[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[FD] Bugcrowd Bug Bounty #7 - Persistent Web Vulnerability

Document Title:
===============
Bugcrowd Bug Bounty #7 - Persistent Web Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1830

ID: b40f63ed19074014df808599e44684f6a18bb6f4f51cf21948ef78df2f56c13b


Release Date:
=============
2016-05-10


Vulnerability Laboratory ID (VL-ID):
====================================
1830


Common Vulnerability Scoring System:
====================================
3.8


Product & Service Introduction:
===============================
From the outback to the valley, Bugcrowd is paving the way for crowdsourced 
security. Founded in 2012 in Australia by 
Casey Ellis, Bugcrowd is now based in San Francisco and is backed by Costanoa 
Venture Capital, Rally Ventures, Paladin Capital 
Group and Blackbird Ventures.

(Copy of the Homepage: https://bugcrowd.com/about )


Abstract Advisory Information:
==============================
The vulnerability laboratory research team discovered an application-side 
vulnerability in the official Bugcrowd online service web-application.


Vulnerability Disclosure Timeline:
==================================
2016-04-20: Researcher Notification & Coordination (Benjamin Kunz Mejri - 
Evolution Security GmbH)
2016-04-21: Vendor Notification (Bugcrowd - Bug Bounty Program)
2016-**-**: Vendor Fix/Patch (Bugcrowd - Bug Bounty Program)
2016-05-03: Acknowledgement & Bug Bounty (Bugcrowd - Bug Bounty Program)
2016-05-10: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Bugcrowd
Product: Online Service - Web Application 2016 Q2


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
A persistent script code injection and application-side mail encode web 
vulnerability has been discovered in the official Bugcrowd online service 
web-application.
The vulnerability typ allows an attacker to inject own malicious script code to 
the application-side of the vulnerable service function or web modules context.

The bugcrowd service allows to register by a web formular in the webpage to 
receive new information like "... Bugcrowd`s Next Chapter". In the name values 
attackers 
are able to inject malicious script codes. In an advisory send to bugcrowd 
about 1 year ago we already mentioned the problem but your team was not able to 
verify 
the bug finally. Thus time we exploited the bug by using casey ellis wrong 
encoded context of the bugcrowd registered users to stream the code with the 
service emails. 
The injection point is the formular registration for receiving information of 
bugcrowd and the execution point is the email body context with the broken 
encode values. 
The code directly executes after the arrival in the main body context and the 
sender of the email was the mail support@bugcrowd inbox.

The security risk of the application-side cross site web vulnerability is 
estimated as medium with a cvss (common vulnerability scoring system) count of 
3.7. 
Exploitation of the persistent input validation web vulnerability requires a 
low privileged web-application user account and low or medium user interaction. 
Successful exploitation of the vulnerability results in session hijacking, 
persistent phishing attacks, persistent external redirects to malicious source 
and 
persistent manipulation of affected or connected application modules.

Request Method(s):
                                [+] POST

Vulnerable Parameter(s):
                                [+] Firstname
                                [+] Lastname
                                [+] Companyname

Affected Module(s):
                                [+] Email Community Letter - 
(community@xxxxxxxxxxxx)


Proof of Concept (PoC):
=======================
The security vulnerability can be exploited by remote attackers without user 
interaction or privileged web-application user account.
For security demonstration or to reproduce the vulnerability follow the 
provided information and steps below to continue.


PoC: Email: We've raised money, here's what's next from Bugcrowd 
(community@xxxxxxxxxxxx) - Casey Ellis
<p style="margin-bottom: 1em; -webkit-text-size-adjust:100%; 
-ms-text-size-adjust:100%">Hi&nbsp;"&gt;<[PERSISTENT INJECTED SCRIPT CODE 
EXECUTION!]&quot;)" <="" "="">&amp;lt;iframe src=a onload=alert("PENTEST") 
&amp;lt;,&amp;lt;/p&amp;gt;
&amp;lt;p style="margin-bottom: 1em; -webkit-text-size-adjust:100%; 
-ms-text-size-adjust:100%"&amp;gt;As you may have&amp;amp;nbsp;already heard, 
this morning we &amp;lt;a 
href="https://bugcrowd.com/resources/bugcrowd-15-million-raises-series-b"; 
style="-webkit-text-size-adjust:100%; -ms-text-size-adjust:100%" 
data-hs-link-id="0"&amp;gt;announced 
our $15M Series B funding&amp;lt;/a&amp;gt;. We're proud to have many of our 
previous investors joining us again, as well as pleased to welcome new 
investors to the family.
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;We couldn't have done this without you. 
With your help we've built a massive&amp;amp;nbsp;community of hackers, made up 
of diverse and 
talented folks from all over the 
world.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;We've got lots of plans for what's 
next and I've shared those details on our blog. Please check 
it out to learn 
more.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&amp;lt;strong&amp;gt;&amp;lt;a 
href="https://blog.bugcrowd.com/15-million-to-connect-hackers-and-companies-bugcrowd-series-b";
 
style="-webkit-text-size-adjust:100%; -ms-text-size-adjust:100%" 
data-hs-link-id="1"&amp;gt;Read about our plans for Bugcrowd's next 
chapter&amp;lt;/a&amp;gt;.&amp;lt;/strong&amp;gt;
&amp;lt;/p&amp;gt;&amp;lt;p style="margin-bottom: 1em; 
-webkit-text-size-adjust:100%; -ms-text-size-adjust:100%"&amp;gt;Thank you 
joining us on this journey. There's so much more to come!
We hope you'll &amp;lt;a 
href="https://twitter.com/Bugcrowd/status/722904657366884353"; 
style="-webkit-text-size-adjust:100%; -ms-text-size-adjust:100%" 
data-hs-link-id="0"&amp;gt;join us 
today in our celebration&amp;lt;/a&amp;gt; of this Bugcrowd community 
milestone.&amp;lt;/p&amp;gt;
&amp;lt;p style="margin-bottom: 1em; -webkit-text-size-adjust:100%; 
-ms-text-size-adjust:100%"&amp;gt;Sincerely,&amp;lt;/p&amp;gt;
&amp;lt;p style="margin-bottom: 1em; -webkit-text-size-adjust:100%; 
-ms-text-size-adjust:100%"&amp;gt;Casey Ellis&amp;lt;br&amp;gt;Bugcrowd Founder 
&amp;amp;amp; CEO&amp;lt;/p&amp;gt;&amp;lt;/div&amp;gt;


Solution - Fix & Patch:
=======================
The vulnerability can be patched by a secure parse and encode of the vulnerable 
firstname, lastname and company values in the add POST method request.
Disallow the usage of special chars in the name values, encode the inputs as 
well to prevent further exploitation.
Encode as well outgoing emails to ensure that no malicious script code 
injection can take place with application-side attack vector.


Security Risk:
==============
The security risk of the filter bypass issue and application-side arbitrary 
script code injection web vulnerability is estimated as medium. (CVSS 3.8)


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri 
(research@xxxxxxxxxxxxxxxxxxxxx) [www.vulnerability-lab.com] 
[http://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any 
warranty. Vulnerability Lab disclaims all warranties, either expressed or 
implied, 
including the warranties of merchantability and capability for a particular 
purpose. Vulnerability-Lab or its suppliers are not liable in any case of 
damage, 
including direct, indirect, incidental, consequential loss of business profits 
or special damages, even if Vulnerability-Lab or its suppliers have been 
advised 
of the possibility of such damages. Some states do not allow the exclusion or 
limitation of liability for consequential or incidental damages so the 
foregoing 
limitation may not apply. We do not approve or encourage anybody to break any 
licenses, policies, deface websites, hack into databases or trade with stolen 
data.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com              
                                - www.evolution-sec.com
Contact:    admin@xxxxxxxxxxxxxxxxxxxxx         - 
research@xxxxxxxxxxxxxxxxxxxxx                                - 
admin@xxxxxxxxxxxxxxxxx
Section:    magazine.vulnerability-lab.com      - 
vulnerability-lab.com/contact.php                             - 
evolution-sec.com/contact
Social:     twitter.com/vuln_lab                - facebook.com/VulnerabilityLab 
                                - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - 
vulnerability-lab.com/rss/rss_upcoming.php                    - 
vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php    - 
vulnerability-lab.com/list-of-bug-bounty-programs.php         - 
vulnerability-lab.com/register.php

Any modified copy or reproduction, including partially usages, of this file 
requires authorization from Vulnerability Laboratory. Permission to 
electronically 
redistribute this alert in its unmodified form is granted. All other rights, 
including the use of other media, are reserved by Vulnerability-Lab Research 
Team or 
its suppliers. All pictures, texts, advisories, source code, videos and other 
information on this website is trademark of vulnerability-lab team & the 
specific 
authors or managers. To record, list, modify, use or edit our material contact 
(admin@ or research@xxxxxxxxxxxxxxxxxxxxx) to get a ask permission.

                                    Copyright © 2016 | Vulnerability Laboratory 
- [Evolution Security GmbH]™

-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/