A vulnerability in the TRUSTe seal verification service was demonstrated last week, showing how the service could have been exploited to make it look as though an unauthorised site had a valid TRUSTe seal.

A security researcher using the pseudonym “Antani Tapioco” discovered the problem, which stemmed from insufficient input validation on the TRUSTe seal validation page. Netcraft has reported the problem to TRUSTe and it has since been fixed.

Tapioco demonstrated how JavaScript could be injected into the page, causing a popup dialog box to display the message “Verified by haxors, LOL”. Tapioco was further critical of the ease at which the flaw was found, saying that companies should spend money on code reviews and penetration tests to discover such problems before they become an issue.

Tapioco was able to execute JavaScript on the page by injecting an img tag with an invalid src parameter. The JavaScript payload, specified in the onerror handler, was then subsequently executed. This kind of vulnerability on a page like this has the potential to be very harmful – being able to inject arbitrary JavaScript can allow attackers to remove all existing content from the page and replace it with their own content.