Cetelem Online Bank Cross Site Scripting / Clickjacking

`===============================================================================================================================================================================================  
CETELEM ON LINE BANK Cross Site Scripting ( and DOM Based XSS ) / Clickjacking: X-Frame-Options header missing / HTML form without CSRF protection  
===============================================================================================================================================================================================  
  
TIME-LINE VULNERABILITY  
  
Multiples Advisories but Vendor not response  
  
25-31 / 08 / 2013 Not Response ( Summer Time? )  
  
3-09-2013 Full Disclosure  
  
  
  
I. VULNERABILITY  
-------------------------  
#Title: CETELEM ON LINE BANK DOM Based Cross Site Scripting ( and DOM Based XSS ) / Clickjacking: X-Frame-Options header missing / HTML form without CSRF protection  
  
#Vendor:httpS://www.cetelem.es/  
  
#Author:Juan Carlos García (@secnight)  
  
#Follow me   
http://www.highsec.es  
Twitter:@secnight  
  
II. DESCRIPTION  
-------------------------  
  
Cetelem is a bank specializing in consumer lending (consumer credit, online credit and cards).  
  
Cetelem's main activity is the selling point funding, which accounts for 66.5% of its activity,  
which has more than 2,800 stores and more than 1,000 partners car dealers.  
  
The granting of credit cards, which represents 26% of its activity and now has about 500,000 active cards.  
  
The one major brands of BNP Paribas Personal Finance are:  
  
Cetelem (Argentina, Spain, France, Hungary, Portugal, Czech Republic, Romania, Russia, Slovakia)  
  
  
  
  
III. PROOF OF CONCEPT  
-------------------------  
  
  
  
Cross site scripting  
*********************  
  
Cross site scripting (also referred to as XSS) is a vulnerability that allows an attacker to send malicious  
code (usually in the form of Javascript) to another user. Because a browser cannot know if the script should be  
trusted or not, it will execute the script in the user context allowing the attacker to access any cookies  
or session tokens retained by the browser.   
  
  
Affected items  
  
/banco/creditos/unificacion-credito.jsp (2)  
  
"  
URL encoded GET input hidAcuerdo was set to BCO_CONSO" onmouseover=prompt(999458) bad="  
The input is reflected inside a tag parameter between double quotes.  
  
GET /banco/creditos/unificacion-credito.jsp?hidAcuerdo=BCO_CONSO%22%20onmouseover%3dprompt%28999458%29%20bad%3d%22&loadParam=false  
  
Variant  
  
URL encoded GET input hidAcuerdo was set to BCO_CONSO" onmouseover=prompt(999458) bad="  
  
  
LoadParam  
  
  
URL encoded GET input loadParam was set to false_930312():;922135  
The input is reflected inside <script> tag.  
  
GET /banco/creditos/unificacion-credito.jsp?hidAcuerdo=BCO_CONSO&loadParam=false_930312%28%29%3a%3b922135   
  
  
  
DOM-based Cross-Site Scripting  
******************************  
  
  
Attack details  
  
This vulnerability affects   
  
/banco/empresa/contacto.jsp.   
  
Script code from document.location path part was executed via document.write() or document.writeln() function.  
  
The code was executed in:  
  
https://www.ntrsupport.com/inquiero/web/an/ann4.asp?login=I23ECF50CC6BF1A9D700B43&lang=es&bgcolor=F5F3EE&txtcolor=009966&button=contacte_cetelem_new&ref=esta llamada viene desde el contacte de Cetelem.es&cat=SAC&cob=1  
  
  
/onlineCetelem/FcControlador.srvl.   
  
Script code from document.location path part was executed via document.write() or document.writeln() function.  
  
The code was executed in: https://www.ntrsupport.com/inquiero/web/an/ann4.asp?login=I23ECF50CC6BF1A9D700B43&lang=es&bgcolor=F5F3EE&txtcolor=009966&button=ayuda_zc&cat=direct&ref=esta llamada viene desde la calculadora&cob=1  
  
  
Clickjacking: X-Frame-Options header missing  
*********************************************  
  
Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of  
tricking a Web user into clicking on something different from what the user perceives they are clicking on,   
thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.   
  
The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking attack.  
The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page   
in a <frame> or <iframe>. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.   
This vulnerability affects Web Server.   
  
Request  
  
GET / HTTP/1.1  
Cookie: JSESSIONID=NbSfSlsWg6fYKt41d6ZSRhLWMZYdfBRHq2zLyhYGn1LKV4j92JGg!1612925708; CookieCTLM=1728053888.25115.0000  
Host: www.cetelem.es  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)  
  
Response  
  
HTTP/1.1 200 OK  
Date: Tue, 03 Sep 2013 00:24:24 GMT  
Content-Length: 196  
Content-Type: text/html; charset=ISO-8859-1  
X-Powered-By: Servlet/2.5 JSP/2.1  
  
  
HTML form without CSRF protection  
********************************  
  
Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF,   
is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts.  
  
Affected items  
  
/banco/bancodocs/js/camposAplicativo.js   
/banco/creditos/calcular-tasa-endeudamiento.jsp   
/banco/creditos/credito-medida.jsp   
/banco/creditos/unificacion-credito.jsp (650acedeac5b1b8ff8a5bcecd8fefb28)   
/banco/empresa/contacte-queja.jsp   
/banco/renting/renting-form-contacto.jsp   
/banco/renting/renting-formulario.jsp   
/onlineCetelem/FcControlador.srvl (03d0a02bcae74455d9c1db6e3e0ebc7d)   
/onlineCetelem/FcControlador.srvl (0701cfa9495bc159d8d7363dd3a16043)   
/onlineCetelem/FcControlador.srvl (0b38c4486c3a40b0acaacf30ac5b2f19)   
/onlineCetelem/FcControlador.srvl (9015d84e8de4ec0d46e99604a1d38094)   
/onlineCetelem/FcControlador.srvl (9b46e4dc609d87508e6f1a7762f99ed5)   
/onlineCetelem/FcControlador.srvl (a74fae0d1a6955158369d4baabefda8f)   
  
  
  
/banco/bancodocs/js/camposAplicativo.js.   
  
Form name: frm  
Form action: https://www.cetelem.es/banco/bancodocs/js/camposAplicativo.js  
Form method: POST  
  
Form inputs:  
  
hidOrigen [Hidden]  
hidCod_Material [Hidden]  
hidDestino [Hidden]  
hidImp_Financiar_Ent [Hidden]  
hidImp_Financiar_Dec [Hidden]  
hidDura [Hidden]  
hidProducto [Hidden]  
hidModalidad_Crto [Hidden]  
hidSeguro [Hidden]  
hidAplicativo [Hidden]  
hidAcuerdo [Hidden]  
hidCodigo [Hidden]  
hidDuracFija [Hidden]  
hidDuraMax [Hidden]  
hidDuraMin [Hidden]  
hidImpFijo [Hidden]  
hidImpMin [Hidden]  
hidImpMax [Hidden]  
hidSoloLectura [Hidden]  
  
One Example.. ( Too Many html form wtihout..)  
  
Request  
  
GET /banco/bancodocs/js/camposAplicativo.js HTTP/1.1  
Pragma: no-cache  
Referer: http://www.cetelem.es/banco/bancodocs/js/camposAplicativo.js  
  
HTML Response  
  
document.write('  
'); document.write(' '); document.write(' '); document.write(' '); document.write(' '); document.write(' ');  
document.write(' '); document.write(' '); document.write(' '); document.write(' '); document.write(' ');  
document.write(' '); document.write(' '); //a continuacin se van a incluir unos nuevos campos para las ofertas que tengan algun tipo de restriccion,  
estos // van a ser la duracion (minima,maxima, fija,),y el importe(minimo,maximo y fijo) document.write(' '); document.write(' ');   
document.write(' '); document.write(' '); document.write(' '); document.write(' '); document.write(' '); document.write('  
'); function mOvr(src) { src.style.cursor = 'hand'; } function mOut(src) { src.style.cursor = 'default'; }  
//FUNCION QUE OCULTA EL ESTADO function hidestatus() { window.status='' return true } if (document.layers) document.captureEvents(Event.MOUSEOVER |   
Event.MOUSEOUT) document.onmouseover=hidestatus document.onmouseout=hidestatus   
  
  
  
The impact of this vulnerability  
________________________________  
  
An attacker may force the users of a web application to execute actions of the attacker's choosing.  
A successful CSRF exploit can compromise end user data and operation in case of normal user.   
If the targeted end user is the administrator account, this can compromise the entire web application.  
  
How to fix this vulnerability  
_______________________________  
  
Check if this form requires CSRF protection and implement CSRF countermeasures if necessary.  
  
  
  
IV. BUSINESS IMPACT  
-------------------------  
This type of failure Banks On line they have so many customers are extremely dangerous because they   
can be a serious impact on customers. No bank can have bugs in the code. Customer trust can be affected  
  
V SOLUTION  
------------------------  
Write Secure Code  
  
  
VI. CREDITS  
-------------------------  
  
This vulnerability has been discovered  
by Juan Carlos García(@secnight)  
  
  
VII. LEGAL NOTICES  
-------------------------  
  
The Author accepts no responsibility for any damage  
caused by the use or misuse of this information.  
  
  
`