Introducing Evil In Your Website With Untrusted Third Party Scripts

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOPFZCmS7IMb_VifWHQ_flsNcjWCfwOL7UO3Mqe-PIB7NtapGvml34qpBd_U2ujh5WsYBnLEDsPb3kdteZNdDhSAFpXweeHe2859j7tm__C6c6MOsSRzeymKUV2T1nnYEqDVg2v_4zfw4/s1600/Evil-Clown-horror-world-23601543-500-375.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="240" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOPFZCmS7IMb_VifWHQ_flsNcjWCfwOL7UO3Mqe-PIB7NtapGvml34qpBd_U2ujh5WsYBnLEDsPb3kdteZNdDhSAFpXweeHe2859j7tm__C6c6MOsSRzeymKUV2T1nnYEqDVg2v_4zfw4/s320/Evil-Clown-horror-world-23601543-500-375.jpg" width="320" /></a></div><br />This is a small case study, where my aim is to explain why you shouldn't use untrusted third party scripts on your website. Htmlcommentbox is a third part script that could be embedded into any webpage would bring a place where users can comment and interact with each, I feel it is poorly coded from both user's perspective and security perspective as it could introduce lots of spam in your website.<br /><br />Let's talk about what else could it do else than introducing spam from security perspective. We [<b>Me and Pepe Vila]</b> have found two attack vectors with the <b>HtmlCommentBox as </b>Does not sanitise the user input's properly resulting in a stored xss and also a reflected xss, which obviously leaves wide variety of attack vectors from the attacker's perspective.<br /><div><a name="more"></a></div><div><h4>Stored XSS POC</h4></div><div>The POC is very simple, Seems like that you can inject any thing as long as you don't close the tag:</div><div><br /></div><div><b>Example:</b></div><div><br /><i><img src=x onerror=prompt(0);</i></div><div><i><iframe/onload=prompt(0);</i></div><div><i><svg/onload=prompt(0);</i></div><div><br /></div><div>Let's see a demonstration of this on their live website where they themselves have hosted their htmlcommentbox making their website vulnerable to the stored XSS too.</div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimL1BRb9NP1nfiOak73rxgvkCs0DP4Ipk1bWJJzg88Z3EaXnDQumyovJfhzzShDhQDJBlmmq7qayfoUdCreJRjZjhISdN77e7ouuU4unPv6GXNnvnUj4o8x-eNN6m8mUK4LDmZ4FN_sUI/s1600/rafay.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="220" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimL1BRb9NP1nfiOak73rxgvkCs0DP4Ipk1bWJJzg88Z3EaXnDQumyovJfhzzShDhQDJBlmmq7qayfoUdCreJRjZjhISdN77e7ouuU4unPv6GXNnvnUj4o8x-eNN6m8mUK4LDmZ4FN_sUI/s640/rafay.png" width="577" /></a></div><div><br /></div><div><br /></div><div><a href="http://www.htmlcommentbox.com/feature-requests.html#.UaiW00BkOuI" rel="nofollow" target="_blank">http://www.htmlcommentbox.com/feature-requests.html#.UaiW00BkOuI</a></div><div><br /></div><div>The following page is where, users can request for additional features, as you can clearly see from the picture that it is using the htmlcommentbox. All, i did was to inject the following payload into the messagebox:</div><div><br /></div><div><b><img src=x onerror=prompt(0);</b></div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinjEuxDVEYON9R4M6rzUX4dJHqHPrCLegZyvFXAW50lSSoHy6J_dU8yUyZS03BlFX9LDsaTNLLlI53wovfKgQVdc9kZqA_EddVQuKDjl8k-ESOTlgPPOEGE0D6Nuh1FpqgUlUJBGRjpPE/s1600/rafay2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="228" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinjEuxDVEYON9R4M6rzUX4dJHqHPrCLegZyvFXAW50lSSoHy6J_dU8yUyZS03BlFX9LDsaTNLLlI53wovfKgQVdc9kZqA_EddVQuKDjl8k-ESOTlgPPOEGE0D6Nuh1FpqgUlUJBGRjpPE/s640/rafay2.png" width="577" /></a></div><div><br /></div><div><div><h4>Second Issue - Reflected XSS</h4></div></div><div>Well, this is not it, We have more for you, Implementing HTMLCommentBox also makes your website vulnerable to a non persistent xss.<br /><br />Let's take a closer look at their script that users would implement on their page:</div><div><br /></div><blockquote class="tr_bq"><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">(function(){var s=document.createElement("</span><wbr style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;"></wbr><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">script"),</span><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">l=(""+window.location || hcb_user.PAGE),</span><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">h="//</span><a href="http://www.htmlcommentbox.com/" style="background-color: white; color: #1155cc; font-family: arial, sans-serif; font-size: 13px;" target="_blank">www.<span class="il" style="background-color: #ffffcc; background-position: initial initial; background-repeat: initial initial; color: #222222;">htmlcommentbox</span>.com</a><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">";</span><wbr style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;"></wbr><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">s.setAttribute("type","text/</span><wbr style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;"></wbr><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">javascript");s.setAttribute("</span><wbr style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;"></wbr><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">src",</span><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">h+"/jread?page="+</span><wbr style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;"></wbr><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">encodeURIComponent(l).replace(</span><wbr style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;"></wbr><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">"+","%2B")+"&opts=16862&num=</span><wbr style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;"></wbr><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">10");if</span><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">(typeof s!="undefined")</span><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">document.getElementsByTagName(</span><wbr style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;"></wbr><span style="background-color: white; color: #222222; font-family: arial, sans-serif; font-size: 13px;">"head")[0].appendChild(s);})()</span></blockquote><div>If you closely look at the window.location portion, you would find that <b>encodeURIComponent </b>allows single quotes. If we just replace window.location with our alert statement, it would triggered under the script context, Hence making the website vulnerable to a xss. And the <b>/jread?page='-prompt(1)-'&opt=x&num=y</b>, this would be reflected under the page context.</div><div>So the POC would be as follows:</div><div><br /></div><div><b>http://www.htmlcommentbox.com/?'-prompt(1)-'</b></div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhV56hIRbpLqkfm7DV9FyK6Y853brKFTYEt7Cxoc6Y_fKbaNeY8WzTFrJE-MKE9-AyVAFR-n9LibSVfcKrv8i6lKfGAtDLIBgwgO6m5973yfHcLAwTl4jfOQvm8g43pJoXMTzp6OuoPbUo/s1600/rafay3.png" imageanchor="1"><img border="0" height="208" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhV56hIRbpLqkfm7DV9FyK6Y853brKFTYEt7Cxoc6Y_fKbaNeY8WzTFrJE-MKE9-AyVAFR-n9LibSVfcKrv8i6lKfGAtDLIBgwgO6m5973yfHcLAwTl4jfOQvm8g43pJoXMTzp6OuoPbUo/s640/rafay3.png" width="577" /></a></div><div><br /></div><div><br /></div><div><b>Again, I am very thankful to @pepevila for pointing the second issue. </b><br /><br />The lesson to be learned is business that rely on or use third part scripts on their website, Should use well known scripts and make sure that they are not vulnerable to any attacks or atleast research if their haven't been any issues with them in past, because often times these third party scripts are responsible for the security breaches.<br /><br />Take an example from this case study, Where using a third party script to host comments introduced High risk security vulnerabilities. Any one using this script on their websites are requested to immediately remove it.</div></div>

Introducing Evil In Your Website With Untrusted Third Party Scripts

This is a small case study, where my aim is to explain why you shouldn't use untrusted third party scripts on your website. Htmlcommentb...

+ Read more »

DOM Based XSS In AVG

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><img src="https://twimg0-a.akamaihd.net/profile_images/1272438885/DOMInatrixss.png" /></div><br />Lately, i have been researching on DOM based XSS a bit, Recently i found a DOM based XSS in AVG, DOM based XSS is caused due to lack of input filtering inside client side javascripts, since most of the code is moving towards client side, therefore DOM based xss have been very common now a days, It is predicted by the experts that the DOM based xss mostly occurs in the websites that heavily rely upon javascripts.<br /><a name="more"></a><br />With that being said, let's take a look at the DOM based XSS POC:<br /><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiA6mhfVuxJFwNtoFqhv2jltHkiM9-rqw-98pnbB0sLy7R2_HsHvyNBcp-Dcmt7hiyQG0ZAxkovSPw-YMsKyld7p5f9n-vjNfZkN0dIILt6gYTQNrmrIf8m4yslBgED9kv8S4HLrd2MPIw/s1600/AVG.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="348" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiA6mhfVuxJFwNtoFqhv2jltHkiM9-rqw-98pnbB0sLy7R2_HsHvyNBcp-Dcmt7hiyQG0ZAxkovSPw-YMsKyld7p5f9n-vjNfZkN0dIILt6gYTQNrmrIf8m4yslBgED9kv8S4HLrd2MPIw/s640/AVG.png" width="577" /></a><br /><br /><br />The vulnerability is the result of lack of escaping done in "js_stdfull.js". The following is the screen shot of the vulnerable code causing the DOM based XSS:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIabGoCleJQiab9yCez31enmHeMwrntvR5vO0m5GB06X244h0fuiShvMG2wtII5zLLOm-AO_gVD10ZHkPd4NrQTRsSTICP0L9p2Gdks9IpPrfHgYQdjH1hJU9_AZZPrTnbBc27h6wTeBE/s1600/AVG-DOM-XSS.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="77" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIabGoCleJQiab9yCez31enmHeMwrntvR5vO0m5GB06X244h0fuiShvMG2wtII5zLLOm-AO_gVD10ZHkPd4NrQTRsSTICP0L9p2Gdks9IpPrfHgYQdjH1hJU9_AZZPrTnbBc27h6wTeBE/s640/AVG-DOM-XSS.png" width="640" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><b>Vulnerable code:</b><br /><br /> //display the correct tab based on the url (#name) var pathname = $(location).attr('href');var urlparts = pathname.split("#"); <br /><br />I would like to give full credits to <b>David Vieira-Kurz from Majorsecurity.com (@secalert)</b>, for helping me sort out the vulnerable code.<br /><br />Yet another security researcher, David Sopas also found the same issue but on the English version of the site:<br /><b><br />http://labs.davidsopas.com/2013/01/avg-vulnerable-to-dom-xss.html</b></div>

DOM Based XSS In AVG

Lately, i have been researching on DOM based XSS a bit, Recently i found a DOM based XSS in AVG, DOM based XSS is caused due to lack of inpu...

+ Read more »

ifixit.com Stored XSS Vulnerability

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxuaK4gZ-02gNN8uQrnafEvNODgSCcYXIS2M5i8sbdnMbZUIx2b6nAb186DN9XYuWaJIn_uWMaRVvoSK-c0lqHbEtp3uecbjyS0ibeY1Nf1K6_wyqlGADu7bL_UsiztnPHTHZDfE5yJ88/s1600/3444991_300.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxuaK4gZ-02gNN8uQrnafEvNODgSCcYXIS2M5i8sbdnMbZUIx2b6nAb186DN9XYuWaJIn_uWMaRVvoSK-c0lqHbEtp3uecbjyS0ibeY1Nf1K6_wyqlGADu7bL_UsiztnPHTHZDfE5yJ88/s1600/3444991_300.jpg" /></a></div><br />Well, it has been a long time, since i haven't posted any thing, i was a bit busy with my university exams, However, finally i managed to get some time to write something, Today i am sharing some of the vulnerabilites i found inside a popular website named "ifixit".<br /><br />I found two XSS one was a Stored XSS and a second one was a Self XSS, However the Self-XSS could have been easily exploited by <a href="http://www.rafayhackingarticles.net/2012/03/hijacking-facebook-users-clickjacking.html">Clickjacking</a> techniques as the page did not contain X-Frame options, Therefore the Self-XSS was also considered.<br /><a name="more"></a>I have created a short POC of the Stored Cross Site Scripting vulnerability (XSS), I hope you enjoy it:<br /><h4>iFixit Stored Cross Site Scritping [Video POC]:</h4><div class="separator" style="clear: both; text-align: center;"><object class="BLOGGER-picasa-video" classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0" data-thumbnail-src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCh231PqAjnAwXn89W-ORZgO2BXtB8yGdk3_vRXcE-9jGlXvjDA0hvKTCxCWncrU6hH_pMJVrfPxwckgglpyi_dyoogmFbc-BgkQw9zojACSk8-QMJGRkKcPorSzH3Fb1coX6QdisHTIo/s1600/IFIXIT+PERSISTANT+XSS.mp4" height="266" width="320"><param name="movie" value="http://video.google.com/googleplayer.swf?videoUrl=http%3A%2F%2Fredirector.googlevideo.com%2Fvideoplayback%3Fid%3D9d051db678d3e474%26itag%3D18%26source%3Dpicasa%26cmo%3Dsensitive_content%253Dyes%26ip%3D0.0.0.0%26ipbits%3D0%26expire%3D1359573833%26sparams%3Did%2Citag%2Csource%2Cip%2Cipbits%2Cexpire%26signature%3D378B4B2BA68625B19EB48547219A3B5EF20046F6.1D02A16C189B80C6132AD48CA50A719DE23CE000%26key%3Dlh1" /><param name="bgcolor" value="#FFFFFF" /><param name="allowFullScreen" value="true" /><embed width="577" height="266" src="http://video.google.com/googleplayer.swf?videoUrl=http%3A%2F%2Fredirector.googlevideo.com%2Fvideoplayback%3Fid%3D9d051db678d3e474%26itag%3D18%26source%3Dpicasa%26cmo%3Dsensitive_content%253Dyes%26ip%3D0.0.0.0%26ipbits%3D0%26expire%3D1359573833%26sparams%3Did%2Citag%2Csource%2Cip%2Cipbits%2Cexpire%26signature%3D378B4B2BA68625B19EB48547219A3B5EF20046F6.1D02A16C189B80C6132AD48CA50A719DE23CE000%26key%3Dlh1" type="application/x-shockwave-flash" allowfullscreen="true"></embed></object></div><h4>iFixit Self-XSS POC</h4><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj10EFLiiZpdx-jm7VsoJaMMZ90YuIuN49j1X9If3YBIKctf6_2R1SvVbvWrbvGWOEQ8rk8sRYbYwnCSJ6I4uUSYl09KCc6oezYAGiwuJmCHbZi365zoDOlfsfzbyHuGUkStCzv9Eb3zJ4/s1600/ifixit.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj10EFLiiZpdx-jm7VsoJaMMZ90YuIuN49j1X9If3YBIKctf6_2R1SvVbvWrbvGWOEQ8rk8sRYbYwnCSJ6I4uUSYl09KCc6oezYAGiwuJmCHbZi365zoDOlfsfzbyHuGUkStCzv9Eb3zJ4/s640/ifixit.png" width="577" /></a></div><br />For the above vulnerabilities, i was listed inside ifixit.com's responsible disclosure page:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUEFYQ72Q8Ur7jmaGeWrlUQa52VmlwoFYTnCUtsTc5sglVYjWrF_Zvww_1eCqQPHx8ri-yYuzcshcmPqJgabpIVudN2bn7mZW4uXa7Q_Ns-nrJE-JAVKFI9jZgauZxD_ieGi1rvpIF81M/s1600/ifixit.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="604" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUEFYQ72Q8Ur7jmaGeWrlUQa52VmlwoFYTnCUtsTc5sglVYjWrF_Zvww_1eCqQPHx8ri-yYuzcshcmPqJgabpIVudN2bn7mZW4uXa7Q_Ns-nrJE-JAVKFI9jZgauZxD_ieGi1rvpIF81M/s640/ifixit.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>Along with it, they also sent me two T-Shirts, some stickers and a 54 bit driver toolkit:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtNiRuUnnHDYytLHzl-BXDZH5BOpIqHg3m7ZV8Sfip0_msAZeu4uEZrxnBrjFft5nowVQgatoSUgt90dghhRHFltaTXFZTxOpN8pDexemSZPud3jwoEHuakJJduZ2UT4iBDArGubH-h-w/s1600/IMAG0545.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="428" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtNiRuUnnHDYytLHzl-BXDZH5BOpIqHg3m7ZV8Sfip0_msAZeu4uEZrxnBrjFft5nowVQgatoSUgt90dghhRHFltaTXFZTxOpN8pDexemSZPud3jwoEHuakJJduZ2UT4iBDArGubH-h-w/s640/IMAG0545.jpg" width="577" /></a></div></div>

ifixit.com Stored XSS Vulnerability

Well, it has been a long time, since i haven't posted any thing, i was a bit busy with my university exams, However, finally i managed t...

+ Read more »