It's basically a bug in Flash. It works like this:
Attacker hosts a flash file, which attempts a cross-domain request to a server controlled by the attacker.
Flash checks crossdomain.xml on the attacker-controlled server. It says "Allow everything". Flash makes the request to the attacker-controlled server.
Server issues a 307 redirect to a www.victim.com that manipulates the user's account in a malicious way. The particular manipulation depends on what www.victim.com does, but changing the e-mail address to spoof the automated password recovery system would be a common one.
Flash does not check the crossdomain.xml on www.victim.com.
The attacker has now manipulated the user's account on www.victim.com in a malicious way.
Attacker hosts a flash file, which attempts a cross-domain request to a server controlled by the attacker.
Flash checks crossdomain.xml on the attacker-controlled server. It says "Allow everything". Flash makes the request to the attacker-controlled server.
Server issues a 307 redirect to a www.victim.com that manipulates the user's account in a malicious way. The particular manipulation depends on what www.victim.com does, but changing the e-mail address to spoof the automated password recovery system would be a common one.
Flash does not check the crossdomain.xml on www.victim.com.
The attacker has now manipulated the user's account on www.victim.com in a malicious way.