SevenIT SevDesk 3.10 Cross Site Scripting

`Document Title:  
===============  
SevenIT SevDesk 3.10 - Multiple Web Vulnerabilities  
  
  
References (Source):  
====================  
http://www.vulnerability-lab.com/get_content.php?id=1314  
  
  
Release Date:  
=============  
2015-03-23  
  
  
Vulnerability Laboratory ID (VL-ID):  
====================================  
1314  
  
  
Common Vulnerability Scoring System:  
====================================  
5.9  
  
  
Product & Service Introduction:  
===============================  
The integrated customer management, digital customer file is the central record for a single customer. invoices, facilities and operations   
to a customer are stored centrally automated in one place. So the customer file is always up to date. For faster retrieval or reporting   
contacts can be tagged. In addition, with powerful. Search options you have as the entire customer base better than ever in view.  
  
Daily backup  
256bit SSL encryption  
TÜV certified datacenter  
  
Free version  
No hidden costs  
No minimum contract term  
  
iPhone App  
Runs in any browser  
No installation required on the PC  
  
Easy to use  
Reduced to the essentials  
Automated, where it is only Possible  
  
(Copy of the Vendor Homepage: https://sevdesk.de/)  
  
  
Abstract Advisory Information:  
==============================  
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official SEVENIT GmbH SevDesk v3.10 web-application & cloud online-service.  
  
  
Vulnerability Disclosure Timeline:  
==================================  
2014-09-01: Researcher Notification & Coordination (Benjamin Kunz Mejri)  
2014-09-02: Vendor Notification (SevDesk Developer Team)  
2014-09-07: Vendor Response/Feedback (SevDesk Developer Team)  
2015-02-01: Vendor Fix/Patch Notification (SevDesk Developer Team)  
2015-03-23: Public Disclosure (Vulnerability Laboratory)  
  
  
Discovery Status:  
=================  
Published  
  
  
Affected Product(s):  
====================  
SevenIT  
Product: SevDesk - Web Application 3.1.0  
  
  
Exploitation Technique:  
=======================  
Remote  
  
  
Severity Level:  
===============  
High  
  
  
Technical Details & Description:  
================================  
Multiple persistent input validation web vulnerabilities are detected in the official SEVENIT Software GmbH - sevDesk v3.10 web-application.  
The vulnerability allows remote attackers or low privileged user account to inject own malicious script codes to the application-side of the   
vulnerable web-application module or service.  
  
The security vulnerability is located in the `firstname`, `surname` & `family` name values of the main sevDesk `Dasboard` application module.  
Remote attackers are able to inject own codes to the main dashboard service by manipulation of the registration username. The execution of   
the injected script code occurs on the application-side in the main dasboard module through the rightHead and feedcontent class. The attack   
vector is persistent and the request method to inject the code is POST. The victim user can also change the name by usage of the application   
which does not require an admins interaction on successful exploitation.  
  
The security risk of the persistent script code inject web vulnerabilities is estimated as medium with a cvss (common vulnerability scoring system)   
count of 5.9. Exploitation of the persistent vulnerability requires a low privileged sevdesk user account with restricted access and no direct   
user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent external redirects   
to malicious source and persistent manipulation of affected or connected application modules.  
  
  
Request Method(s):  
[+] POST  
  
Vulnerable Module(s):  
[+] Registration to SevDesk  
  
  
Vulnerable Parameter(s):  
[+] surname  
[+] firstname  
[+] family name  
  
Affected Module(s):  
[+] Dasboard Index - rightHead & feedcontent  
  
  
Proof of Concept (PoC):  
=======================  
The persistent input validation web vulnerability can be exploited by low privileged application user accounts with low user interaction.  
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.  
  
Manual steps to reproduce the vulnerability  
  
1. Register an account by usage of the following webpage https://my.sevdesk.de/register/  
2. Include to the surname, family name and firstname your own script code as payload  
3. Save the registration form and go to the website https://my.sevdesk.de/  
4. Login with the user account data  
5. The execution of the injected script code occurs after the registration POST method request and next to the redirect in the main dasboard index (rightHead < name > feedcontent)  
6. Successful reproduce of the application-side security vulnerability!  
  
  
PoC: rightHead > Displayname (First- & Lastname)  
  
<div id="middleHead">  
<input id="suche" type="text" onfocus="this.value = ''" value="Gehe zu Kontakt, Projekt, Dokument..." />   
</div>  
<div id="rightHead">  
<div style="float:right;margin-top:5px;text-align: right;padding-right:5px;">  
<div style="color:#fff;padding:3px;margin-bottom:2px;">  
<span style="color:#f5d385;font-weight:bold;">a>"<[PERSISTENT INJECTED SCRIPT CODE VIA NAME VALUE!]> b>"</span></div>   
<a href="/admin/company">Einstellungen</a> |   
<a href="http://portal.sevdesk.de/" target="_blank">Hilfe</a> | <a href="./auth/logout/">Logout</a>  
</div>  
</div>  
</div>   
</div>  
<div id="headNav" style="top:80px;">  
<div class="headwrapper">  
<ul id="mainNavigation">  
  
  
PoC: Verlauf > feedcontent  
  
<div>  
<div class="feed" id_feed="393424"><div class="imgpos"><img src="/img/icons/24x24/offer.png"></div><div class="feedbody">  
<div class="headline">Samstag, 30. August 2014 - 02:14</div><div class="feedcontent">  
a>"<[PERSISTENT INJECTED SCRIPT CODE VIA NAME VALUE!]> b>"<[PERSISTENT INJECTED SCRIPT CODE VIA NAME VALUE!]> hat den Status des   
<img src="/img/icons/16x16/offer.png"> <a href="/om/detail/index/id/60547">Angebots - 1007</a> auf  
"archiviert" geändert  
</div></div><div class="clearfix"></div></div>  
<div class="feed" id_feed="393423"><div class="imgpos"><img src="/img/icons/24x24/offer.png"/></div><div class="feedbody">   
<div class="headline">Samstag, 30. August 2014 - 02:14  
  
  
  
--- PoC Session Logs [POST] (Registration sevDesk) ---  
Status: 200[OK]  
POST https://my.sevdesk.de/register/save Load Flags[LOAD_BYPASS_CACHE LOAD_BACKGROUND ] Größe des Inhalts[94] Mime Type[text/html]  
Request Header:  
Host[my.sevdesk.de]  
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0]  
Accept[application/json, text/javascript, */*; q=0.01]  
Accept-Language[de,en-US;q=0.7,en;q=0.3]  
Accept-Encoding[gzip, deflate]  
Content-Type[application/x-www-form-urlencoded; charset=UTF-8]  
X-Requested-With[XMLHttpRequest]  
Referer[https://my.sevdesk.de/register]  
Content-Length[119]  
Cookie[PHPSESSID=63m788aic41f173a01akttgp24; optimizelySegments=%7B%7D; optimizelyEndUserId=oeu1409658038644r0.9444753343384411;   
optimizelyBuckets=%7B%7D; __utma=47898149.1078820709.1409658041.1409658041.1409658041.1; __utmb=47898149.3.10.1409658041; __utmc=47898149;   
__utmz=47898149.1409658041.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); kvcd=1409658049586;   
km_ai=5La%2FUBeVvA7zRXwSTd4gSRBJccE%3D; km_uq=; km_vs=1; km_lv=1409658050; _ga=GA1.2.1078820709.1409658041]  
Connection[keep-alive]  
Pragma[no-cache]  
Cache-Control[no-cache]  
POST-Daten:  
name[[PERSISTENT INJECTED SCRIPT CODE VIA NAME VALUE!]]  
surename[[PERSISTENT INJECTED SCRIPT CODE VIA SURNAME VALUE!]]  
familyname[[PERSISTENT INJECTED SCRIPT CODE VIA FAMILY NAME VALUE!]]  
username[support%40vulnerability-lab.com]  
password[chaos666]  
Response Header:  
Date[Tue, 02 Sep 2014 11:44:30 GMT]  
Server[Apache/2.2.22 (Debian)]  
X-Powered-By[PHP/5.4.4-14+deb7u7]  
Expires[Thu, 19 Nov 1981 08:52:00 GMT]  
Cache-Control[no-store, no-cache, must-revalidate, post-check=0, pre-check=0]  
Pragma[no-cache]  
Vary[Accept-Encoding]  
Content-Encoding[gzip]  
Content-Length[94]  
Keep-Alive[timeout=5, max=99]  
Connection[Keep-Alive]  
Content-Type[text/html; charset=utf-8]  
  
  
Reference(s):  
https://my.sevdesk.de/register/save  
  
  
Solution - Fix & Patch:  
=======================  
The vulnerbility can be patched by a secure parse and encode of the affected rightHead & feedcontent values in the dashboard application index.  
Filter and restrict the user registration input form with a secure mask or exception-handling to prevent persistent code injections in the important name values.  
  
Note: The issue has been patched by the manufacturer since 2015-02-01  
  
  
Security Risk:  
==============  
The security risk of the persistent input validation web vulnerabilities in the main dasboard application is estimated as medium. (CVSS 5.9)  
  
  
Credits & Authors:  
==================  
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected]) [www.vulnerability-lab.com]  
  
  
Disclaimer & Information:  
=========================  
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed   
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable   
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab   
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for   
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,   
policies, deface websites, hack into databases or trade with fraud/stolen material.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com  
Contact: [email protected] - [email protected] - [email protected]  
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact  
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php  
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/  
  
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to   
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by   
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website   
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact   
([email protected] or [email protected]) to get a permission.  
  
Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™  
  
  
  
--   
VULNERABILITY LABORATORY - RESEARCH TEAM  
SERVICE: www.vulnerability-lab.com  
CONTACT: [email protected]  
PGP KEY: http://www.vulnerability-lab.com/keys/[email protected]%280x198E9928%29.txt  
  
`