XSS Ebuddy (responsible disclosure)

[Rener Silva <rener@xxxxxxxxxxxxx>]

Early this morning, the security group Virtual Luminous published a
vulnerability in 'Ebuddy Web Messenger' and we would like to inform
you that this vulnerability had been discovered and reported to the
vendor on June 5th, 2011 by DcLabs Security Research Group.

In the report below you are going to find videos and references to the
date when the POC was sent to the vendor and the follow up regarding
the timeline for the release.
- Ocultar texto das mensagens anteriores -

[Discussion]

- DcLabs Security Research Group advises about the following vulnerability(ies):

[Software]

- eBuddy Windows Live Messenger (web)

[Vendor Product Description]

- eBuddy is a privately-held company which owns a browser-based web
and mobile messenger service supporting various instant messaging
services. eBuddy was launched in 2003 under the name e-Messenger,
located at www.e-messenger.net, before re-branding itself in 2006 to
eBuddy.

- eBuddy supports Windows Live Messenger, Yahoo! Messenger, AIM, ICQ,
Google Talk, MySpace Instant Messenger and Facebook Chat using one
interface. eBuddy can also be accessed from mobile platforms such as
iOS, Nokia Symbian and Android.
- Site: http://www.ebuddy.com

[Advisory Timeline]

- 05/06/2011 -> The bug was found;
- 06/06/2011 -> First Contact requesting security department contact;
- 06/06/2011 -> Vendor responded;
- 09/06/2011 -> Advisory sent to vendor;
- 15/06/2011 -> A demo movie sent to vendor showing how to exploit the
flaw;
- 17/06/2011 -> Vendor developing a new version;
- 27/06/2011 -> Vendor fix the initial bug;
- 28/06/2011 -> The application remains vulnerable and a new alert is
sent to the vendor;
- 30/06/2011 -> The vendor requested a new demo movie;
- 05/07/2011 -> A new demo movie sent to vendor showing how to exploit
the flaw; (http://www.youtube.com/watch?v=Kl-ahz4Kasg)
- No vendor reply
- 15/07/2011 -> Notification send to vendor requesting a status about
progress of fix;
- No vendor reply
- 01/08/2011 -> Other notification sent to vendor;
- 02/08/2011 -> Vendor responded (bug not patched);
- 31/08/2011 -> Vendor was advised of the publication release;
- 02/09/2011 -> Advisory Published.


[Bug Summary]

- The lack of input validation on the sub-nick and textarea field for
- Ocultar texto das mensagens anteriores -
Windows Live Messenger allows attackers to bypass client-side security
mechanisms normally imposed on web content by modern browsers. An
attacker can gain elevated access privileges to sensitive
page-content, session cookies, and a variety of other information
maintained by the browser on behalf of the user.

[Impact]

- High

[Affected Version]

- Ebuddy Windows Live Messenger;
- Other products may also be vulnerable;

[Bug Description and Proof of Concept]

- Exploiting the HTML-injection issue allows an attacker to execute
HTML and Java Script code in the remote user context to steal
cookie-based authentication credentials or to control how the site is
rendered to the user; other attacks may also be possible.

- Moreover, Cross Site Scripting (XSS) vulnerabilities are caused due
to lack of input validation. This allows malicious people to inject
arbitrary HTML and script code. More info at:
http://en.wikipedia.org/wiki/Cross-site_scripting

All flaws described here were discovered and researched by:

Rêner Alberto aka Gr1nch.
DcLabs Security Research Group
gr1nch (at) dclabs <dot> com <dot> br

[Patch(s) / Workaround]

N/A

[Greetz]
DcLabs Security Research Group.