Cross site scripting (XSS) Gmail vulnerability
According to Tech Reads [via], Gmail users who are currently logged into their accounts who follow a unique URL can expose their entire contacts list (without even knowing).
Using a form of cross scripting, it becomes easy to steal a GMail user’s contact list if they visit a certain type of website. The only condition is you have to be logged in to GMail at the time of the attack. GMail is setup to store your contact list in javascript files, which is the core problem. If you log into your GMail account, and click here [see link below], you’ll see your contact’s details, along with their email.
Thanks to a little cross site scripting (XSS), anyone who visits the following URL below can view their entire contacts list outside of Gmail. Image the implications of such a privacy hole if email harvesters created a site which exploited such a hole for profit?
http://googlified.com.googlepages.com/contactlist.htm
I’ve tested the the above URL on a few dummy accounts in Safari, Opera, Firefox, and IE6/7 and the script does indeed display contact email addresses (if previously logged into Gmail).
UPDATE: Long time friend of the site Ferny B has modified the script to work again (We have mirrored a copy of the script here)
