Advisories 2016

2016-001: Desk.com is affected by Reflected Cross-Site Scripting vulnerability

2016-002: Stored XSS in Google Sites

2016-001: Desk.com is affected by Reflected Cross-Site Scripting vulnerability

Original release date: February 16, 2016
Last revised: February 16, 2016
Discovered by: José Antonio Pérez Piedra
Severity: 6.1/10 (CVSSv3 Base Metrics)

BACKGROUND

Desk(.)com is a help desk solution which allows companies to handle both traditional 1-to-1 communications as well as monitor and respond to social media. It also provides email support system and knowledgebase.

DESCRIPTION

Desk(.)com is affected by Reflected Cross-Site Scripting vulnerability in the email contact form. The vulnerable resource does not properly check the type of the parameters passed to the application through GET requests. It allows malicious users to bypass the sanitizer and execute arbitrary HTML/script code in the context of the victim's browser.

PROOF OF CONCEPT

                   The affected resource is:
                   /customer/portal/emails/new
	
                   All GET parameters are affected by this vulnerability, for example:
                   email[body]
                   email[subject]
                   interaction[email]
                   interaction[name]

The application does not filter the parameters if they are passed as nested arrays and reflects its content in the response.

Here is a PoC:		
⁄customer⁄portal⁄emails⁄new?email[body]=&email[subject][]=asd'>
	<img onerror="prompt(1)" src="x" ⁄>&interaction[email]=&interaction[name]=

BUSINESS IMPACT

An attacker can execute arbitrary HTML or script code in a targeted user's browser, this can leverage to steal sensitive information as user credentials, personal data, etc.

SYSTEMS AFFECTED

www.desk.com

SOLUTION

This vulnerability have been corrected.

REFERENCES

- http://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
See Proof of Concept of exploitation in our Youtube channel.

CREDITS

This vulnerability has been discovered by José Antonio Pérez Piedra, japerez (at) isecauditors (dot) com.

REVISION HISTORY

February 16, 2016: Initial release

DISCLOSURE TIMELINE

November 4, 2015: Vulnerability acquired by Internet Security Auditors
November 6, 2015 Contact with Desk.com Security Team
December 1, 2015: Internet Security Auditors confirm that the bug have bveen corrected.
February 16, 2016: Advisory published.

LEGAL NOTICES

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.

ABOUT

Internet Security Auditors is a Spain based leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us.

2016-002: Stored XSS in Google Sites

Original release date: February 16, 2016
Last revised: February 16, 2016
Discovered by: Fabián Cuchietti
Severity: 6.1/10 (CVSSv3 Base Metrics)

BACKGROUND

Google Sites is a structured wiki and Web page-creation tool offered by Google as part of the Google Apps for Work productivity suite. The goal of Google Sites is for anyone to be able to create a team-oriented site where multiple people can collaborate and share files.

DESCRIPTION

It possible to bypass the restriction on JavaScript execution in Google with article by embedding an <iframe> with a data and base64. The persistent (or stored) XSS vulnerability is a more devastating variant of a cross-site scripting flaw: it occurs when the data provided by the attacker is saved by the server, and then permanently displayed on &quot;normal&quot; pages returned to other users in the course of regular browsing, without proper HTML escaping. The affected resource is https://sites.google.com/isecauditorstest/ when you create/Edit a new article. </iframe>

PROOF OF CONCEPT

First XSS:
1) Go to: https://sites.google.com/
2) Create > Blank template > Site Name: > Create
3) Browse to the URL vulnerable: https://sites.google.com/site/isecauditorstest/ (example)
4) Edit > HTML > here insert the following payload: "><iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4">
5) To update
6) PoC: https://sites.google.com/site/isecauditorstest/

Second XSS:
1) Browse to URL vulnerable: https://sites.google.com/site/isecauditorstest/ (example)
2) Create Page
3) Assign a name to your site: > Select a template: File cabinet > Create
4) Add file > select our file * .swf > Copy the link to "See"
5) PoC: https://sites.google.com/site/isecauditorstest/test-xssed/isec_flashxss....

BUSINESS IMPACT

An attacker can execute arbitrary HTML or script code in a targeted user&#39;s browser. This can leverage to steal sensitive information as google email, user credentials, personal data, etc.

SYSTEMS AFFECTED

https://sites.google.com/

SOLUTION

This vulnerability have been corrected.

REFERENCES

- http://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
See Proof of Concept of exploitation in our Youtube channel.

CREDITS

This vulnerability has been discovered by Fabi&aacute;n Cuchietti (ofcuchietti (at) isecauditors (dot) com).

REVISION HISTORY

February 16, 2016: Initial release

DISCLOSURE TIMELINE

December 13, 2015 Vulnerability acquired by Internet Security Auditors December 13, 2015 Contact with Google Security Team December 14, 2015 Vendor Response/Feedback February 16, 2016 Advisory published.

LEGAL NOTICES

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.

ABOUT

Internet Security Auditors is a Spain based leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us.