Sony PSN Community - Persistent Web Vulnerability

Document Title:
===============
Sony PSN Community - Persistent Web Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=746


Release Date:
=============
2013-05-04


Vulnerability Laboratory ID (VL-ID):
====================================
746


Common Vulnerability Scoring System:
====================================
3.5


Product & Service Introduction:
===============================
PlayStation Network, often abbreviated as PSN, is an online multiplayer gaming and digital media delivery service provided/run 
by Sony Computer Entertainment for use with the PlayStation 3, PlayStation Portable, and PlayStation Vita video game consoles. 
The PlayStation Network is the video game portion of the Sony Entertainment Network.

(Copy of the Homepage: http://en.wikipedia.org/wiki/PlayStation_Network)


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a persistent web vulnerability in Sony`s official PSN Community Website Application.


Vulnerability Disclosure Timeline:
==================================
2012-11-01:	Researcher Notification & Coordination
2012-11-02:	Vendor Notification
2013-05-05:	Public Disclosure


Discovery Status:
=================
Published


Affected Product(s):
====================
Sony
Product: PSN Community - Lithium Forums 2012 Q4


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Low


Technical Details & Description:
================================
Multiple persistent input validation vulnerabilities are located in Sony`s official PSN Community Website Application.
The bug allows remote attackers with low account privileges to inject via editor & replace function own malicious 
persistent script codes. The vulnerabilities are located in the forum editor module with the replace function and the 
bound vulnerable message titel, subject and link parameters. Remote attackers can compose malicious forum posts to 
hijack psn admin/moderator/customer accounts. Successful exploitation result in persistent web context manipulation, 
application-side phishing, persistent malware loads, external redirects or persistent session hijacking via forum messages.


Vulnerable Section(s):
				[+] Skype Community (Forums) - Lithium Forum

Vulnerable Module(s):
				[+] Editor (in combination with the replace all function to execute)

Vulnerable Parameter(s):
				[+] Message Subject, Topic Title & Link Widget


Proof of Concept (PoC):
=======================
The vulnerability can be exploited by remote attackers with low or medium required user inter action and with low privileged 
psn application service user account. For demonstration or reproduce ...


PoC:

<label for="lia-subject" class="lia-form-label">Subject</label>

<input style="" class="lia-form-subject-input lia-form-type-text lia-form-input-vertical" 
maxlength="2000" 
value=>"<>>"><[PERSISTENT INECTED SCRIPT CODE!]"Re: Bug Report VL ID 740 " id="lia-subject" name="subject" type="text">

... or in the body


<a target="_self" title=<>>"><[PERSISTENT INECTED SCRIPT CODE!]" data-mce-href="<>>"><[PERSISTENT INECTED SCRIPT CODE!] >"
<>"<<>>"><[PERSISTENT INECTED SCRIPT CODE!]>" href="http://>"<>"<<>>"><[PERSISTENT INECTED SCRIPT CODE!]>.com 
>"<>"<<>>"><[PERSISTENT INECTED SCRIPT CODE!]>">>"<>"<<>>"><[PERSISTENT INECTED SCRIPT CODE!]">      
>"<>"<iframe src=http://vw.de></iframe></a>



Reference(s): (SIMULATION - TEST)
http://community.eu.playstation.com/t5/forums/replypage/board-id/bDE_PSNSupport/message-id/18905


Reference(s):
				../compose.htm
				../compose2.htm


Picture(s):
				../1.png
				../2.png
				../3.png
				../4.png


Security Risk:
==============
The security risk of the persistent input validation vulnerabilities are estimated as medium(+)||(-)high.


Credits & Authors:
==================
Vulnerability Laboratory [Research Team]  -    Benjamin Kunz Mejri ([email protected])


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2013 | Vulnerability Laboratory