Bugcrowd Bug Bounty #7 - Persistent Web Vulnerability

Document Title:
===============
Bugcrowd Bug Bounty #7 - Persistent Web Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1830

ID: b40f63ed19074014df808599e44684f6a18bb6f4f51cf21948ef78df2f56c13b


Release Date:
=============
2016-05-09


Vulnerability Laboratory ID (VL-ID):
====================================
1830


Common Vulnerability Scoring System:
====================================
3.8


Product & Service Introduction:
===============================
From the outback to the valley, Bugcrowd is paving the way for crowdsourced security. Founded in 2012 in Australia by 
Casey Ellis, Bugcrowd is now based in San Francisco and is backed by Costanoa Venture Capital, Rally Ventures, Paladin Capital 
Group and Blackbird Ventures.

(Copy of the Homepage: https://bugcrowd.com/about )


Abstract Advisory Information:
==============================
The vulnerability laboratory research team discovered an application-side vulnerability in the official Bugcrowd online service web-application.


Vulnerability Disclosure Timeline:
==================================
2016-04-20: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH)
2016-04-21: Vendor Notification (Bugcrowd - Bug Bounty Program)
2016-**-**: Vendor Fix/Patch (Bugcrowd - Bug Bounty Program)
2016-05-03: Acknowledgement & Bug Bounty (Bugcrowd - Bug Bounty Program)
2016-05-10: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Bugcrowd
Product: Online Service - Web Application 2016 Q2


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Low


Technical Details & Description:
================================
A persistent script code injection and application-side mail encode web vulnerability has been 
discovered in the official Bugcrowd online service web-application. The vulnerability typ allows 
an attacker to inject own malicious script code to the application-side of the vulnerable service 
function or web modules context.

The bugcrowd service allows to register by a web formular in the webpage to receive new information 
like "... Bugcrowd`s Next Chapter". In the name values attackers are able to inject malicious script 
codes. In an advisory send to bugcrowd about 1 year ago we already mentioned the problem but your 
team was not able to verify the bug finally. Thus time we exploited the bug by using casey ellis wrong 
encoded context of the bugcrowd registered users to stream the code with the service emails. The injection 
point is the formular registration for receiving information of bugcrowd and the execution point is the 
email body context with the broken encode values. The code directly executes after the arrival in the 
main body context and the sender of the email was the mail support@bugcrowd inbox.

The security risk of the application-side cross site web vulnerability is estimated as medium with a 
cvss (common vulnerability scoring system) count of 3.8. Exploitation of the persistent input validation 
web vulnerability requires no privileged web-application user account and low user interaction. 
Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, 
persistent external redirects to malicious source and persistent manipulation of affected or connected 
application modules.

Request Method(s):
				[+] POST

Vulnerable Parameter(s):
				[+] Firstname
				[+] Lastname
				[+] Companyname

Affected Module(s):
				[+] Email Community Letter - ([email protected])


Proof of Concept (PoC):
=======================
Persistent web vulnerability can be exploited by remote attackers without privileged web-application user account and low user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

PoC: Email: We've raised money, here's what's next from Bugcrowd ([email protected]) - Casey Ellis
<p style="margin-bottom: 1em; -webkit-text-size-adjust:100%; 
-ms-text-size-adjust:100%">
Hi&nbsp;"&gt;<[PERSISTENT INJECTED SCRIPT CODE EXECUTION!]&quot;)" <="" "="">
&amp;lt;iframe src=a onload=alert("PENTEST") &amp;lt;,&amp;lt;/p&amp;gt;
&amp;lt;p style="margin-bottom: 1em; -webkit-text-size-adjust:100%; 
-ms-text-size-adjust:100%"&amp;gt;As you may have&amp;amp;nbsp;already heard, this morning we &amp;lt;a 
href="https://bugcrowd.com/resources/bugcrowd-15-million-raises-series-b" 
style="-webkit-text-size-adjust:100%; -ms-text-size-adjust:100%" data-hs-link-id="0"&amp;gt;announced 
our $15M Series B funding&amp;lt;/a&amp;gt;. We're proud to have many of our previous investors 
joining us again, as well as pleased to welcome new investors to the family.
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;We couldn't have done this without you. With your help we've 
built a massive&amp;amp;nbsp;community of hackers, made up of diverse and 
talented folks from all over the world.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;We've got lots of 
plans for what's next and I've shared those details on our blog. Please check 
it out to learn more.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&amp;lt;strong&amp;gt;&amp;lt;
a href="https://blog.bugcrowd.com/15-million-to-connect-hackers-and-companies-bugcrowd-series-b" 
style="-webkit-text-size-adjust:100%; -ms-text-size-adjust:100%" data-hs-link-id="1"&amp;gt;
Read about our plans for Bugcrowd's next chapter&amp;lt;/a&amp;gt;.&amp;lt;/strong&amp;gt;
&amp;lt;/p&amp;gt;&amp;lt;p style="margin-bottom: 1em; -webkit-text-size-adjust:100%; 
-ms-text-size-adjust:100%"&amp;gt;Thank you joining us on this journey. There's so much more to come!
We hope you'll &amp;lt;a href="https://twitter.com/Bugcrowd/status/722904657366884353" 
style="-webkit-text-size-adjust:100%; -ms-text-size-adjust:100%" data-hs-link-id="0"&amp;gt;join us 
today in our celebration&amp;lt;/a&amp;gt; of this Bugcrowd community milestone.&amp;lt;/p&amp;gt;
&amp;lt;p style="margin-bottom: 1em; -webkit-text-size-adjust:100%; -ms-text-size-adjust:100%"
&amp;gt;Sincerely,&amp;lt;/p&amp;gt;
&amp;lt;p style="margin-bottom: 1em; -webkit-text-size-adjust:100%; -ms-text-size-adjust:100%"&amp
;gt;Casey Ellis&amp;lt;br&amp;gt;Bugcrowd Founder &amp;amp;amp; CEO&amp;lt;/p&amp;gt;&amp;lt;/div&amp;gt;


Solution - Fix & Patch:
=======================
The vulnerability can be patched by a secure parse and encode of the vulnerable firstname, lastname and company values in the add POST method request.
Disallow the usage of special chars in the name values, encode the inputs as well to prevent further exploitation.
Encode as well outgoing emails to ensure that no malicious script code injection can take place with application-side attack vector.


Security Risk:
==============
The security risk of the filter bypass issue and application-side arbitrary script code injection web vulnerability is estimated as medium. (CVSS 3.8)


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected]) [www.vulnerability-lab.com] [http://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, 
including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, 
including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised 
of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing 
limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com 		- www.vuln-lab.com 						- www.evolution-sec.com
Contact:    [email protected] 	- [email protected] 				- [email protected]
Section:    magazine.vulnerability-lab.com 	- vulnerability-lab.com/contact.php 				- evolution-sec.com/contact
Social:	    twitter.com/vuln_lab		- facebook.com/VulnerabilityLab 				- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php 	- vulnerability-lab.com/rss/rss_upcoming.php 			- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php 	- vulnerability-lab.com/list-of-bug-bounty-programs.php 	- vulnerability-lab.com/register.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically 
redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or 
its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific 
authors or managers. To record, list, modify, use or edit our material contact (admin@ or [email protected]) to get a ask permission.

				    Copyright © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]™