About the 'clickTAG' option:
Macromedia flash supplies user-tracking field to swf (flash movies) ads:
"The clickTAG is the tracking code assigned by the ad serving network to
an individual ad. The clickTAG allows the network to register where the
was displayed when it was clicked on. This click through data is
to the ad serving servers so advertisers may determine the effectiveness
of their campaign.
The code below will allow ad serving networks to dynamically assign a
clickTAG to their ad.
In this example, a getURL action is being assigned to a button that will
navigate the browser to ["clickTAG"]. The "getURL(clickTAG)" statement
appends the variable data passed in via the OBJECT EMBED tag and
the browser to that location. It is the tracking code assigned by the ad
serving network, which allows them to register a user's click on that
http://adnetwork.com/tracking?http://www.destinationURL.com" > ..."
The information was taken from Macromedia designer's guide:
Vulnerability in the clickTAG field enables a remote user to run
retrieve session information and possibly other sensitive information.
For example in the following script:
("XXXX" = arbitrary script or tag)
Replacing "XXXX" with a script to steal cookies will enable an attacker
perform session hijacking if the session is saved in the cookie, or to
gain the private information present in ad tracking cookies.
"A new player version is NOT required. Macromedia Flash advertisements
that accept clickTAGs need to validate that the clickTAG URL begins with
"http:". This helps ensure the clickTAG does not contain malicious
Quote from the official Macromedia security advisory.
We recommend that all user input should be filtered for malicious code
characters and never trusted "as-is".
We would like to thank Macromedia for its prompt response and
for solving this issue.
Macromedia quickly acted to notify possibly affected sites and has
released an official security announcement, which can be found at:
Macromedia has also revised the Designer's Guide and added this note:
"Note: The ActionScript in this Flash advertisement is verifying that
clickTAG URL begins with "http:". This is an important security measure.
If you do not take this precaution, a malicious HTML page could source
scripting pseudo-protocol. If your ActionScript code were to call getURL
site serving the malicious HTML page to obtain the contents of your HTTP
cookies or perform other actions on your site's behalf."
The vulnerability was reported by Scan Security Wire
The information in this bulletin is provided "AS IS" without warranty of
In no event shall we be liable for any damages whatsoever including
direct, indirect, incidental, consequential, loss of business profits or
Full-Disclosure is hosted and sponsored by Secunia.