Virgin Mobile Cross Site Scripting

`Document Title:  
===============  
Virgin Mobile Client Side XSS Vulnerability  
  
Release Date:  
=============  
2015-10-22  
  
Common Vulnerability Scoring System:  
====================================  
3.4  
  
  
Product & Service Introduction:  
===============================  
Virgin Mobile is a celluar company operating in the US and Canada.  
  
  
Abstract Advisory Information:  
==============================  
An independent researcher discovered a client-side cross site scripting web vulnerability in the official Virgin Mobile online service web-application.  
  
  
Vulnerability Disclosure Timeline:  
==================================  
2015-10-16: Discovery  
2015-10-19: Initial contact to [email protected]  
2015-10-19: Vendor replies and requests more information  
2015-10-20: Additional information provided along with PoC  
2015-10-22: Vendor Released Patch  
  
  
Discovery Status:  
=================  
Published  
  
  
Affected Product(s):  
====================  
Virgin Mobile  
  
  
Exploitation Technique:  
=======================  
Remote  
  
  
Severity Level:  
===============  
Medium  
  
  
Technical Details & Description:  
================================  
Request Method(s):  
[+] GET  
  
Vulnerable Service(s):  
[+] Virgin Mobile (virginmobile.ca)  
  
Vulnerable Module(s):  
[+] Search  
  
Vulnerable Parameter(s):  
[+] q  
  
Affected Section(s):  
[+] Merchant Search Results  
  
  
Proof of Concept (PoC):  
=======================  
The client-side cross site scripting web vulnerability can be exploited by remote attackers without privileged application user account and with low user interaction (click).  
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.  
  
PoC:   
  
http://www.virginmobile.ca/en/search/search.html?q=%27%3E%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28String.fromCharCode%2888%2C83%2C83%2C80%2C79%2C83%2C69%2C68%29%29%3E&local=yes&x=54&y=25&province=ON&geoResult=failed  
  
Solution - Fix & Patch:  
=======================  
2015-10-15: Vendor Fix/Patch (Virgin Mobile - Developer Team)  
  
  
Credits & Authors:  
==================  
Tommy DeVoss - ([email protected])  
  
  
`