Newtelligence DasBlog CVE-2014-7292 Open Redirection Vulnerability
Bugtraq ID: 70654
Class: Input Validation Error
CVE: CVE-2014-7292
Remote: Yes
Local: No
Published: Oct 20 2014 12:00AM
Updated: Oct 20 2014 12:00AM
Credit: Wang Jing
Showing posts with label Application Exploit. Show all posts
Showing posts with label Application Exploit. Show all posts
Monday, 29 December 2014
CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities
CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities
Exploit Title: goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities
Product: WebPress
Vendor: goYWP
Vulnerable Versions: 13.00.06
Tested Version: 13.00.06
Advisory Publication: Dec 09, 2014
Latest Update: Dec 09, 2014
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-8751
Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]
Advisory Details:
(1) Product
“WebPress is the foundation on which we build web sites. It’s our unique Content Management System (CMS), flexible enough for us to build your dream site, and easy enough for you to maintain it yourself.”
(2) Vulnerability Details:
goYWP WebPress has a security problem. It is vulnerable to XSS attacks.
(2.1) The first security vulnerability occurs at “/search.php” page with “&search_param” parameter in HTTP GET.
(2.2) The second security vulnerability occurs at “/forms.php” (form submission ) page with “&name”, “&address” “&comment” parameters in HTTP POST.
References:
Wednesday, 1 October 2014
Vigilantes testing security of IT systems
SINGAPORE: Call them cybersecurity vigilantes if you will, or “white hats” - as they are known in the hacking world.
Mr
Wang Jing and Mr Zhao Hainan are part of a growing group of individuals
who are taking it upon themselves to test the security of information
systems in organisations and report security flaws.
Earlier this month, Mr Zhao, 26, a National University of Singapore computer science postgraduate student, managed to hack into M1’s pre-order site for
the iPhone 6 and 6 Plus to access personal data, including phone and
NRIC numbers, as well as home addresses of the telco’s customers. He
then alerted the company.
M1,
which temporarily suspended all pre-orders to carry out an
investigation, said it appreciated the fact that Mr Zhao, who was not
identified in previous media reports, had taken the time to inform the
firm about the potential security flaw and would not be taking any
action against him.
Speaking
to TODAY, Mr Zhao, a Singapore permanent resident, said his interest in
hacking began after he had taken a module on website security. He added
that he makes sure he does not break any laws and would report any
vulnerabilities he discovered to website owners.
“I
want to make the Internet a safer place. So, over the years, I will try
to hack (into) a website when I feel interested in (it) … I also do it
out of curiosity,” he said.
For
Mr Wang, who is pursuing a PhD in mathematics at Nanyang Technological
University’s School of Physical and Mathematical Sciences, testing
websites for vulnerabilities is a hobby he started early this year.
After
reading up on computer security, he tested some well-known social
networking sites, as well as websites of banks here and other popular
Singapore-based sites.
“I
believe making the Web more secure is beneficial to users … I am happy
to do something that is useful,” said Mr Wang, who is in his 20s.
Apart
from individuals, there are also groups of cybersecurity watchdogs,
including the 400-member Singapore Security Meetup Group.
Led
by Infotect Security managing director Wong Onn Chee, the informal
group comprises cybersecurity experts. They do not do penetration
testing of websites, as this could potentially run afoul of laws if it
is unauthorised.
Mr
Wong said the group members have informed organisations when they came
across websites using technology or carrying out transactions that were
highly suspected to be vulnerable.
Mr
Anthony Lim, a member of the Application Security Advisory Board at
ISC2, a not-for-profit association for information security
professionals, cautioned against individuals performing “ethical
hacking”.
“We
don’t want anonymous ‘superhero-wannabe’ types … running around loose
in cyberspace trying to do good by quietly hacking into your system
without your prior knowledge and approval … even if they don’t cause any
damage or steal any data,” he said.
- TODAY
Reference:
Wednesday, 3 September 2014
Serious Covert Redirect Vulnerability Found in OAuth 2.0 and OpenID
Following in the steps of the OpenSSL vulnerability Heartbleed, A serious Covert Redirect vulnerability related to OAuth 2.0 and OpenID has been found. Almost all major providers of OAuth 2.0 and OpenID are affected, such as Facebook, Google, Yahoo, LinkedIn, Microsoft, Paypal, GitHub, QQ, Taobao, Weibo, VK, Mail.Ru, Sohu, etc.
Wang Jing, a Ph.D. student at the Nanyang Technological University in Singapore, discovered that the serious vulnerability "Covert Redirect" flaw can masquerade as a log-in popup based on an affected site's domain. Covert Redirect is based on a well-known exploit parameter.
For example, someone clicking on a malicious phishing link will get a popup window in Facebook, asking them to authorize the app. Instead of using a fake domain name that's similar to trick users, the Covert Redirect flaw uses the real site address for authentication.
If a user chooses to authorize the log in, personal data (depending on what is being asked for) will be released to the attacker instead of to the legitimate website. This can range from email addresses, birth dates, contact lists, and possibly even control of the account.
Regardless of whether the victim chooses to authorize the app, he or she will then get redirected to a website of the attacker's choice, which could potentially further compromise the victim.
Wang says he has already contacted Facebook and has reported the flaw, but was told that the company "understood the risks associated with OAuth 2.0," and that "short of forcing every single application on the platform to use a whitelist," fixing this bug was "something that can't be accomplished in the short term."
Facebook isn't the only site affected. Wang says he has reported this to Google, LinkedIn, and Microsoft, which gave him various responses on how they would handle the matter.
Google (which uses OpenID) told him that the problem was being tracked, while LinkedIn said that the company has published a blog on the matter. Microsoft, on the other hand, said an investigation had been done and that the vulnerability existed on the domain of a third party and not on its own sites.
"Patching this vulnerability is easier said than done. If all the third-party applications strictly adhere to using a whitelist, then there would be no room for attacks," said Wang.
"However, in the real world, a large number of third-party applications do not do this due to various reasons. This makes the systems based on OAuth 2.0 or OpenID highly vulnerable," he added.
LinkedIn engineer Shikha Sehgal wrote a blog post about the creation of a whitelist for the site more than a month before Wang published his findings.
"In order to make the LinkedIn platform even more secure, and so we can comply with the security specifications of OAuth 2, we are asking those of you who use OAuth 2 to register your application's redirect URLs with us by April 11, 2014," she said.
Sehgal did not explicitly say that the measure was in response to a flaw in OAuth 2, but the social network did confirm to CNET that the vulnerability that Wang detailed is the same one that inspired the blog post.
PayPal also has addressed the flaw.
"When PayPal implemented OAuth2.0/OpenID, we engineered additional security measures to protect our merchants and customers. These measures protect PayPal customers from this specific OAuth2.0/OpenID vulnerability," James Barrese, PayPal's CTO, said in a blog post on Friday. PayPal declined to add details about those measures.
(Article Mainly from Cnet.com)
Tuesday, 10 June 2014
Oracle Access Manager (OAM) Vulnerabilities
Oracle Access Manager (formerly known as Oblix NetPoint and
Oracle COREid) provides a full range of identity administration and
security functions, that include Web single sign-on; user self-service
and self-registration; sophisticated workflow functionality; auditing
and access reporting; policy management; dynamic group management; and
delegated administration.
The main file of OAM is “obrareq.cgi”.
However,
I found “obrareq.cgi” doesn’t authenticate its paramters properly. So
attackers can do Attacks such as Dos and Information Disclosure
When
a user clicks the URLs above before login, the “Login” page appears.
The user needs to enter his/her username and password. When this is
done, the user could be redirected to a webpage controlled by an
attacker or to any file in Oracle.
My tests were performed on Firefox (26.0) in Ubuntu (12.04) and IE (9.0.15) in Windows 7.
The vulnerabilities fixed by Oracle in the following update:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
CVE Details:
CVE-2014-2404: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2404
CVE-2014-2452: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2452
CVE-2014-2404: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2404
CVE-2014-2452: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2452
More Details: http://www.tetraph.com/blog/2014/06/oracle-access-manager-oam-vulnerabilities/
Posted by:WANG Jing (王晶). a PhD student in mathematics from Nanyang Technological University. He obtained his bachelor's degree in mathematics at University of Science and Technology of China.
http://www.tetraph.com/wangjing/
http://www.tetraph.com/wangjing/chinese.html
http://user.qzone.qq.com/137372921
Subscribe to:
Posts (Atom)