We received an email from Google today regarding a security issue in Google Website Optimizer, see below:

“Dear Website Optimiser user,
We are writing to inform you of a potential security issue with Website Optimiser. By exploiting a vulnerability in the Website Optimiser Control Script, an attacker might be able to execute malicious code on your site using a Cross-Site Scripting (XSS) attack. This attack can only take place if a website or browser has already been compromised by a separate attack. While the immediate probability of this attack is low, we urge you to take action to protect your site.”

The letter goes on to say that they have fixed the bug and that no new experiments are susceptible, but any old experiments that were created before 3rd December 2010 are.

I wonder how many people’s experiments will be destroyed if they stop them before they are conclusive – some experiments could feasibly go on for months to get enough data to provide an accurate picture.

This is slightly worrying, how long has this cross-site scripting vulnerability been present? How many websites are likely to have been affected by this?

Is it a good idea announcing this if people are running experiments that they NEED to keep running?

Creating a New Experiment

1. Stop any currently running Website Optimiser experiments
2. Remove all the Website Optimiser scripts from your site
3. Create a new experiment as normal. New experiments are not vulnerable.

Updating the Website Optimizer Control Script Directly

1. Locate the Control Script on your site. It looks like this:

A/B Test Control Script
<!-- Google Website Optimiser Control Script -->
<script>
function utmx_section(){}function utmx(){}
(function(){var k='XXXXXXXXXX',d=document,l=d.location,c=d.cookie;function f(n){
if(c){var i=c.indexOf(n+'=');if(i>-1){var j=c.indexOf(';',i);return c.substring(i+n.
length+1,j<0?c.length:j)}}}var x=f('__utmx'),xx=f('__utmxx'),h=l.hash;
d.write('<sc'+'ript src="'+
'http'+(l.protocol=='https:'?'s://ssl':'://www')+'.google-analytics.com'
+'/siteopt.js?v=1&utmxkey='+k+'&utmx='+(x?x:'')+'&utmxx='+(xx?xx:'')+'&utmxtime='
+new Date().valueOf()+(h?'&utmxhash='+escape(h.substr(1)):'')+
'" charset="utf-8"></sc'+'ript>')})();
</script><script>utmx("url",'A/B');</script>
<!-- End of Google Website Optimizer Control Script -->

Multivariate Test Control Script
<!-- Google Website Optimizer Control Script -->
<script>
function utmx_section(){}function utmx(){}
(function(){var k='XXXXXXXXXX',d=document,l=d.location,c=d.cookie;function f(n){
if(c){var i=c.indexOf(n+'=');if(i>-1){var j=c.indexOf(';',i);return c.substring(i+n.
length+1,j<0?c.length:j)}}}var x=f('__utmx'),xx=f('__utmxx'),h=l.hash;
d.write('<sc'+'ript src="'+
'http'+(l.protocol=='https:'?'s://ssl':'://www')+'.google-analytics.com'
+'/siteopt.js?v=1&utmxkey='+k+'&utmx='+(x?x:'')+'&utmxx='+(xx?xx:'')+'&utmxtime='
+new Date().valueOf()+(h?'&utmxhash='+escape(h.substr(1)):'')+
'" charset="utf-8"></sc'+'ript>')})();
</script>
<-- End of Google Website Optimizer Control Script -->

2. Locate the following in the Control Script: return c.substring(...
3. Modify the following line as shown:
   BEFORE: return c.substring(i+n.length+1,j<0?c.length:j)
   FIXED: return escape(c.substring(i+n.length+1,j<0?c.length:j))
   Make sure to include the final closing brackets “)”

Fixed A/B Control Script
<!-- Google Website Optimizer Control Script -->
<script>
function utmx_section(){}function utmx(){} (function(){var k='XXXXXXXXXX',d=document,l=d.location,c=d.cookie;function f(n){ if(c){var i=c.indexOf(n+'=');if(i>-1){var j=c.indexOf(';',i);
return escape(c.substring(i+n.length+1,j<0?c.length:j))}}}
var x=f('__utmx'),xx=f('__utmxx'),h=l.hash; d.write('<sc'+'ript src="'+
'http'+(l.protocol=='https:'?'s://ssl':'://www')+'.google-analytics.com'
+'/siteopt.js?v=1&utmxkey='+k+'&utmx='+(x?x:'')+'&utmxx='+(xx?xx:'')+'&utmxtime='
+new Date().valueOf()+(h?'&utmxhash='+escape(h.substr(1)):'')+
'" charset="utf-8"></sc'+'ript>')})();
</script><script>utmx("url",'A/B');
</script>
<-- End of Google Website Optimizer Control Script -->

Fixed Multivariate Control Script
<!-- Google Website Optimizer Control Script -->
<script>
function utmx_section(){}function utmx(){}
(function(){var k='XXXXXXXXXX',d=document,l=d.location,c=d.cookie;function f(n){
if(c){var i=c.indexOf(n+'=');if(i>-1){var j=c.indexOf(';',i);
return escape(c.substring(i+n.length+1,j<0?c.length:j))}}}
var x=f('__utmx'),xx=f('__utmxx'),h=l.hash; d.write('<sc'+'ript src="'+
'http'+(l.protocol=='https:'?'s://ssl':'://www')+'.google-analytics.com'
+'/siteopt.js?v=1&utmxkey='+k+'&utmx='+(x?x:'')+'&utmxx='+(xx?xx:'')+'&utmxtime='
+new Date().valueOf()+(h?'&utmxhash='+escape(h.substr(1)):'')+
'" charset="utf-8"></sc'+'ript>')})();
</script>
<-- End of Google Website Optimizer Control Script -->

Note that the k=XXXXXXXXX line in the above Control Script examples is a placeholder.

Your experiment will continue as normal after you’ve made this update. There’s no need to pause or restart the experiment.

We’re committed to keeping Website Optimiser secure, and we’re deeply sorry for this issue. We will continue to work hard to prevent future vulnerabilities.