Digg actually had a similar problem a few years ago with pbwiki running on a subdomain:
Careful when hosting 3rd party apps on subdomains, or how I hacked Facebook
11–13 of 13 posts
Re: Careful when hosting 3rd party apps on subdomains, or how I hacked Facebook
#12Earlier quoted context omitted.
It would be helpful to elaborate on: * what document.domain is * what hijacking user's session actually implies
I know what hijacking a user's session is, what is document.domain though?
This is a good overview: https://developer.mozilla.org/en/document.domain
Re: Careful when hosting 3rd party apps on subdomains, or how I hacked Facebook
#13Thought it was well written. Would like to see a bit more focus on risk i.e. liklihood and impact explored a bit more.
On specific vulnerabilities like this I like the CVE format: e.g. http://www.securityfocus.com/bid/38615/info
information / background, exploit, solution, then some discussion on risk