Web Cabinet @webcabinet - Tumblr Blog

Daily mail Registration Page Unvalidated Redirects and Forwards & XSS Web Security Problem

Website Description: “The Daily Mail is a British daily middle-market tabloid newspaper owned by the Daily Mail and General Trust. First published in 1896 by Lord Northcliffe, it is the United Kingdom’s second biggest-selling daily newspaper after The Sun. Its sister paper The Mail on Sunday was launched in 1982. Scottish and Irish editions of the daily paper were launched in 1947 and 2006 respectively. The Daily Mail was Britain’s first daily newspaper aimed at the newly-literate “lower-middle class market resulting from mass education, combining a low retail price with plenty of competitions, prizes and promotional gimmicks”, and was the first British paper to sell a million copies a day. It was at the outset a newspaper for women, the first to provide features especially for them, and as of the second-half of 2013 had a 54.77% female readership, the only British newspaper whose female readers constitute more than 50% of its demographic. It had an average daily circulation of 1,708,006 copies in March 2014. Between July and December 2013 it had an average daily readership of approximately 3.951 million, of whom approximately 2.503 million were in the ABC1 demographic and 1.448 million in the C2DE demographic. Its website has more than 100 million unique visitors per month.” (Wikipedia)

One of its website’s Alexa rank is 93 on January 01 2015. The website is one of the most popular websites in the United Kingdom.

The Unvalidated Redirects and Forwards problem has not been patched, while the XSS problem has been patched.

(1) Daily mail Registration Page Unvalidated Redirects and Forwards Web Security Problem

(1.1) Vulnerability Description: Daily online websites have a cyber security problem. Hacker can exploit it by Open Redirect (Unvalidated Redirects and Forwards) attacks. During the tests, all Daily mail websites (Daily Mail, Mail on Sunday & Metro media group) use the same mechanism. These websites include dailymail.co.uk, thisismoney.co.uk, and mailonsunday.co.uk.

Google Dork: “Part of the Daily Mail, The Mail on Sunday & Metro Media Group”

The vulnerability occurs at “&targetUrl” parameter in “logout.html?” page, i.e. http://www.dailymail.co.uk/registration/logout.html?targetUrl=http%3A%2F%2Fgoogle.com

(1.1.1) Use the following tests to illustrate the scenario painted above.

The redirected webpage address is “http://diebiyi.com/articles“. Can suppose that this webpage is malicious.

Vulnerable URLs: http://www.dailymail.co.uk/registration/logout.html?targetUrl=http%3A%2F%2Fdailymail.co.uk http://www.thisismoney.co.uk/registration/logout.html?targetUrl=http%3A%2F%2Fhao123.com/ http://www.mailonsunday.co.uk/registration/logout.html?targetUrl=http%3A%2F%2Fpinterest.com

POC Code: http://www.dailymail.co.uk/registration/logout.html?targetUrl=http%3A%2F%2Fdiebiyi.com/articles http://www.thisismoney.co.uk/registration/logout.html?targetUrl=http%3A%2F%2Fdiebiyi.com/articles http://www.mailonsunday.co.uk/registration/logout.html?targetUrl=http%3A%2F%2Fdiebiyi.com/articles

POC Video: https://www.youtube.com/watch?v=AU-HJGe5BWE&feature=youtu.be

Blog Details: http://tetraph.com/security/website-test/daily-mail-url-redirection/ http://securityrelated.blogspot.com/2015/10/daily-mail-registration-page.html

(1.1.2) The program code flaw can be attacked without user login. Tests were performed on Microsoft IE (9 9.0.8112.16421) of Windows 8, Mozilla Firefox (37.0.2) & Google Chromium 42.0.2311 (64- bit) of Ubuntu (14.04.2)，and Apple Safari 6.1.6 of Mac OS X v10.9 Mavericks.

These bugs were found by using URFDS (Unvalidated Redirects and Forwards Detection System).

(1.2) Description of Open Redirect: Here is the description of Open Redirect: “A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance.” (From CWE)

(1.3) Vulnerability Disclosure: These vulnerabilities have not been patched.

(2) Daily Mail Website XSS Cyber Security Zero-Day Vulnerability

(2.1) Vulnerability description: DailyMail has a security problem. Criminals can exploit it by XSS attacks.

The vulnerability occurs at “reportAbuseInComment.html?” page with “&commentId” parameter, i.e. http://www.dailymail.co.uk/home/reportAbuseInComment.html?articleId=346288&commentId=877038

POC Code: http://www.dailymail.co.uk/home/reportAbuseInComment.html?articleId=346288&commentId=”><img src=x onerror=prompt(‘justqdjing’)>

The vulnerability can be attacked without user login. Tests were performed on Mozilla Firefox (34.0) in Ubuntu (14.04) and Microsoft IE (9.0.15) in Windows 7

Poc Video: https://www.youtube.com/watch?v=Oig-ZrlJDf8&feature=youtu.be

Blog Detail: http://tetraph.com/security/web-security/daily-mail-xss-bug/ http://securityrelated.blogspot.com/2015/10/daily-mail-online-website-xss-cyber.html

(2.2) What is XSS? “Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side script into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. Cross-site scripting carried out on websites accounted for roughly 84% of all security vulnerabilities documented by Symantec as of 2007. Their effect may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site’s owner.” (Wikipedia)

(2.3) Vulnerability Disclosure: This vulnerability has been patched.

Blog Details: http://tetraph.com/security/website-test/daily-mail-open-redirect-xss/ http://securityrelated.blogspot.com/2015/10/daily-mail-url-redirection-and-xss-bug.html https://vulnerabilitypost.wordpress.com/2015/10/30/daily-mail-url-redirect-xss/

Discover and Reporter: Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing) http://www.tetraph.com/wangjing

Reference: http://permalink.gmane.org/gmane.comp.security.fulldisclosure/2643 http://lists.openwall.net/full-disclosure/2015/11/03/8 https://infoswift.wordpress.com/2015/11/02/daily-mail-xss/ http://frenchairing.blogspot.com/2015/11/daily-mail-xss-bug.html https://cxsecurity.com/issue/WLB-2015110028 https://www.mail-archive.com/fulldisclosure%40seclists.org/msg02683.html https://progressive-comp.com/?l=full-disclosure&m=144651836427184&w=1 http://whitehatpost.lofter.com/post/1cc773c8_8d458d1 http://ithut.tumblr.com/post/132724992778/daily-mail-xss https://biyiniao.wordpress.com/2015/11/03/daily-mail-xss/ http://seclists.org/fulldisclosure/2015/Nov/7 http://japanbroad.blogspot.com/2015/11/daily-mail-xss.html

#Daily Mail #xss #open redirect #urf #lofter #tumblr #blogspot #justqdjing #mail archive #wordpress #openwall #gmane #SPMS #NTU #Hacker

whitehatview

TeleGraph All Photo (Picture) Pages Have Been Vulnerable to XSS Cyber Attacks

Website Description: http://www.telegraph.co.uk

“The Daily Telegraph is a British daily morning English-language broadsheet newspaper, published in London by Telegraph Media Group and distributed throughout the United Kingdom and internationally. The newspaper was founded by Arthur B. Sleigh in June 1855 as The Daily Telegraph and Courier, and since 2004 has been owned by David and Frederick Barclay. It had a daily circulation of 523,048 in March 2014, down from 552,065 in early 2013. In comparison, The Times had an average daily circulation of 400,060, down to 394,448. The Daily Telegraph has a sister paper, The Sunday Telegraph, that was started in 1961, which had circulation of 418,670 as of March 2014. The two printed papers currently are run separately with different editorial staff, but there is cross-usage of stories. News articles published in either, plus online Telegraph articles, may also be published on the Telegraph Media Group’s www.telegraph.co.uk website, all under The Telegraph title.” (From Wikipedia)

(1) Vulnerability Description: Telegraph has a Web security bug problem. It is vulnerable to XSS attacks. In fact, all its photo pages are vulnerable to XSS (Cross-Site Scripting) vulnerabilities. Telegraph’s picture pages use “&frame” as its parameter. All its web pages use “&frame” are vulnerable to the bugs. Those vulnerabilities have been patched now.

Examples of Vulnerable Links: http://www.telegraph.co.uk/culture/culturepicturegalleries/10663967/The-worlds-most-spectacular-theatres.html?frame=2836095

http://www.telegraph.co.uk/property/investmentinproperty/10609314/For-sale-top-20-properties-ripe-for-investment.html?frame=2808162

http://www.telegraph.co.uk/foodanddrink/foodanddrinkpicturegalleries/9737226/Elephant-dung-coffee-Black-Ivory-beans-passed-through-the-animals-guts.html?frame=2424280

http://www.telegraph.co.uk/education/9487434/Graduate-jobs-Best-languages-to-study.html?frame=2314790

http://www.telegraph.co.uk/motoring/picturegalleries/10782171/The-20-best-cars-to-own-in-2014.html?frame=2890278

POC Code: http://www.telegraph.co.uk/culture/culturepicturegalleries/10663967/The-worlds-most-spectacular-theatres.html?frame=2836095“><img src=x onerror=prompt(‘justqdjing’)>

http://www.telegraph.co.uk/property/investmentinproperty/10609314/For-sale-top-20-properties-ripe-for-investment.html?frame=2808162”><img src=x onerror=prompt(‘justqdjing’)>

http://www.telegraph.co.uk/foodanddrink/foodanddrinkpicturegalleries/9737226/Elephant-dung-coffee-Black-Ivory-beans-passed-through-the-animals-guts.html?frame=2424280“><img src=x onerror=prompt(‘justqdjing’)>

http://www.telegraph.co.uk/education/9487434/Graduate-jobs-Best-languages-to-study.html?frame=2314790”><img src=x onerror=prompt('justqdjing’)>

http://www.telegraph.co.uk/motoring/picturegalleries/10782171/The-20-best-cars-to-own-in-2014.html?frame=2890278“><img src=x onerror=prompt('justqdjing’)>

The vulnerability can be attacked without user login. Tests were performed on Firefox (37.02) in Ubuntu (14.04) and IE (8.0. 7601) in Windows 7. The bugs found by using CSXDS.

(2) XSS Description: The description of XSS is: “Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.” (OWSAP)

Poc Video: https://www.youtube.com/watch?v=SqjlabJ1OzA&feature=youtu.be

Blog Details: http://www.tetraph.com/security/website-test/telegraph-xss/ http://securityrelated.blogspot.com/2015/10/telegraph-xss-0day.html https://vulnerabilitypost.wordpress.com/2015/10/30/telegraph-bug/

(3) Vulnerability Disclosure: Those vulnerabilities are patched now.

Discoved and Disclosured By: Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing) http://www.tetraph.com/wangjing

References: http://lists.openwall.net/full-disclosure/2015/11/03/7 http://permalink.gmane.org/gmane.comp.security.fulldisclosure/2642 http://russiapost.blogspot.com/2015/11/telegraph-xss.html https://itinfotechnology.wordpress.com/2015/11/01/telegraph-xss/ https://www.mail-archive.com/fulldisclosure%40seclists.org/msg02682.html https://cxsecurity.com/issue/WLB-2015110023 http://marc.info/?l=full-disclosure&m=144651821527165&w=4 http://germancast.blogspot.com/2015/11/telegraph-xss.html http://itsecurity.lofter.com/post/1cfbf9e7_8d3ea9e http://whitehatview.tumblr.com/post/132723700196/telegraph-xss https://itswift.wordpress.com/2015/11/02/telegraph-xss/ http://seclists.org/fulldisclosure/2015/Nov/4

#telegraph #xss #bug #attack #justqdjing #web application #website #england #UK #tetraph #inzeed #diebiyi #Nanyang #Singapore

whitehatview

Daily Mail Online Website XSS Cyber Security Zero-Day Vulnerability

Domain Name: http://www.dailymail.co.uk/

The Alexa rank of it is 93 on January 01 2015. It is one of the most popular websites in the United Kingdom.

(1) Vulnerability description:

Daily Mail has a security problem. Criminals can exploit it by XSS attacks.

The vulnerability occurs at “reportAbuseInComment.html?” page with “&commentId” parameter, i.e. http://www.dailymail.co.uk/home/reportAbuseInComment.html?articleId=346288&commentId=877038

POC Code: http://www.dailymail.co.uk/home/reportAbuseInComment.html?articleId=346288&commentId=”><img src=x onerror=prompt(‘justqdjing’)>

The vulnerability can be attacked without user log in. Tests were performed on Mozilla Firefox (34.0) in Ubuntu (14.04) and Microsoft IE (9.0.15) in Windows 7.

Poc Video: https://www.youtube.com/watch?v=Oig-ZrlJDf8&feature=youtu.be

Blog Detail: http://tetraph.com/security/web-security/daily-mail-xss-bug/ http://securityrelated.blogspot.com/2015/10/daily-mail-online-website-xss-cyber.html https://vulnerabilitypost.wordpress.com/2015/10/30/daily-mail-xss/

(2) What is XSS? “Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side script into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. Cross-site scripting carried out on websites accounted for roughly 84% of all security vulnerabilities documented by Symantec as of 2007. Their effect may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site’s owner.” (Wikipedia)

(3) Vulnerability Disclosure: This vulnerability has been patched.

Reference: https://packetstormsecurity.com/files/134189/Daily-Mail-Unvalidated-Redirect http://news.softpedia.com/news/the-telegraph-and-daily-mail-fix-xss https://www.secnews.gr/dailymail_open_redirect_bug http://whitehatview.tumblr.com/post/132726489926/daily-mail-xss http://sys-secure.es/daily-mail-registration-page-unvalidated http://itsecuritynews.info/tag/jing-wang/ http://itsecurity.lofter.com/post/1cfbf9e7_8d45d6b http://computerobsess.blogspot.com/2015/11/daily-mail-xss.html https://computertechhut.wordpress.com/2015/11/04/daily-mail-xss/ http://marc.info/?l=full-disclosure&m=144651836427184&w=4

#daily mail #xss #cyber security #justqdjing #tetraph #spms #NTU #mas #math #jing wang

securitypost

URFDS: Systematic discovery of Unvalidated Redirects and Forwards in web applications

Author: Jing Wang, Hongjun Wu School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore Abstract: URL redirection is necessary in web applications. Well-designed redirection makes better user experience. However, if usedimproperly, it could give rise to attacks such as phishing. These improperly used redirections are called Unvalidated Redirects and Forwards (URF). This paper prescribes a mechanism to systemically discover URF vulnerabilities in web applications. The prototype implementation, that we call Unvalidated Redirects and Forwards Detection System (URFDS), uses a black-box scanning technique to modify URLs and analyse the generated output to identify URF. In order to show the feasible of our approach, we tested 142,522,691 unique links and found a great number of vulnerabilities in top websites and popular applications that were overlooked by previous works.

http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=7346891

#urf #urfds #jing wang #hong jun wu #NTU #Research #Academic #web security #application #fuzzing

whitehatview

VuFind 1.0 Reflected XSS (Cross-site Scripting) Application 0-Day Web Security Bug

Exploit Title: VuFind Results? &lookfor parameter Reflected XSS Web Security Vulnerability

Product: VuFind

Vendor: VuFind

Vulnerable Versions: 1.0

Tested Version: 1.0

Advisory Publication: September 20, 2015

Latest Update: September 25, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference:

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized modification

Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Caution Details:

(1) Vendor & Product Description:

Vendor:

VuFind

Product & Vulnerable Versions:

VuFind

1.0

Vendor URL & Download:

Product can be obtained from here, http://sourceforge.net/p/vufind/news/

Product Introduction Overview:

“VuFind is a library resource portal designed and developed for libraries by libraries. The goal of VuFind is to enable your users to search and browse through all of your library’s resources by replacing the traditional OPAC to include: Catalog Records, Locally Cached Journals, Digital Library Items, Institutional Repository, Institutional Bibliography, Other Library Collections and Resources. VuFind is completely modular so you can implement just the basic system, or all of the components. And since it’s open source, you can modify the modules to best fit your need or you can add new modules to extend your resource offerings. VuFind runs on Solr Energy. Apache Solr, an open source search engine, offers amazing performance and scalability to allow for VuFind to respond to search queries in milliseconds time. It has the ability to be distributed if you need to spread the load of the catalog over many servers or in a server farm environment. VuFind is offered for free through the GPL open source license. This means that you can use the software for free. You can modify the software and share your successes with the community! Take a look at our VuFind Installations Wiki page to see how a variety of organizations have taken advantage of VuFind’s flexibility. If you are already using VuFind, feel free to edit the page and share your accomplishments. ”

(2) Vulnerability Details:

VuFind web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user’s browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug researchers before. VuFind has patched some of them. “scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training”.

(2.1) The code flaw occurs at “lookfor?” parameter in “/vufind/Resource/Results?” page.

Some other researcher has reported a similar vulnerability here and VuFind has patched it. https://vufind.org/jira/si/jira.issueviews:issue-html/VUFIND-54/VUFIND-54.html

(3) Solution:

Update to new version.

References: http://tetraph.com/security/xss-vulnerability/vufind-xss/ http://russiapost.blogspot.ru/2015/09/vufind-xss-issue.html https://infoswift.wordpress.com/2015/09/25/vufind-issue/ http://www.openwall.com/lists/oss-security/2015/09/25/2 http://whitehatview.tumblr.com/post/129834589981/vufind-xss-bugs http://itsecurity.lofter.com/post/1cfbf9e7_854cb25 https://progressive-comp.com/?l=oss-security&m=144316469829656&w=1 http://essayjeans.blog.163.com/blog/static/23717307420158253407863/ http://seclists.org/oss-sec/2015/q3/639 http://frenchairing.blogspot.fr/2015/09/vufind-bug.html https://itswift.wordpress.com/2015/09/22/vufind-0day/ http://permalink.gmane.org/gmane.comp.security.oss.general/17836

#0day bugs #internet exploit #xss publish #hacker research #whitehat #bug

itinfotech

webcabinet

KnowledgeTree OSS 3.0.3b Application Reflected XSS (Cross-site Scripting) Web Security 0Day Vulnerability

Exploit Title: KnowledgeTree login.php &errorMessage parameter Reflected XSS Web Security Vulnerability

Product: Knowledge Tree Document Management System

Vendor: Knowledge Inc

Vulnerable Versions: OSS 3.0.3b

Tested Version: OSS 3.0.3b

Advisory Publication: August 22, 2015

Latest Update: August 31, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference:

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized modification

Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Recommendation Details:

(1) Vendor & Product Description:

Vendor:

KnowledgeTree

Product & Vulnerable Versions:

Knowledge Tree Document Management System

OSS 3.0.3b

Vendor URL & Download:

Product can be obtained from here,

http://download.cnet.com/KnowledgeTree-Document-Management-System/3000-10743_4-10632972.html

http://www.knowledgetree.com/

Product Introduction Overview:

"KnowledgeTree is open source document management software designed for business people to use and install. Seamlessly connect people, ideas, and processes to satisfy all your collaboration, compliance, and business process requirements. KnowledgeTree works with Microsoft® Office®, Microsoft® Windows® and Linux®."

(2) Vulnerability Details:

KnowledgeTree web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. KnowledgeTree has patched some of them. "Bugtraq is an electronic mailing list dedicated to issues about computer security. On-topic issues are new discussions about vulnerabilities, vendor security-related announcements, methods of exploitation, and how to fix them. It is a high-volume mailing list, and almost all new vulnerabilities are discussed there.". It has listed similar exploits, such as Bugtraq (Security Focus) 32920.

(2.1) The code flaw occurs at "&errorMessage" parameter in "login.php" page.

One similar bug is CVE-2008-5858. Its X-Force ID is 47529.

References: http://seclists.org/oss-sec/2015/q3/458 http://tetraph.com/security/xss-vulnerability/knowledgetree-oss-3-0-3b-reflected-xss/ https://progressive-comp.com/?l=oss-security&m=144094021709472 https://infoswift.wordpress.com/2015/08/31/knowledge-tree-xss/ http://japanbroad.blogspot.jp/2015/08/knowledge-tree-bug-exploit.html http://marc.info/?l=full-disclosure&m=144099659719456&w=4 http://tetraph.blog.163.com/blog/static/234603051201573144123156/ http://www.openwall.com/lists/oss-security/2015/08/30/2 https://www.mail-archive.com/fulldisclosure%40seclists.org/msg02446.html http://itinfotech.tumblr.com/post/128016383831/knowledge-tree-xss http://germancast.blogspot.com/2015/08/knowledge-tree-xss.html http://permalink.gmane.org/gmane.comp.security.oss.general/17655 http://webtech.lofter.com/post/1cd3e0d3_806e1d4

#Knowledgetree #xss #bug #research #whitehat #0day #Hacker #internet

Winmail Server 4.2 Reflected XSS (Cross-site Scripting) Web Application 0-Day Security Bug Exploit Title: Winmail Server badlogin.php &lid parameter Reflected XSS Web Security Vulnerability Product: Winmail Server Vendor: Winmail Server Vulnerable Versions: 4.2 4.1 Tested Version: 4.2 4.1 Advisory Publication: August 24, 2015 Latest Update: August 30, 2015 Vulnerability Type: Cross-Site Scripting [CWE-79] CVE Reference: Impact CVSS Severity (version 2.0): CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend) Impact Subscore: 2.9 Exploitability Subscore: 8.6 CVSS Version 2 Metrics: Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism Access Complexity: Medium Authentication: Not required to exploit Impact Type: Allows unauthorized modification Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing) Caution Details: (1) Vendor & Product Description: Vendor: Winmail Server Product & Vulnerable Versions: Winmail Server 4.2 4.1 Vendor URL & Download: Product can be obtained from here, http://www.magicwinmail.net/download.asp Product Introduction Overview: "Winmail Server is an enterprise class mail server software system offering a robust feature set, including extensive security measures. Winmail Server supports SMTP, POP3, IMAP, Webmail, LDAP, multiple domains, SMTP authentication, spam protection, anti-virus protection, SSL security, Network Storage, remote access, Web-based administration, and a wide array of standard email options such as filtering, signatures, real-time monitoring, archiving, and public email folders. Winmail Server can be configured as a mail server or gateway for ISDN, ADSL, FTTB and cable modem networks, beyond standard LAN and Internet mail server configurations." (2) Vulnerability Details: Winmail Server web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. Winmail Server has patched some of them. "scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training". Scip has recorded similar XSS bugs, such as scipID 26980. (2.1) The code flaw occurs at "&lid" parameter in "badlogin.php" page. In fact, CVE-2005-3692 mentions that "&retid" parameter in "badlogin.php" page is vulnerable to XSS attacks. But it does not mention "&lid" parameter". The scipID of the bug is 26980. Bugtraq (SecurityFocus) ID is 15493. OSVDB ID is 20926. References: http://seclists.org/oss-sec/2015/q3/459 http://www.tetraph.com/security/xss-vulnerability/winmail-server-4-2-reflected-xss/ http://computerobsess.blogspot.com/2015/08/winmail-xss.html http://marc.info/?l=oss-security&m=144094251309925&w=4 http://permalink.gmane.org/gmane.comp.security.oss.general/17656 https://webtechwire.wordpress.com/2015/08/31/winmail-xss/ http://tetraph.blog.163.com/blog/static/234603051201573115638385/ http://webtechhut.blogspot.com/2015/08/winmail-xss-0day.html http://ittechnology.lofter.com/post/1cfbf60d_806df2e http://www.inzeed.com/kaleidoscope/xss-vulnerability/fc2-blog-xss/ http://webcabinet.tumblr.com/post/128010125747/winmail-xss-bug http://www.openwall.com/lists/oss-security/2015/08/30/3 https://progressive-comp.com/?l=oss-security&m=144094251309925&w=1

#winmail #server #xss #0day #whitehat #computer bug #hacker #exploit attack

ithut

The Weather Channel at Least 76.3% Links Vulnerable to XSS Attacks Domain Description: http://www.weather.com/ “The Weather Channel is an American basic cable and satellite television channel which broadcasts weather forecasts and weather-related news and analyses, along with documentaries and entertainment programming related to weather. Launched on May 2, 1982, the channel broadcasts weather forecasts and weather-related news and analysis, along with documentaries and entertainment programming related to weather.“

"As of February 2015, The Weather Channel was received by approximately 97.3 million American households that subscribe to a pay television service (83.6% of U.S. households with at least one television set), which gave it the highest national distribution of any U.S. cable channel. However, it was subsequently dropped by Verizon FiOS (losing its approximately 5.5 millions subscribers), giving the title of most distributed network to HLN. Actual viewership of the channel averaged 210,000 during 2013 and has been declining for several years. Content from The Weather Channel is available for purchase from the NBCUniversal Archives.” (Wikipedia) Vulnerability description: The Weather Channel has a cyber security problem. Hacker can exploit it by XSS bugs.

Almost all links under the domain weather.com are vulnerable to XSS attacks. Attackers just need to add script at the end of The Weather Channel’s URLs. Then the scripts will be executed.

10 thousands of Links were tested based a self-written tool. During the tests, 76.3% of links belong to weather.com were vulnerable to XSS attacks.

The reason of this vulnerability is that Weather Channel uses URLs to construct its HTML tags without filtering malicious script codes. The vulnerability can be attacked without user login. Tests were performed on Firefox (34.0) in Ubuntu (14.04) and IE (9.0.15) in Windows 8.

Discovered by: Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing) http://www.tetraph.com/wangjing

More Details: http://seclists.org/fulldisclosure/2014/Nov/89 http://lists.openwall.net/full-disclosure/2014/11/27/3 http://whitehatview.tumblr.com/post/104313615841/the-weather-channel-flaw http://www.inzeed.com/kaleidoscope/xss-vulnerability/the-weather-channel-exploit http://diebiyi.com/articles/security/the-weather-channel-bug http://whitehatpost.lofter.com/post/1cc773c8_6f2d4a8 https://vulnerabilitypost.wordpress.com/2014/12/04/the-weather-channel-flaw http://tetraph.blog.163.com/blog/static/234603051201411475314523/ http://tetraph.blogspot.com/2014/12/the-weather-channel-xss.html http://ithut.tumblr.com/post/121916595448/weather-channel-xss https://mathfas.wordpress.com/2014/12/04/the-weather-channel-weather-bug http://computerobsess.blogspot.com/2014/12/the-weather-channel-xss.html http://www.tetraph.com/blog/xss-vulnerability/the-weather-channel-bug

#weather channel #xss #0day #bugs #exploit #hacker #whitehat #computer science #website #testing #cyber security #internet #IT bugs

The New York Times Old Articles Can Be Exploited by XSS Attacks (Almost all Article Pages Before 2013 Are Affected)

Domain: http://www.nytimes.com/ "The New York Times (NYT) is an American daily newspaper, founded and continuously published in New York City since September 18, 1851, by the New York Times Company. It has won 114 Pulitzer Prizes, more than any other news organization. The paper's print version has the largest circulation of any metropolitan newspaper in the United States, and the second-largest circulation overall, behind The Wall Street Journal. It is ranked 39th in the world by circulation. Following industry trends, its weekday circulation has fallen to fewer than one million daily since 1990. Nicknamed for years as "The Gray Lady", The New York Times is long regarded within the industry as a national "newspaper of record". It is owned by The New York Times Company. Arthur Ochs Sulzberger, Jr., (whose family (Ochs-Sulzberger) has controlled the paper for five generations, since 1896), is both the paper's publisher and the company's chairman. Its international version, formerly the International Herald Tribune, is now called the International New York Times. The paper's motto, "All the News That's Fit to Print", appears in the upper left-hand corner of the front page." (Wikipedia) (1) Vulnerability Description: The New York Times has a computer cyber security problem. Hacker can exploit its users by XSS bugs. The code program flaw occurs at New York Times’s URLs. Nytimes (short for New York Times) uses part of the URLs to construct its pages. However, it seems that Nytimes does not filter the content used for the construction at all before 2013. Based on Nytimes’s Design, Almost all URLs before 2013 are affected (All pages of articles). In fact, all article pages that contain “PRINT” button, “SINGLE PAGE” button, “Page *” button, “NEXT PAGE” button are affected. Nytimes changed this mechanism since 2013. It decodes the URLs sent to its server. This makes the mechanism much safer now. However, all URLs before 2013 are still using the old mechanism. This means almost all article pages before 2013 are still vulnerable to XSS attacks. I guess the reason Nytimes does not filter URLs before is cost. It costs too much (money & human capital) to change the database of all posted articles before.

Discover and Reporter: Jing Wang, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing) http://www.tetraph.com/wangjing More Details: http://lists.openwall.net/full-disclosure/2014/10/16/2 http://www.tetraph.com/blog/xss-vulnerability/new-york-times-xss http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1102 http://webcabinet.tumblr.com/post/121907302752/new-york-times-xss http://www.inzeed.com/kaleidoscope/xss-vulnerability/new-york-times-xss http://webtech.lofter.com/post/1cd3e0d3_6f57c56 http://tetraph.blog.163.com/blog/static/2346030512014101270479/ https://vulnerabilitypost.wordpress.com/2014/11/01/new-york-times-xss http://lifegrey.tumblr.com/post/121912534859/tous-les-liens-vers-les-articles http://securityrelated.blogspot.com/2014/10/new-york-times-design.html https://mathfas.wordpress.com/2014/11/01/new-york-times-xss http://computerobsess.blogspot.com/2014/10/new-york-times-design.html http://whitehatview.tumblr.com/post/103788276286/urls-to-articles-xss http://diebiyi.com/articles/security/xss-vulnerability/new-york-times-xss

#new york times #xss #0day #bug #attack #website testing #internet exploit #hacker #web security #cyber intelligence #computer science #jing.wang #white

securitypost

shellmantis

securitypost:

CVE-2014-8753 Cit-e-Net Multiple XSS (Cross-Site Scripting) Web Security Vulnerabilities

Exploit Title: Cit-e-Net Multiple XSS (Cross-Site Scripting) Web Security Vulnerabilities

Product: Cit-e-Access

Vendor: Cit-e-Net

Vulnerable Versions: Version 6

Tested Version: Version 6

Advisory Publication: February 12, 2015

Latest Update: June 01, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8753

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized modification

Discover and Author: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Instruction Details:

(1) Vendor & Product Description:

Vendor:

Cit-e-Net

Product & Version:

Cit-e-Access

Version 6

Vendor URL & Download:

Cit-e-Net can be downloaded from here, https://www.cit-e.net/citeadmin/help/cntrainingmanualhowto.pdf http://demo.cit-e.net/ http://www.cit-e.net/demorequest.cfm http://demo.cit-e.net/Cit-e-Access/ServReq/?TID=1&TPID=17

Product Introduction:

“We are a premier provider of Internet-based solutions encompassing web site development and modular interactive e-government applications which bring local government, residents and community businesses together.

Cit-e-Net provides a suite of on-line interactive services to counties, municipalities, and other government agencies, that they in turn can offer to their constituents. The municipal government achieves a greater degree of efficiency and timeliness in conducting the daily operations of government, while residents receive improved and easier access to city hall through the on-line access to government services.

Our web-based applications can help your municipality to acheive its e-government goals. Type & click website content-management empowers the municipality to manage the website quickly and easily. Web page styles & formats are customizable by the municipality, and because the foundation is a database application, user security can be set for individual personnel and module applications. Our application modules can either be integrated into your existing municipal web site or implemented as a complete web site solution. It’s your choice! Please contact us at [email protected] to view a demonstration of our municipal web site solution if you are an elected official or member of municipal management and your municipality is looking for a cost efficient method for enhancing & improving municipal services.

Interactive Applications

Online Service Requests

Online Tax Payments by ACH electronic-check or credit card.

Online Utility Payments by ACH electronic-check or credit card.

Online General-Payments by ACH electronic-check or credit card.

Submit Volunteer Resume’s Online for the municipality to match your skills with available openings.”

(2) Vulnerability Details:

Cit-e-Access web application has a security bug problem. It can be exploited by XSS attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user’s browser session within the trust relationship between their browser and the server.

Several similar products 0Day vulnerabilities have been found by some other bug hunter researchers before. Cit-i-Access has patched some of them. Open Sourced Vulnerability Database (OSVDB) is an independent and open-sourced database. The goal of the project is to provide accurate, detailed, current, and unbiased technical information on security vulnerabilities. The project promotes greater, open collaboration between companies and individuals. It has published suggestions, advisories, solutions details related to important vulnerabilities and cyber intelligence.

(2.1) The first programming code flaw occurs at “/eventscalendar/index.cfm?” page with “&DID” parameter in HTTP GET.

(2.2) The second programming code flaw occurs at “/search/index.cfm?” page with “&keyword” parameter in HTTP POST.

(2.3) The third programming code flaw occurs at “/news/index.cfm” page with “&jump2” “&DID” parameter in HTTP GET.

(2.4) The fourth programming code flaw occurs at “eventscalendar?” page with “&TPID” parameter in HTTP GET.

(2.5) The fifth programming code flaw occurs at “/meetings/index.cfm?” page with “&DID” parameter in HTTP GET.

(3) Solutions:

Leave message to vendor. No response. http://www.cit-e.net/contact.cfm

References: http://seclists.org/fulldisclosure/2015/Feb/48 http://marc.info/?l=full-disclosure&m=142380271819297&w=4 https://packetstormsecurity.com/files/130392/Cit-e-Net-6 https://hackertopic.wordpress.com/2015/06/06/cve-2014-8753 https://www.facebook.com/permalink.php?story_fbid=746137642163648 http://mathswift.blogspot.com/2015/06/cve-2014-8753.html http://inzeed.tumblr.com/post/120907933886/securitypost-cve-2014-8753 https://plus.google.com/u/0/100242269120759811496/posts/M5W1kShGpKr https://twitter.com/essayjeans/status/607391837213458432 http://ittechnology.lofter.com/post/1cfbf60d_735a4d0 http://www.weibo.com/5099722551/Clqtl3zWs?from=page_1005055099722551 http://blog.163.com/greensun_2006/blog/static/11122112201557115414537/ http://japanbroad.blogspot.jp/2015/06/cve-2014-8753-cit-e-net https://www.facebook.com/permalink.php?story_fbid=43609503322 http://whitehatpost.lofter.com/post/1cc773c8_73568f4 https://dailymem.wordpress.com/2015/06/06/cve-2014-8753 http://itinfotech.tumblr.com/post/120907872116/securitypost-cve-2014-8753 https://progressive-comp.com/?l=full-disclosure&m=142380271819297&w=1 http://www.tetraph.com/blog/xss-vulnerability/cve-2014-8753

#xss #cve #8753 #0day #cit-e-net #bug #computer #net exploit #cyber security #web application #internet #IT news #hacking

itinfotech

xingti

itinfotech:

About Group (about.com) All Topics (At least 99.88% links) Vulnerable to XSS & Iframe Injection Security Attacks, About.com Open Redirect Web Security Vulnerabilities

Vulnerability Description: About.com all “topic sites” are vulnerable to XSS (Cross-Site Scripting) and Iframe Injection (Cross Frame Scripting) attacks. This means all sub-domains of about.com are affected. Based on a self-written program, 94357 links were tested. Only 118 links do not belong to the topics (Metasites) links. Meanwhile, some about.com main pages are vulnerable to XSS attack, too. This means no more than 0.125% links are not affected. At least 99.875% links of About Group are vulnerable to XSS and Iframe Injection attacks. In fact, for about.com’s structure, the main domain is something just like a cover. So, very few links belong to them.

Simultaneously, the About.com main page’s search field is vulnerable to XSS attacks, too. This means all domains related to about.com are vulnerable to XSS attacks.

For the Iframe Injection vulnerability. They can be used to do DDOS (Distributed Denial-of-Service Attack) to other websites, too. Here is one example of DDOS based on Iframe Injection attacks of others. http://www.incapsula.com/blog/world-largest-site-xss-ddos-zombies.html

In the last, some “Open Redirect” vulnerabilities related to about.com are introduced. There may be large number of other Open Redirect Vulnerabilities not detected. Since About.com are trusted by some the other websites. Those vulnerabilities can be used to do “Covert Redirect” to these websites.

Vulnerability Disclosure: Those vulnerabilities were reported to About on Sunday, Oct 19, 2014. No one replied. Until now, they are still unpatched.

Vulnerability Discover: Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@Justqdjing) http://www.tetraph.com/wangjing

(1) Some Basic Background

(1.1) Domain Description: http://www.about.com/ http://www.alexa.com/siteinfo/about.com

“For March 2014, 61,428,000 unique visitors were registered by comScore for About.com, making it the 16th-most-visited online property for that month.” (The New York Times)

“About.com, also known as The About Group (formerly About Inc.), is an Internet-based network of content that publishes articles and videos about various subjects on its “topic sites,” of which there are nearly 1,000. The website competes with other online resource sites and encyclopedias, including those of the Wikimedia Foundation, and, for March 2014, 61,428,000 unique visitors were registered by comScore for About.com, making it the 16th-most-visited online property for that month. As of August 2012, About.com is the property of IAC, owner of Ask.com and numerous other online brands, and its revenue is generated by advertising.“ (Wikipedia)

“As of May 2013, About.com was receiving about 84 million unique monthly visitors.” (TechCrunch. AOL Inc.)

“According to About’s online media kit, nearly 1,000 “Experts” (freelance writers) contribute to the site by writing on various topics, including healthcare and travel.“ (About.com)

(1.2) Topics Related to About.com

“The Revolutionary About.com Directory and Community Metasite. Hundreds of real live passionate Guides covering Arts, Entertainment, Business, Industry, Science, Technology, Culture, Health, Fitness, Games,Travel, News, Careers, Jobs, Sports, Recreation, Parenting, Kids, Teens, Moms, Education, Computers, Hobbies and Local Information.” (azlist.about.com)

About.com - Sites A to Z

Number of Topics

A: 66

B: 61

C: 118

D: 49

E: 33

F: 57

G: 39

H: 48

I: 32

J: 15

K: 13

L: 36

M: 70

N: 26

O: 23

P: 91

Q: 4

R: 32

S: 104

T: 47

U: 12

V: 9

W: 43

X: 1

Y: 4

Z: 1

SUM: 1039

Reference: azlist.about.com/

In fact, those are not all topics of about.com. Some of the topics are not listed here such as, http://specialchildren.about.com

So, there are more than 1000 topics related to about.com.

(1.3) Result of Exploiting XSS Attacks XSS may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user’s browser session within the trust relationship between their browser and the server. Base on Acunetix, exploited XSS is commonly used to achieve the following malicious results:

“Identity theft

Accessing sensitive or restricted information

Gaining free access to otherwise paid for content

Spying on user’s web browsing habits

Altering browser functionality

Public defamation of an individual or corporation

Web application defacement

Denial of Service attacks (DOS)

“ (Acunetix)

… …

More: http://seclists.org/fulldisclosure/2015/Feb/9

Related Articles: http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1547 http://marc.info/?l=full-disclosure&m=142289980219878&w=4 https://packetstormsecurity.com/files/130211/About.com-Cross-Site-Scripting.html http://computerobsess.blogspot.com/2015/06/about-group-aboutcom-all-topics-at.html https://www.facebook.com/computersecurities/posts/384674738385985 http://www.weibo.com/1644370627/Clk7CaKvL?from=page_1005051644370627 http://guyuzui.lofter.com/post/1ccdcda4_6f03224 https://twitter.com/yangziyou/status/607145647037284352 http://webtechhut.blogspot.com/2015/06/about-group-aboutcom-all-topics-at.html https://computertechhut.wordpress.com/2015/02/02/about-group-about-com- https://www.facebook.com/permalink.php?story_fbid=1043670099006327 http://inzeed.tumblr.com/post/118845379331/securitypost-about-group-99-88-xss https://dailymem.wordpress.com/2015/02/11/about-group http://mathdaily.lofter.com/post/1cc75b20_7340000 http://xingti.tumblr.com/post/120847740060/itinfotech-about-group-xss-xfs http://diebiyi.com/articles/security/xss-vulnerability/about-group-xss-xrf-open-redirect/ http://www.tetraph.com/blog/xss-vulnerability/about-group-xss-xrf-open-redirect/

#about group #xss #xfs #0day exploit #open redirect #urf #dos #computer science #webstie testing #internet #cyber intlligence #bugs #jing.wang

ithut

qianqiuxue

CNN Travel.cnn.com XSS and Ads.cnn.com Open Redirect Web Security Vulnerabilities

Domain: cnn.com

“The Cable News Network (CNN) is an American basic cable and satellite television channel that is owned by the Turner Broadcasting System division of Time Warner. The 24-hour cable news channel was founded in 1980 by American media proprietor Ted Turner. Upon its launch, CNN was the first television channel to provide 24-hour news coverage, and was the first all-news television channel in the United States. While the news channel has numerous affiliates, CNN primarily broadcasts from the Time Warner Center in New York City, and studios in Washington, D.C. and Los Angeles, its headquarters at the CNN Center in Atlanta is only used for weekend programming. CNN is sometimes referred to as CNN/U.S. to distinguish the American channel from its international sister network, CNN International. As of August 2010, CNN is available in over 100 million U.S. households. Broadcast coverage of the U.S. channel extends to over 890,000 American hotel rooms, as well as carriage on cable and satellite providers throughout Canada. Globally, CNN programming airs through CNN International, which can be seen by viewers in over 212 countries and territories. As of February 2015, CNN is available to approximately 96,289,000 cable, satellite and, telco television households (82.7% of households with at least one television set) in the United States.” (Wikipedia)

Discovered and Reported by: Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing) http://www.tetraph.com/wangjing/

Vulnerability Description: CNN has a cyber security bug problem. It cab be exploited by XSS (Cross Site Scripting) and Open Redirect (Unvalidated Redirects and Forwards) attacks.

Based on news published, CNN users were hacked based on both Open Redirect and XSS vulnerabilities. According to E Hacker News on June 06, 2013, (@BreakTheSec) came across a diet spam campaign that leverages the open redirect vulnerability in one of the top News organization CNN. After the attack, CNN takes measures to detect Open Redirect vulnerabilities. The measure is quite good during the tests. Almost no links are vulnerable to Open Redirect attack on CNN’s website, now. It takes long time to find a new Open Redirect vulnerability that is un-patched on its website.

CNN.com was hacked by Open Redirect in 2013. While the XSS attacks happened in 2007.

<1> There are some tweets complaining about hacked with links from CNN.

At the same time, the cybercriminals have also leveraged a similar vulnerability in a Yahoo domain to trick users into thinking that the links point to a trusted website.

Yahoo Open Redirects Vulnerabilities: http://securityrelated.blogspot.com/2014/12/yahoo-yahoocom-yahoocojp-open-redirect.html

<2> CNN.com XSS hacked http://seclists.org/fulldisclosure/2007/Aug/216

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. CNN has patched some of them. BugTraq is a full disclosure moderated mailing list for the *detailed* discussion and announcement of computer security vulnerabilities: what they are, how to exploit them, and how to fix them. The below things be posted to the Bugtraq list: (a) Information on computer or network related security vulnerabilities (UNIX, Windows NT, or any other). (b) Exploit programs, scripts or detailed processes about the above. © Patches, workarounds, fixes. (d) Announcements, advisories or warnings. (e) Ideas, future plans or current works dealing with computer/network security. (f) Information material regarding vendor contacts and procedures. (g) Individual experiences in dealing with above vendors or security organizations. (h) Incident advisories or informational reporting. (i) New or updated security tools. A large number of the fllowing web securities have been published here, Buffer overflow, HTTP Response Splitting (CRLF), CMD Injection, SQL injection, Phishing, Cross-site scripting, CSRF, Cyber-attack, Unvalidated Redirects and Forwards, Information Leakage, Denial of Service, File Inclusion, Weak Encryption, Privilege Escalation, Directory Traversal, HTML Injection, Spam. It also publishes suggestions, advisories, solutions details related to XSS and URL Redirection vulnerabilities and cyber intelligence recommendations.

Detail: http://seclists.org/fulldisclosure/2014/Dec/128

Related Articles: https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01507.html https://packetstormsecurity.com/files/129754/cnn-xssredirect.txt http://cxsecurity.com/issue/WLB-2014120196 https://progressive-comp.com/?l=full-disclosure&m=141988778706126&w=1 https://itinfotechnology.wordpress.com/2015/01/01/cnn-travel-cn http://russiapost.blogspot.com/2015/06/cnn-travelcnncom-xss https://www.facebook.com/permalink.php?story_fbid=745810602196352 http://www.weibo.com/5337321538/Clij19Krr?from=page_1005055337321538 https://plus.google.com/u/0/112682696109623633489/posts/TyipiFnULRj http://webcabinet.tumblr.com/post/116075198227/ithut-cnn-cnn http://mathdaily.lofter.com/post/1cc75b20_4f0a751 https://twitter.com/tetraphibious/status/607085555776561152 http://qianqiuxue.tumblr.com/post/120838173915/ithut-cnn-xss-url-redirection-bug http://itprompt.blogspot.com/2015/06/cnn-travelcnncom-xss https://www.facebook.com/permalink.php?story_fbid=891722397533572 http://tetraph.com/security/xss-vulnerability/cnn-xss-url-redirect-bug/ http://ittechnology.lofter.com/post/1cfbf60d_7338770 https://hackertopic.wordpress.com/2015/01/04/cnn-travel-cnn http://www.inzeed.com/kaleidoscope/xss-vulnerability/cnn-xss-url-redirect-bug/

#cnn #travel #open redirect #xss #urf #0day exploit #computer science #website testing #hack prevention #internet flaw #jing.wang #It news #cyber

inzeed

ithut

inzeed:

ESPN espn.go.com Login & Register Page XSS and Dest Redirect Privilege Escalation Web Security Vulnerabilities

Domain: http://espn.go.com/

“ESPN (originally an acronym for Entertainment and Sports Programming Network) is a U.S.-based global cable and satellite television channel that is owned by ESPN Inc., a joint venture between The Walt Disney Company (which operates the network, through its 80% controlling ownership interest) and Hearst Corporation (which holds the remaining 20% interest). The channel focuses on sports-related programming including live and recorded event telecasts, sports news and talk shows, and other original programming.

ESPN broadcasts primarily from studio facilities located in Bristol, Connecticut. The network also operates offices in Miami, New York City, Seattle, Charlotte, and Los Angeles. John Skipper currently serves as president of ESPN, a position he has held since January 1, 2012. While ESPN is one of the most successful sports networks, it has been subject to criticism, which includes accusations of biased coverage, conflict of interest, and controversies with individual broadcasters and analysts. ESPN headquarters in Bristol, Connecticut. As of February 2015, ESPN is available to approximately 94,396,000 paid television households (81.1% of households with at least one television set) in the United States. In addition to the flagship channel and its seven related channels in the United States, ESPN broadcasts in more than 200 countries, operating regional channels in Australia, Brazil, Latin America and the United Kingdom, and owning a 20% interest in The Sports Network (TSN) as well as its five sister networks and NHL Network in Canada.”(Wikipedia)

Vulnerability description: Espn.go.com has a cyber security bug problem. It is vulnerable to XSS (Cross Site Scripting) and Dest Redirect Privilege Escalation (Open Redirect) attacks.

Those vulnerabilities are very dangerous. Since they happen at ESPN’s “login” & “register” pages that are credible. Attackers can abuse those links to mislead ESPN’s users. The success rate of attacks may be high.

During the tests, besides the links given above, large number of ESPN’s links are vulnerable to those attacks.

The programming code flaw occurs at “espn.go.com”’s “login?” & “register” pages with “redirect” parameter, i.e.

http://streak.espn.go.com/en/login?redirect=

https://r.espn.go.com/members/login?appRedirect=http%3A%2F%2Fr.espn.go.com

http://games.espn.go.com/world-cup-bracket-predictor/2014/es/login?redirect=

https://register.go.com/go/sendMemberNames?regFormId=espn&appRedirect=http://register.go.com/

Tests were performed on Firefox (33.0) in Ubuntu (14.04) and IE (8.0. 7601) in Windows 8.

Disclosed by: Jing Wang, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing) http://www.tetraph.com/wangjing/

“The Full Disclosure mailing list is a public forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. FD differs from other security lists in its open nature and support for researchers’ right to decide how to disclose their own discovered bugs. The full disclosure movement has been credited with forcing vendors to better secure their products and to publicly acknowledge and fix flaws rather than hide them. Vendor legal intimidation and censorship attempts are not tolerated here!” A great many of the fllowing web securities have been published here, Injection, Broken Authentication and Session Management, Cross-Site Scripting (XSS), Insecure Direct Object References, Security Misconfiguration, Sensitive Data Exposure, Missing Function Level Access Control, Cross-Site Request Forgery (CSRF), Using Components with Known Vulnerabilities, Unvalidated Redirects and Forwards. It also publishes suggestions, advisories, solutions details related to XSS and Open Redirect vulnerabilities and cyber intelligence recommendations.

(1) XSS Web Security Vulnerability XSS may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user’s browser session within the trust relationship between their browser and the server. Base on Acunetix, exploited XSS is commonly used to achieve the following malicious results

Identity theft

Accessing sensitive or restricted information

Gaining free access to otherwise paid for content

Spying on user’s web browsing habits

Altering browser functionality

Public defamation of an individual or corporation

Web application defacement

Denial of Service attacks

Detail: http://seclists.org/fulldisclosure/2014/Dec/36

More Details: http://lists.openwall.net/full-disclosure/2014/12/09/6 http://marc.info/?l=full-disclosure&m=141815942329008&w=4 https://packetstormsecurity.com/files/129450/espngocom-xssredirect.txt http://inzeed.tumblr.com/post/118510896051/webcabinet-espn-are-suffering https://plus.google.com/u/0/+JingWang-tetraph-justqdjing/posts/EdBhzmtNLts https://www.facebook.com/pcwebsecurities/posts/701707826641804 https://hackertopic.wordpress.com/2014/12/17/espn-espn-go-com- http://lifegreen.lofter.com/post/1cfbf37e_731a270 http://tetraph.blog.163.com/blog/static/234603051201555111422339/ http://frenchairing.blogspot.fr/2015/06/espn-espngocom-login-register-page-xss.html http://webtech.lofter.com/post/1cd3e0d3_6e6902d https://twitter.com/essayjeans/status/606833415166394368 https://www.facebook.com/tetraph/posts/1659649470921679 http://www.weibo.com/1644370627/Clc3JaGP7?from=page_1005051644370627 http://russiapost.blogspot.ru/2015/06/espn-espngocom-login-register-page-xss.html http://ithut.tumblr.com/post/120779685303/inzeed-espn-xss-open-redirect https://progressive-comp.com/?l=full-disclosure&m=141815942329008&w=1 http://www.inzeed.com/kaleidoscope/xss-vulnerability/espn-xss-open-redirect/

#espn #login #register #xss #open redirect #urf #0day-attack #whitehat topic #computer science #internet test #website report #wang.jing #cyber intelligence

lifegrey

xingti

lifegrey:

Yahoo Yahoo.com Yahoo.co.jp Open Redirect (Unvalidated Redirects and Forwards) Web Security Bugs

Though Yahoo lists open redirect vulnerability on its bug bounty program. However, it seems Yahoo do not take this vulnerability seriously at all.

Multiple Open Redirect vulnerabilities were reported Yahoo. All Yahoo’s responses were “It is working as designed”. However, these vulnerabilities were patched later.

Several other security researcher complained about getting similar treatment, too. http://seclists.org/fulldisclosure/2014/Jan/51 http://seclists.org/fulldisclosure/2014/Feb/119

All Open Redirect Vulnerabilities are intended behavior? If so, why patch them later?

From report of CNET, Yahoo’s users were attacked by redirection vulnerabilities. “Yahoo.com visitors over the last few days may have been served with malware via the Yahoo ad network, according to Fox IT, a security firm in the Netherlands. Users visiting pages with the malicious ads were redirected to sites armed with code that exploits vulnerabilities in Java and installs a variety of different malware. ”

Moreover, since Yahoo is well-known worldwide. these vulnerabilities can be used to attack other companies such as Google, eBay, The New York Times, Amazon, Godaddy, Alibaba, Netease, e.g. by bypassing their Open Redirect filters (Covert Redirect). These cyber security bug problems have not been patched. Other similar web and computer flaws will be published in the near future.

The vulnerabilities can be attacked without user login. Tests were performed on Microsoft IE (10.0.9200.16750) of Windows 8, Mozilla Firefox (34.0) & Google Chromium 39.0.2171.65-0 ubuntu0.14.04.1.1064 (64-bit) of Ubuntu (14.04)，Apple Safari 6.1.6 of Mac OS X Lion 10.7.

Disclosed by: Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing) http://www.tetraph.com/wangjing

Both Yahoo and Yahoo Japan online web application has a computer cyber security bug problem. It can be exploited by Unvalidated Redirects and Forwards (URL Redirection) attacks. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker’s choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

BugTraq is a full disclosure moderated mailing list for the *detailed* discussion and announcement of computer security vulnerabilities: what they are, how to exploit them, and how to fix them. The below things be posted to the Bugtraq list: (a) Information on computer or network related security vulnerabilities (UNIX, Windows NT, or any other). (b) Exploit programs, scripts or detailed processes about the above. © Patches, workarounds, fixes. (d) Announcements, advisories or warnings. (e) Ideas, future plans or current works dealing with computer/network security. (f) Information material regarding vendor contacts and procedures. (g) Individual experiences in dealing with above vendors or security organizations. (h) Incident advisories or informational reporting. (i) New or updated security tools. A large number of the fllowing web securities have been published here, Injection, Broken Authentication and Session Management, Cross-Site Scripting (XSS), Insecure Direct Object References, Security Misconfiguration, Sensitive Data Exposure, Missing Function Level Access Control, Cross-Site Request Forgery (CSRF), Using Components with Known Vulnerabilities, Unvalidated Redirects and Forwards. It also publishes suggestions, advisories, solutions details related to Open Redirect vulnerabilities and cyber intelligence recommendations.

Detail: http://seclists.org/fulldisclosure/2014/Dec/88

Related Articles: http://lists.openwall.net/full-disclosure/2014/12/19/10 http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1355 http://diebiyi.com/articles/security/open-redirect/yahoo-yahoo-com-yahoo-co-jp http://essaybeans.blogspot.com/2015/06/yahoo-yahoocom-yahoocojp-open-redirect.html https://webtechwire.wordpress.com/2014/12/23/yahoo-yahoo-com-yahoo-co-jp https://twitter.com/essayjeans/status/606789286428438528 http://inzeed.tumblr.com/post/118511483471/securitypost-yahoo-and-yahoo-japan-may-be http://essayjeans.lofter.com/post/1cc7459a_7314ba3 https://plus.google.com/u/0/+essayjeans/posts/GxcKENw4ira http://www.weibo.com/3973471553/ClaSVxObt?from=page_1005053973471553 http://computerobsess.blogspot.com/2015/06/yahoo-yahoocom-yahoocojp-open-redirect.html https://www.facebook.com/permalink.php?story_fbid=841616792540365 http://xingti.tumblr.com/post/120770694665/lifegrey-yahoo-url-redirection-bug http://xingzhehong.lofter.com/post/1cfd0db2_6e68fe3 https://redysnowfox.wordpress.com/2014/12/25/yahoo-open-redirect/ http://whitehatpost.blog.163.com/blog/static/24223205420155581240158 https://www.facebook.com/websecuritiesnews/posts/803277513125754 http://www.inzeed.com/kaleidoscope/spamming/yahoo-url-redirection/

#yahoo #yahoo japan #0day bug #new vulnerability #cyber intelligence #computer test #website security #whitehat #hack prevention #jing wang

tetraph

Google DoubleClick.net (Advertising) System URL Redirection Vulnerabilities Could Be Used by Spammers

Although Google does not include Open Redirect vulnerabilities in its bug bounty program, its preventive measures against Open Redirect attacks have been quite thorough and effective to date.

However, Google might have overlooked the security of its DoubleClick.net advertising system. After some test, it is found that most of the redirection URLs within DoubleClick.net are vulnerable to Open Redirect vulnerabilities. Many redirection are likely to be affected. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker’s choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

These redirections can be easily used by spammers, too.

Some URLs belong to Googleads.g.Doubleclick.net are vulnerable to Open Redirect attacks, too. While Google prevents similar URL redirections other than Googleads.g.Doubleclick.net. Attackers can use URLs related to Google Account to make the attacks more powerful.

Moreover, these vulnerabilities can be used to attack other companies such as Google, eBay, The New York Times, Amazon, Godaddy, Yahoo, Netease, e.g. by bypassing their Open Redirect filters (Covert Redirect). These cyber security bug problems have not been patched. Other similar web and computer attacks will be published in the near future.

(1) Background Related to Google DoubleClick.net.

(1.1) What is DoubleClick.net?

“DoubleClick is a subsidiary of Google which develops and provides Internet ad serving services. Its clients include agencies, marketers (Universal McCann, AKQA etc.) and publishers who serve customers like Microsoft, General Motors, Coca-Cola, Motorola, L'Oréal, Palm, Inc., Apple Inc., Visa USA, Nike, Carlsberg among others. DoubleClick’s headquarters is in New York City, United States.

DoubleClick was founded in 1996 by Kevin O'Connor and Dwight Merriman. It was formerly listed as “DCLK” on the NASDAQ, and was purchased by private equity firms Hellman & Friedman and JMI Equity in July 2005. In March 2008, Google acquired DoubleClick for US$3.1 billion. Unlike many other dot-com companies, it survived the dot-com bubble and focuses on uploading ads and reporting their performance.“ (Wikipedia)

(1.2) Reports Related to Google DoubleClick.net Used by Spammers

(1.2.1) Google DoublClick.net has been used by spammers for long time. The following is a report in 2008.

“The open redirect had become popular with spammers trying to lure users into clicking their links, as they could be made to look like safe URLs within Google’s domain.” https://www.virusbtn.com/blog/2008/06_03a.xml?comments

(1.2.2) Mitechmate published a blog related to DoubleClick.net spams in 2014.

“Ad.doubleclick.net is recognized as a perilous adware application that causes unwanted redirections when surfing on the certain webpages. Actually it is another browser hijacker that aims to distribute frauds to make money.Commonly people pick up Ad.doubleclick virus when download softwares, browse porn site or read spam email attachments. It enters into computer sneakily after using computer insecurely.Ad.doubleclick.net is not just annoying, this malware traces users’ personal information, which would be utilized for cyber criminal.” http://blog.mitechmate.com/remove-ad-doubleclick-net-redirect-virus/

(1.2.3) Malwarebytes posted a news related to DoubleClick.net malvertising in 2014.

“Large malvertising campaign under way involving DoubleClick and Zedo” https://blog.malwarebytes.org/malvertising-2/2014/09/large-malvertising-campaign-under-way-involving-doubleclick-and-zedo/

(2) DoubleClick.net System URL Redirection Vulnerabilities Details.

Used webpages for the following tests. The webpage address is “http://securitypost.tumblr.com/”. We can suppose that this webpage is malicious.

…

Detail: http://seclists.org/fulldisclosure/2014/Nov/28

Related Posts: http://lists.openwall.net/full-disclosure/2014/11/14/2 http://marc.info/?l=full-disclosure&m=141599320308665&w=4 http://www.hotforsecurity.com/blog/googles-doubleclick-advertising-platform http://mathpost.tumblr.com/post/120760828940/tetraph-google-doubleclick-net http://diebiyi.com/articles/security/open-redirect/google-doubleclick-spam/ https://mathfas.wordpress.com/2014/11/19/google-doubleclick-netadvertising-system https://plus.google.com/u/0/+JingWang-tetraph-justqdjing/posts/S7NdTCdEUpC http://essayjeans.blogspot.com/2015/06/google-doubleclick-website-system-could.html https://twitter.com/yangziyou/status/606740348757368832 https://www.facebook.com/websecuritiesnews/posts/803216363131869 http://itsecurity.lofter.com/post/1cfbf9e7_72fe79f http://tetraph.tumblr.com/post/120760676767/google-doubleclick-net-advertising http://www.weibo.com/1644370627/Cl9CvdTms?from=page_1005051644370627 https://zuiyuxiang.wordpress.com/2014/11/22/google-doubleclick-spam/ http://tetraph.blogspot.com/2015/06/google-doubleclick-website-system-could.html| https://www.facebook.com/permalink.php?story_fbid=8415712192115891 http://yurusi.blogspot.com/2015/06/google-doubleclick-website-system-could.html http://guyuzui.lofter.com/post/1ccdcda4_7305f25| http://www.tetraph.com/blog/open-redirect/google-doubleclick-spam/

#google #doubleclick #advertisement #open redirect #urf #ebay bypass #new york times #white hat #0day-exploit #hack prevention #jing.wang #covert-redirect

itinfotech

Facebook Old Generated URLs Still Vulnerable to Open Redirect Attacks & A New Open Redirect Web Security Bugs Domain: http://www.facebook.com

“Facebook is an online social networking service headquartered in Menlo Park, California. Its website was launched on February 4, 2004, by Mark Zuckerberg with his college roommates and fellow Harvard University students Eduardo Saverin, Andrew McCollum, Dustin Moskovitz and Chris Hughes. The founders had initially limited the website’s membership to Harvard students, but later expanded it to colleges in the Boston area, the Ivy League, and Stanford University. It gradually added support for students at various other universities and later to high-school students. Since 2006, anyone who is at least 13 years old is allowed to become a registered user of the website, though the age requirement may be higher depending on applicable local laws. Its name comes from a colloquialism for the directory given to it by American universities students.” (Wikipedia) “Facebook had over 1.44 billion monthly active users as of March 2015.Because of the large volume of data users submit to the service, Facebook has come under scrutiny for their privacy policies. Facebook, Inc. held its initial public offering in February 2012 and began selling stock to the public three months later, reaching an original peak market capitalization of $104 billion. As of February 2015 Facebook reached a market capitalization of $212 Billion.” (Wikipedia)

Discover: Jing Wang, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing) http://www.tetraph.com/wangjing/

(1) General Vulnerabilities Description:

(1.1) Two Facebook vulnerabilities are introduced in this article.

Facebook has a computer cyber security bug problem. It can be exploited by Open Redirect attacks. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker’s choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs. Since Facebook is trusted by large numbers of other websites. Those vulnerabilities can be used to do “Covert Redirect” to other websites such as Amazon, eBay, Go-daddy, Yahoo, 163, Mail.ru etc.

(1.1.1) One Facebook Open Redirect vulnerability was reported to Facebook. Facebook adopted a new mechanism to patch it. Though the reported URL redirection vulnerabilities are patched. However, all old generated URLs are still vulnerable to the attacks. Section (2) gives detail of it.

The reason may be related to Facebook’s third-party interaction system or database management system or both. Another reason may be related to Facebook’s design for different kind of browsers.

(1.1.2) Another new Open Redirect vulnerability related to Facebook is introduced, too. For reference, please read section (3).

Detail: http://seclists.org/fulldisclosure/2015/Jan/22

Related Articles: https://packetstormsecurity.com/files/129914/facebook-redirect.txt https://rstforums.com/forum/archive/index.php/t-95459.html https://progressive-comp.com/?l=full-disclosure&m=142104333521454&w=1 http://whitehatpost.blog.163.com/blog/static/24223205420155501020837/ http://webtechhut.blogspot.com/2015/06/facebook-old-generated-urls-still.html http://qianqiuxue.tumblr.com/post/120750458855/itinfotech-facebook-web-security http://www.weibo.com/5099722551/Cl8mZk3Q3?from=page_1005055099722551 https://infoswift.wordpress.com/2015/01/15/facebook-old-generated-urls https://twitter.com/buttercarrot/status/606696103329693696 https://www.facebook.com/permalink.php?story_fbid=891088980930247 http://itinfotech.tumblr.com/post/120750347586/facebook-web-security-0day-bug http://frenchairing.blogspot.fr/2015/06/facebook-old-generated-urls-still.html http://essaybeans.lofter.com/post/1cc77d20_7300027 http://japanbroad.blogspot.jp/2015/06/facebook-old-generated-urls-still.html http://ittechnology.lofter.com/post/1cfbf60d_72fd108 https://inzeed.wordpress.com/2015/01/18/facebook-old-generated-urls-still https://www.facebook.com/permalink.php?story_fbid=745417422235670 http://www.inzeed.com/kaleidoscope/computer-security/facebook-open-redirect/

#facebook #URLs #old #0day attack #phishing #open redirect #URF #wang.jing #covert.redirect #amazon bypass #spam #computer bug #IT news

whitehatview

Internet Users Threatened by New Serious Security Flaw, Covert Redirect

A serious flaw in two widely used security standards could give anyone access to your account information at Google, Microsoft, Facebook, Twitter and many other online services. The flaw, dubbed “Covert Redirect” by its discoverer, exists in two open-source session-authorization protocols, OAuth 2.0 and OpenID.

Both standards are employed across the Internet to let users log into websites using their credentials from other sites, such as by logging into a Web forum using a Facebook or Twitter username and password instead of creating a new account just for that forum.

Attackers could exploit the flaw to disguise and launch phishing attempts from legitimate websites, said the flaw’s finder, Mathematics Ph.D. student Wang Jing of the Nanyang Technological University in Singapore.

Wang believes it’s unlikely that this flaw will be patched any time soon. He says neither the authentication companies (those with which users have an account, such as Google, Microsoft, Facebook, Twitter or LinkedIn, among others) nor the client companies (sites or apps whose users log in via an account from an authentication company) are taking responsibility for fixing the issue.

“The vulnerability is usually due to the existing weakness in the third-party websites,” Wang writes on his own blog. “However, they have little incentive to fix the problem.”

The biggest danger of Covert Redirect is that it could be used to conduct phishing attacks, in which cybercriminals seize login credentials, by using email messages containing links to malicious websites disguised as something their targets might want to visit.

Normal phishing attempts can be easy to spot, because the malicious page’s URL will usually be off by a couple of letters from that of the real site. The difference with Covert Redirect is that an attacker could use the real website instead by corrupting the site with a malicious login popup dialogue box.

For example, say you regularly visit a given forum (the client company), to which you log in using your credentials from Facebook (the authentication company). Facebook uses OAuth 2.0 to authenticate logins, so an attacker could put a corrupted Facebook login popup box on this forum.

If you sign in using that popup box, your Facebook data will be released to the attacker, not to the forum. This means the attacker could possibly gain access to your Facebook account, which he or she could use to spread more socially engineered attacks to your Facebook friends.

Covert Redirect could also be used in redirection attacks, which is when a link takes you to a different page than the one expected.

Wang told CNET authentication companies should create whitelists — pre-approved lists that block any not on it — of the client companies that are allowed to use OAuth and OpenID to redirect to them. But he said he had contacted a number of these authentication companies, who all shifted blame elsewhere.

Wang told CNET Facebook had told him it “understood the risks associated with OAuth 2.0” but that fixing the flaw would be “something that can’t be accomplished in the short term.” Google and LinkedIn allegedly told Wang they were looking into the issue, while Microsoft said the issue did not exist on its own sites.

Covert Redirect appears to exist in the implementations of the OpenID and OAuth standards used on client websites and apps. But because these two standards are open-source and were developed by a group of volunteers, there’s no company or dedicated team that could devote itself to fixing the issue.

Where does that leave things?

“Given the trust users put in Facebook and other major OAuth providers, I think it will be easy for attackers to trick people into giving some access to their personal information stored on those service,” Chris Wysopal, chief technology officer of Boston-area security firm Veracode and a member of the legendary 1990s hackerspace the L0pht, told CNET.

“It’s not easy to fix, and any effective remedies would negatively impact the user experience,” Jeremiah Grossman, founder of Santa Clara, Calif.-based WhiteHat Security, told CNET. “Just another example that Web security is fundamentally broken and the powers that be have little incentive to address the inherent flaws.”

Users should be extra-wary of login popups on Web pages. If you wish to log into a given website, it might be better to use an account specific to that website instead of logging in with Facebook, Twitter, or another authentication company, which would require the use of OAuth and/or OpenID to do.

If you think someone has gained access to one of your online accounts, notify the service and change that account’s password immediately.

http://www.tomsguide.com/us/facebook-google-covert-redirect-flaw,news-18726.html

http://www.scmagazine.com/covert-redirect-vulnerability-impacts-oauth-20-openid/article/345407/

http://news.yahoo.com/facebook-google-users-threatened-security-192547549.html

http://thehackernews.com/2014/05/nasty-covert-redirect-vulnerability.html

http://www.foxnews.com/tech/2014/05/05/facebook-google-users-threatened-by-new-security-flaw/

http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html

http://whitehatview.tumblr.com/post/120695795041

http://russiapost.blogspot.ru/2015/05/openid-oauth-20.html

http://www.diebiyi.com/articles/security/covert-redirect/covert_redirect/

http://whitehatpost.lofter.com/post/1cc773c8_706b622

https://itswift.wordpress.com/2014/05/06/microsoft-google-facebook-attacked/

http://tetraph.blog.163.com/blog/static/2346030512015420103814617/

http://www.inzeed.com/kaleidoscope/computer-security/facebook-google-attack/

#facebook #google #yahoo #linkedin #microsoft #it news #0day-attack #web threat #user in danger #jing wang #covert redirect #oauth 2.0 #openid

Trending Blogs

Recently Viewed Blogs

Web Cabinet