I just took a look and there appear to be some risks associated with this vulnerability.
If you log in to Posterous and check the "Remember me" box, it sets a cookie scoped to .posterous.com (which means it's within the scope of this XSS). That cookie does not have the HttpOnly flag set, which means it can be accessed via Javascript. I'm not sure whether the auth_token cookie has any protections against session hijacking (ie: if it's restricted to the IP that was used to log in). If it doesn't, you can steal the cookie and log in as a user.
Outside of that, the site appears to use a cookie called _sharebymail_session_id, which is scoped the same as auth_token but which is marked HttpOnly, which means it can't be accessed directly via Javascript.
In order to really exploit this vulnerability, you would need to find a way to send requests to and read responses from posterous.com, the root domain, since that's where all the functionality is defined.
Comments
I just took a look and there appear to be some risks associated with this vulnerability.
If you log in to Posterous and check the "Remember me" box, it sets a cookie scoped to .posterous.com (which means it's within the scope of this XSS). That cookie does not have the HttpOnly flag set, which means it can be accessed via Javascript. I'm not sure whether the auth_token cookie has any protections against session hijacking (ie: if it's restricted to the IP that was used to log in). If it doesn't, you can steal the cookie and log in as a user.
Outside of that, the site appears to use a cookie called _sharebymail_session_id, which is scoped the same as auth_token but which is marked HttpOnly, which means it can't be accessed directly via Javascript.
In order to really exploit this vulnerability, you would need to find a way to send requests to and read responses from posterous.com, the root domain, since that's where all the functionality is defined.