OKCupid Cross Site Scripting

🗓️ 21 Sep 2014 00:00:00Reported by Kenneth F. BelvaType

packetstorm🔗 packetstormsecurity.com👁 25 Views

OKCupid Server Error Page XSS, High Severity, CVE-ID: CVE-2014-3148

Reporter	Title	Published	Views	Family All 8
FreeBSD	cURL -- multiple vulnerabilities	22 Apr 201500:00	–	freebsd
CNVD	OkCupid OKWS Cross-Site Scripting Vulnerability	6 Sep 201500:00	–	cnvd
CVE	CVE-2014-3148	31 Aug 201518:00	–	cve
Cvelist	CVE-2014-3148	31 Aug 201518:00	–	cvelist
EUVD	EUVD-2014-3166	7 Oct 202500:30	–	euvd
Tenable Nessus	FreeBSD : cURL -- multiple vulnerabilities (6294f75f-03f2-11e5-aab1-d050996490d0)	27 May 201500:00	–	nessus
NVD	CVE-2014-3148	31 Aug 201518:59	–	nvd
Prion	Cross site scripting	31 Aug 201518:59	–	prion

`Title: OKCupid Server Error Page XSS  
Severity: High  
CVE-ID: CVE-2014-3148  
Re-release: 20 September 2014   
Author: Kenneth F. Belva  
Websites: http://silverbackventuresllc.com  
http://xssWarrior.com   
http://securitymaverick.com  
Twitter: @infosecmaverick  
Contact: Please use website contact form.  
Mail:   
URL: https://github.com/okws/okws  
Vendor:   
Remote Exploit: Yes  
  
  
Description:  
============  
  
A non-existent page triggers the vulnerable XSS page.  
  
  
  
Proof of Concept :  
==================  
  
http://okcupidserver/none/[code]  
  
  
Various URLs :  
==================  
  
Public Release:  
https://twitter.com/infosecmaverick/status/462573038299803648  
  
Hacker1:  
https://hackerone.com/reports/3317  
  
Git Credit and Correction:  
https://github.com/okws/okws/commit/e9bedb644d106a043e33e1058bedd1c2c0b2e2e0  
  
  
Solution:  
=========  
  
Upgrade.  
  
  
Remarks:  
========  
  
Thanks to @Sidnicious at OKCupid for such a quick fix and responsiveness  
  
  
  
`

21 Sep 2014 00:00Current

6.7Medium risk

Vulners AI Score6.7

EPSS0.00256