[FD] Script Injection Vulnerability Remediated

[Scott Baker via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

A script injection vulnerability was discovered by a penetration tester hired 
by Prosper and later by a security professional. Thanks to Paul O’Neil at 
CyberScout for his responsible disclosure and assistance in confirming this 
vulnerability.



For the attack to be successful, the attacker needed to be logged into 
prosper.com<https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fprosper.com%2F&data=02%7C01%7Csbaker%40prosper.com%7C7b23dc89e8394767025f08d7befc24a0%7C924fb1d22d664b62aeca6517836f3b2f%7C1%7C0%7C637187862469813924&sdata=g7V%2ByRdKPP3UNH%2Fqr0XLa%2FvAlqGoMT4StOEsHCtB%2FsY%3D&reserved=0>
 and could potentially save scripts that would run against their account.   The 
Prosper information security team checked the database for persisted attacks 
and detected some benign proof of concepts.  Monitoring alerts were created to 
detect further attacks. Developers then implemented input validation to prevent 
further attacks from being saved to the database.  Encoding was added as a 
defense in depth measure such that saved attacks would not work. In addition, 
Prosper has enabled Content Security Policy headers site-wide to whitelist 
domains that are approved for use in the context of our site.



Scott Baker

Director, Information Security

[/var/folders/pp/z1x004w566s7p31cjl2505shtvw7m0/T/com.microsoft.Outlook/WebArchiveCopyPasteTempFiles/cidimage001.png@01D3CA8A.F07D7DD0]

221 Main Street, Suite 300

San Francisco, CA 94105





CONFIDENTIALITY STATEMENT: This email message, together with all attachments, 
is intended only for the individual or entity to which it is addressed and may 
contain legally privileged or confidential information. Any dissemination, 
distribution or copying of this communication by persons or entities other than 
the intended recipient, is strictly prohibited, and may be unlawful. If you 
have received this communication in error please contact the sender immediately 
and delete the transmitted material and all copies from your system, or if 
received in hard copy format, return the material to us via the United States 
Postal Service. Thank you.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/