Sony PSN Community Lithium Forums 2012 Q4 XSS

`Title:  
======  
Sony PSN Community - Persistent Web Vulnerability  
  
  
Date:  
=====  
2013-05-04  
  
  
References:  
===========  
http://www.vulnerability-lab.com/get_content.php?id=746  
  
  
VL-ID:  
=====  
746  
  
  
Common Vulnerability Scoring System:  
====================================  
3.5  
  
  
Introduction:  
=============  
PlayStation Network, often abbreviated as PSN, is an online multiplayer gaming and digital media delivery service provided/run   
by Sony Computer Entertainment for use with the PlayStation 3, PlayStation Portable, and PlayStation Vita video game consoles.   
The PlayStation Network is the video game portion of the Sony Entertainment Network.  
  
(Copy of the Homepage: http://en.wikipedia.org/wiki/PlayStation_Network)  
  
  
Abstract:  
=========  
The Vulnerability Laboratory Research Team discovered a persistent web vulnerability in Sony`s official PSN Community Website Application.  
  
  
Report-Timeline:  
================  
2012-11-01: Researcher Notification & Coordination  
2012-11-02: Vendor Notification  
2013-05-05: Public Disclosure  
  
  
Status:  
========  
Published  
  
  
Affected Products:  
==================  
Sony  
Product: PSN Community - Lithium Forums 2012 Q4  
  
  
Exploitation-Technique:  
=======================  
Remote  
  
  
Severity:  
=========  
High  
  
  
Details:  
========  
Multiple persistent input validation vulnerabilities are located in Sony`s official PSN Community Website Application.  
The bug allows remote attackers with low account privileges to inject via editor & replace function own malicious   
persistent script codes. The vulnerabilities are located in the forum editor module with the replace function and the   
bound vulnerable message titel, subject and link parameters. Remote attackers can compose malicious forum posts to   
hijack psn admin/moderator/customer accounts. Successful exploitation result in persistent web context manipulation,   
application side phishing, persistent malware loads, external redirects or persistent session hijacking via forum messages.  
  
  
Vulnerable Section(s):  
[+] Skype Community (Forums) - Lithium Forum  
  
Vulnerable Module(s):  
[+] Editor (in combination with the replace all function to execute)  
  
Vulnerable Parameter(s):  
[+] Message Subject, Topic Title & Link Widget  
  
  
Proof of Concept:  
=================  
The vulnerability can be exploited by remote attackers with low or medium required user inter action and with low privileged   
psn application service user account. For demonstration or reproduce ...  
  
  
PoC:  
  
<label for="lia-subject" class="lia-form-label">Subject</label>  
  
<input style="" class="lia-form-subject-input lia-form-type-text lia-form-input-vertical"   
maxlength="2000"   
value=>"<>>"><[PERSISTENT INECTED SCRIPT CODE!]"Re: Bug Report VL ID 740 " id="lia-subject" name="subject" type="text">  
  
... or in the body  
  
  
<a target="_self" title=<>>"><[PERSISTENT INECTED SCRIPT CODE!]" data-mce-href="<>>"><[PERSISTENT INECTED SCRIPT CODE!] >"  
<>"<<>>"><[PERSISTENT INECTED SCRIPT CODE!]>" href="http://>"<>"<<>>"><[PERSISTENT INECTED SCRIPT CODE!]>.com   
>"<>"<<>>"><[PERSISTENT INECTED SCRIPT CODE!]>">>"<>"<<>>"><[PERSISTENT INECTED SCRIPT CODE!]">   
>"<>"<iframe src=http://vw.de></iframe></a>  
  
  
  
Reference(s): (SIMULATION - TEST)  
http://community.eu.playstation.com/t5/forums/replypage/board-id/bDE_PSNSupport/message-id/18905  
  
  
Reference(s):  
../compose.htm  
../compose2.htm  
  
  
Picture(s):  
../1.png  
../2.png  
../3.png  
../4.png  
  
  
Risk:  
=====  
The security risk of the persistent input validation vulnerabilities are estimated as medium(+)||(-)high.  
  
  
Credits:  
========  
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected])  
  
  
Disclaimer:  
===========  
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,   
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-  
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business   
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some   
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation   
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases   
or trade with fraud/stolen material.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register  
Contact: [email protected] - [email protected] - [email protected]  
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com  
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php  
  
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.   
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other   
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and   
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),   
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.  
  
Copyright © 2013 | Vulnerability Laboratory  
  
  
  
--   
VULNERABILITY RESEARCH LABORATORY  
LABORATORY RESEARCH TEAM  
CONTACT: [email protected]  
  
`