SEC Consult SA-20200407-0 :: Multiple XSS vulnerabilities in TAO Open Source Assessment Platform

--===============5557677324472988244==
Content-Type: multipart/signed; protocol="application/pkcs7-signature";
	micalg=sha-256; boundary="------------ms080101050909030109060103"

--------------ms080101050909030109060103
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

SEC Consult Vulnerability Lab Security Advisory < 20200407-0 >
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
              title: Multiple XSS vulnerabilities
            product: TAO Open Source Assessment Platform
 vulnerable version: 3.3.0 RC2
      fixed version: -
         CVE number: -
             impact: medium
           homepage: https://www.taotesting.com/product/community/
              found: 2019-09-16
                 by: David Haintz
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult
                     Europe | Asia | North America

                     https://www.sec-consult.com

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Vendor description:
-------------------
"The Next Generation Open Source Assessment Solution -
Say goodbye to technical complexity and yet another IT project. Say hello=
 to an
all-in-one assessment solution. Easily tap into the power of open source,=
 single
sign-on and LTI. Open source means open possibilities so you can benefit =
from
the ideas of the expert assessment community."

Source: https://www.taotesting.com/product/


Business recommendation:
------------------------
The vendor did not respond to our communication attempts, hence no patch =
is
available.

An in-depth security analysis performed by security professionals is
highly advised, as the software may be affected from further security
issues.


Vulnerability overview/description:
-----------------------------------
1) Multiple XSS vulnerabilities
Several pages lack input validation within the URL that is output into th=
e
action attribute of a form. An attacker can break out of the string
and add custom JavaScript events to several forms. Additionally, the erro=
r
page also lacks filtering user input / output.


Proof of concept:
-----------------
1) Multiple XSS vulnerabilities
a) XSS in URL for form action attributes

If a victim accesses the following link and enters their credentials, an =
alert
shows the entered password:

[ removed PoC from advisory ]

Since chars like " or < and > are filtered in this case, a string had to =
be built
by using char codes and JavaScript's String.fromCharCode(). The same patt=
ern
works for many other paths too. Following additional paths were also foun=
d to be
vulnerable:

[ removed PoC from advisory ]


b) XSS in error page
The internal error page also lacks input/output validation. The following=
 URL
generates a website opening a message box showing the current location wi=
thout
any filtering:

[ removed PoC from advisory ]


Vulnerable / tested versions:
-----------------------------
The following version has been tested, which was the most recent one at t=
he time
of the test:

* 3.3.0 RC2


Vendor contact timeline:
------------------------
2019-09-17: Contacting vendor through https://www.taotesting.com/contact-=
us/
2019-10-08: Contacting vendor again through https://www.taotesting.com/co=
ntact-us/
2020-03-19: Checked whether newer version exists; contacting vendor again=
 through
            contact form and support contact email address.
            Got sales auto-response which automatically booked an online
            meeting with a "Business Development" person. Also automatica=
lly got
            added to a newsletter which we did not agree in the contact f=
orm.
            Contacted "Business Development" person via email directly. N=
o response.
2020-03-20: Sent email again, asking for security contact
2020-03-23: Sent email again to [email protected] and "Business Develo=
pment"
            person; no response
2020-04-07: Release of security advisory


Solution:
---------
The vendor did not respond to our communication attempts, hence no patch =
is
available.


Workaround:
-----------
Don't use the product or implement additional measures such as a WAF unti=
l the
vendor fixes the security issues.


Advisory URL:
-------------
https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. I=
t
ensures the continued knowledge gain of SEC Consult in the field of netwo=
rk
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evalu=
ation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and v=
alid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/career/index.html=


Interested in improving your cyber security with the experts of SEC Consu=
lt?
Contact our local offices https://www.sec-consult.com/en/contact/index.ht=
ml
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF @D. Haintz, J. Greil / 2020


--------------ms080101050909030109060103
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
DGAwggYQMIID+KADAgECAhBNlCwQ1DvglAnFgS06KwZPMA0GCSqGSIb3DQEBDAUAMIGIMQsw
CQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkx
HjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRydXN0IFJT
QSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xODExMDIwMDAwMDBaFw0zMDEyMzEyMzU5
NTlaMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD
VQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3Rp
Z28gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyjztlApB/975Rrno1jvm2pK/KxBOqhq8gr2+
JhwpKirSzZxQgT9tlC7zl6hn1fXjSo5MqXUfItMltrMaXqcESJuK8dtK56NCSrq4iDKaKq9N
xOXFmqXX2zN8HHGjQ2b2Xv0v1L5Nk1MQPKA19xeWQcpGEGFUUd0kN+oHox+L9aV1rjfNiCj3
bJk6kJaOPabPi2503nn/ITX5e8WfPnGw4VuZ79Khj1YBrf24k5Ee1sLTHsLtpiK9OjG4iQRB
dq6Z/TlVx/hGAez5h36bBJMxqdHLpdwIUkTqT8se3ed0PewDch/8kHPo5fZl5u1B0ecpq/sD
N/5sCG52Ds+QU5O5EwIDAQABo4IBZDCCAWAwHwYDVR0jBBgwFoAUU3m/WqorSs9UgOHYm8Cd
8rIDZsswHQYDVR0OBBYEFAnA8vwL2pTbX/4r36iZQs/J4K0AMA4GA1UdDwEB/wQEAwIBhjAS
BgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDARBgNV
HSAECjAIMAYGBFUdIAAwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDovL2NybC51c2VydHJ1c3Qu
Y29tL1VTRVJUcnVzdFJTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHYGCCsGAQUFBwEB
BGowaDA/BggrBgEFBQcwAoYzaHR0cDovL2NydC51c2VydHJ1c3QuY29tL1VTRVJUcnVzdFJT
QUFkZFRydXN0Q0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29t
MA0GCSqGSIb3DQEBDAUAA4ICAQBBRHUAqznCFfXejpVtMnFojADdF9d6HBA4kMjjsb0XMZHz
tuOCtKF+xswhh2GqkW5JQrM8zVlU+A2VP72Ky2nlRA1GwmIPgou74TZ/XTarHG8zdMSgaDrk
VYzz1g3nIVO9IHk96VwsacIvBF8JfqIs+8aWH2PfSUrNxP6Ys7U0sZYx4rXD6+cqFq/ZW5BU
fClN/rhk2ddQXyn7kkmka2RQb9d90nmNHdgKrwfQ49mQ2hWQNDkJJIXwKjYA6VUR/fZUFeCU
isdDe/0ABLTI+jheXUV1eoYV7lNwNBKpeHdNuO6Aacb533JlfeUHxvBz9OfYWUiXu09sMAvi
M11Q0DuMZ5760CdO2VnpsXP4KxaYIhvqPqUMWqRdWyn7crItNkZeroXaecG03i3mM7dkiPaC
kgocBg0EBYsbZDZ8bsG3a08LwEsL1Ygz3SBsyECa0waq4hOf/Z85F2w2ZpXfP+w8q4ifwO90
SGZZV+HR/Jh6rEaVPDRF/CEGVqR1hiuQOZ1YL5ezMTX0ZSLwrymUE0pwi/KDaiYB15uswgeI
AcA6JzPFf9pLkAFFWs1QNyN++niFhsM47qodx/PL+5jR87myx5uYdBEQkkDc+lKB1Wct6ucX
qm2EmsaQ0M95QjTmy+rDWjkDYdw3Ms6mSWE3Bn7i5ZgtwCLXgAIe5W8mybM2JzCCBkgwggUw
oAMCAQICEQCqEvWSMxa60FTK/mX98WsoMA0GCSqGSIb3DQEBCwUAMIGWMQswCQYDVQQGEwJH
QjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYD
VQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENsaWVudCBBdXRo
ZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMB4XDTIwMDIxOTAwMDAwMFoXDTIzMDIx
ODIzNTk1OVowggFRMQswCQYDVQQGEwJBVDENMAsGA1UEERMEMjcwMDEWMBQGA1UECBMNTG93
ZXIgQXVzdHJpYTEVMBMGA1UEBxMMV3IuIE5ldXN0YWR0MRcwFQYDVQQJEw5Lb21hcmlnYXNz
ZSAxNDEuMCwGA1UEChMlU0VDIENvbnN1bHQgVW50ZXJuZWhtZW5zYmVyYXR1bmcgR21iSDFJ
MEcGA1UECxNASXNzdWVkIHRocm91Z2ggU0VDIENvbnN1bHQgVW50ZXJuZWhtZW5zYmVyYXR1
bmcgR21iSCBFLVBLSSBNYW5hZzEfMB0GA1UECxMWQ29ycG9yYXRlIFNlY3VyZSBFbWFpbDEm
MCQGA1UEAxMdU0VDIENvbnN1bHQgVnVsbmVyYWJpbGl0eSBMYWIxJzAlBgkqhkiG9w0BCQEW
GHJlc2VhcmNoQHNlYy1jb25zdWx0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAMjhLLCjQCn+Gf7TyDcOlNIfQvq4jLeuo9LrBZLXOG4ccfndc/C+gWtIcub0rnzHF/F7
v+Ag636eDTLmECZUbAfPkNz7KNwXp8MpcnvMxMFIMmjODSjRZEla+cVOblNM9bVjJT7Lxt1j
bKzwDXxefF6EskGbJxqLcbAKJOE2CWK6KQBTyx6tXoi4Zmbqx5A0bt/vUOFansPvVOFqFh8s
WnHxqm/ASap5CsIpORcBeTmQlO0zCXgCiW72SaNfDLemVxo18Hx/O3i7juD8NR8NOL8tZCSV
JH+X12CAlfpDzPqx9JPZ+thPQ/e9DYTWIyGSP5zE80mpqSgBQLLVjAIDQfECAwEAAaOCAdEw
ggHNMB8GA1UdIwQYMBaAFAnA8vwL2pTbX/4r36iZQs/J4K0AMB0GA1UdDgQWBBSpYREAZ3TJ
TDKYmZRoqa17m9EH5zAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAU
BggrBgEFBQcDBAYIKwYBBQUHAwIwQAYDVR0gBDkwNzA1BgwrBgEEAbIxAQIBAQEwJTAjBggr
BgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0
cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUlNBQ2xpZW50QXV0aGVudGljYXRpb25hbmRT
ZWN1cmVFbWFpbENBLmNybDCBigYIKwYBBQUHAQEEfjB8MFUGCCsGAQUFBzAChklodHRwOi8v
Y3J0LnNlY3RpZ28uY29tL1NlY3RpZ29SU0FDbGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3Vy
ZUVtYWlsQ0EuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAjBgNV
HREEHDAagRhyZXNlYXJjaEBzZWMtY29uc3VsdC5jb20wDQYJKoZIhvcNAQELBQADggEBAG3h
PGEd6a0iPVOK7nEk+NigrOcYslK17zTVQSGnki/Nil1RcoC9k+eX5fIWDmFeqdMIwxjx2isV
mlXgph5sVc6QG4RcTvhaM9yhVbNrrw4vdv6jBJMghtU/jOwECryDXIwBEQ6RqHYLdAyo4ZFo
+ra9jpoTYfc81c3RAck2cwEq2yyXatFnEN1DRZ3oVLYg9cVkrDA3Af0UMv11TjawxHmyZyYY
2GGLiqTz0gsetS625bcD7gR2QfPiJ8L35PZg9SUgjPOSze3kwLEAbeOK4iJNmkPKpHrr5hh0
+4PZJaTcNwO5mRXxZFIRZfZ71kMZjAsG53a1ZHYnW5BJpMPYlBoxggQ1MIIEMQIBATCBrDCB
ljELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMH
U2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJT
QSBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRAKoS9ZIzFrrQ
VMr+Zf3xaygwDQYJYIZIAWUDBAIBBQCgggJZMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw
HAYJKoZIhvcNAQkFMQ8XDTIwMDQwNzE0NTY0NVowLwYJKoZIhvcNAQkEMSIEIO8V6k6rU/1S
70k/sSsqcAs4WQ/AtBNXZS+sq4nJmK1SMGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEq
MAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwIC
AUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwgb0GCSsGAQQBgjcQBDGBrzCBrDCBljELMAkG
A1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9y
ZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBDbGll
bnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRAKoS9ZIzFrrQVMr+Zf3x
aygwgb8GCyqGSIb3DQEJEAILMYGvoIGsMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3Jl
YXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExp
bWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQg
U2VjdXJlIEVtYWlsIENBAhEAqhL1kjMWutBUyv5l/fFrKDANBgkqhkiG9w0BAQEFAASCAQCL
OEVPi38CjtluTyzzpZxuOXdjwv8OlII4EbVV3avMbNrqVFAvDOObYx1FrOIVUuPnJAEdD1wt
xkRLMV7M/aRWG2hqXg+FbasnWCdOUkMJk18FRR5gg4MeWR+TSQjNxHZxeVfKVyFe3eEh5Va5
Z9F9w0xdjIZDCwkIL1paIxtcvW2oeo8HA8She6IOVBLcYd8NKZgh38uyXmiu/1SF0T9YKzco
1OkaPs4sZ0ePuPrYPaMeUlmcbedG2ABGd5Vh81fksVJ0aCpVpIcdLExCBR3zyYzOmyPnIUkY
C5K2Qn4zVsFiOIjHTyQqLTRcSWYYWqpfDAAr3yNa62veFzmt/qoBAAAAAAAA
--------------ms080101050909030109060103--

--===============5557677324472988244==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline