Document Title: =============== Pinterest Bug Bounty #1 - Persistent CNAME Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1431 Release Date: ============= 2015-06-29 Vulnerability Laboratory ID (VL-ID): ==================================== 1431 Common Vulnerability Scoring System: ==================================== 3.3 Product & Service Introduction: =============================== Pinterest is a web and mobile application company that offers a visual discovery, collection, sharing, and storage tool. Users create and share the collections of visual bookmarks (boards). Boards are created through a user selecting an item, page, website, etc. and pinning it to an existing or newly created board. Users save and share pins from multiple resources onto boards based on a plethora of criteria, e.g. similar characteristics, a theme, birthday parties, planning a vacation, writing a book, interior decorating, holidays. Boards can develop projects, organize events, or save pictures and data together. The site was founded by Ben Silbermann, Paul Sciarra and Evan Sharp. It is managed by Cold Brew Labs and funded by a small group of entrepreneurs and investors. (Copy of the Homepage: http://en.wikipedia.org/wiki/Pinterest ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered an application-side mail encoding and validation vulnerability in the official Pinterest online service web-application. Vulnerability Disclosure Timeline: ================================== 2015-01-30: Researcher Notification & Coordination (Benjamin Kunz Mejri) 2015-01-31: Vendor Notification (Pinterest Bug Bounty Program) 2015-02-06: Vendor Response/Feedback (Pinterest Bug Bounty Program) 2015-02-18: Vendor Fix/Patch Notification (Pinterest - Developer Team) 2015-06-30: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Pinterest Product: Pinterest - Online Service Web Application 2015 Q1 Exploitation Technique: ======================= Remote Severity Level: =============== Low Technical Details & Description: ================================ A persistent mail encoding web vulnerability has been discovered in the official Pinterest Web-Application (API). The application-side issue allows remote attackers to compromise emails by injection of own malicious persistent context. The application-side validation and encoding vulnerability is located in the `contact_name` value of the User Profile > Kontaktperson input field. Remote attackers are able to inject on registration user emails or random mails with script code in the Kontaktperson input field (contact_name) of the user profile. Remote attackers can inject the code on registration and local attackers can use Kontoeinstellungen module. After the inject of malicious script code the service stores the account in the database management system. The service captures with the wrong encoding the user input and sends it in the pinterest tip to the saved or changed email. The execution of the injected script code occurs next to the introduction word context `Hallo`. The attack vector of the issue is located on the application-side of the online service and the request method to inject is POST. The security risk of the persistent mail encoding web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.3. Exploitation of the persistent vulnerability requires a low privilege pinterest account with low user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent redirect to external source and persistent manipulation of affected or connected module context. Request Method(s): [+] POST Vulnerable Module(s): [+] User Profile Vulnerable Input(s): [+] Kontaktperson Vulnerable Function(s): [+] contact_name Affected Module(s): [+] Pinterest Tips - Mail (community@pinterest.com & community@email.pinterest.com) Proof of Concept (PoC): ======================= The application-side mail encoding web vulnerability can be exploited by local attackers and remote attackers with medium or high user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the security vulnerability ... 1. Open the pinterest website and register to the pinterest community web-application account 2. Include the following string to the name input fields @.com Note: Use Username: admin@evolution-sec.com Password: bugcrowd23 3. Save the settings to add the new account to the pinterest database Note: Now, you need to wait even if the account is not confirmed the pinterest tips will arrive 4. The script code execution occurs in the pinterest tip mail next to the Hallo introduction word context Note: The issue can be exploited by local and remote accounts. Remote attackers are able register with random mails without verification to send the pinterest service pin tips with malicious context. 5. Successful reproduce of the security vulnerability! PoC: Pin-Tipp: So erstellst du geheime Pinnwände (community@pinterest.com & community@email.pinterest.com)

Hallo [PERSISTENT SCRIPT CODE EXECUTION!]>"

Query Builder