Was it an auto-reply?

Was it an auto-reply?

After two months, hi5 finally replied to one of my emails. I can't really qualify the kind of email, from amusing to plain stupid. Maybe they're just joking with me.. But better to show you the email.

From: "hi5 support" <support@hi5.com>
Subject: Re: XSS vunerability in hi5
To: "Paulo Abrantes" address removed
Date: Thu, 23 Mar 2006 20:59:34 +0500
User-Agent: Neotonic Trakken/2.13.4

Hello,

Thanks for writing hi5!

Thanks for your suggestions! We love hearing from our members how we can make hi5 even better - our members know best! Currently, this feature is not available on hi5, but we will definitely consider adding it.

Let us know if you have any other ideas, questions or comments.

Sincerely,
Clinton - hi5 Support

Now...let's see if I understood, they will definatly consider adding XSS vunerability has a feature… AHHH!! So that's why they aren't fixing the bug that persists for 2 months. Ok… It seems they have a similar philosophy to Microsoft, it's not a bug but a feature… oh well.

Since I don't want to leave you out of context, below follows the 1st email I sent to hi5 support, which was the one that got replied.

From: Paulo Abrantes address removed
Subject: XSS vunerability in hi5
Date: Sun, 15 Jan 2006 17:38:19 +0000

Hello, I hope I'm writting for the right email, otherwise please forward this to the developing team of hi5.

I'm reporting a XSS problem withing your pages. I've sucessfully managed to inject javascript inside and <img> via events, such as onMouseOver or onError. Currently I've setted up a proof of concept page, inside my profile at:

http://www.hi5.com/friend/profile/displayProfile.do?userid=8563539

It will automatically redirect the users to a fake login request and the print the information to them. NO INFORMATION IS BEING STORED! This is not a hacking attempt into other users account, only a simple proof of concept. More ellaborated spoofing, or any other kind of attacks, like infite loops with alerts to crash browser, cookie stealing, etc can be achieve via this method.

I've found this problem yesterday when I saw that you are allowing certain html tags, I wrote a feedback explaining the problem but today I thought in writting to this email also.

I've also published this problem in my blog, in the 14th january and 15th january, which can be found at http://pabrantes.dyndns.org/blog/

My best regards,

Paulo Abrantes

I think I'm being explicit that there is a problem, and actually, I'm painting a really drastic scenario so they would do something. But I got that reply… So I guess it was just an auto-reply, but in order to not leave the impression that was an auto-reply they delay the email reply...for 2 months.