CVE-2014-8753 Cit-e-Net Multiple XSS (Cross-Site Scripting) Web Security Vulnerabilities

CVE-2014-8753  Cit-e-Net Multiple XSS (Cross-Site Scripting) Web Security Vulnerabilities

Exploit Title: Cit-e-Net Multiple XSS (Cross-Site Scripting) Web Security Vulnerabilities

Product: Cit-e-Access

Vendor: Cit-e-Net

Vulnerable Versions: Version 6

Tested Version: Version 6

Advisory Publication: February 12, 2015

Latest Update: June 01, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8753

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized modification

Discover and Author: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Instruction Details:

(1) Vendor & Product Description:

Vendor:

Cit-e-Net

Product & Version: 

Cit-e-Access

Version 6

Vendor URL & Download: 

Cit-e-Net can be downloaded from here,

https://www.cit-e.net/citeadmin/help/cntrainingmanualhowto.pdf

http://demo.cit-e.net/

http://www.cit-e.net/demorequest.cfm

http://demo.cit-e.net/Cit-e-Access/ServReq/?TID=1&TPID=17

Product Introduction:

"We are a premier provider of Internet-based solutions encompassing web site development and modular interactive e-government applications which bring local government, residents and community businesses together.

Cit-e-Net provides a suite of on-line interactive services to counties, municipalities, and other government agencies, that they in turn can offer to their constituents. The municipal government achieves a greater degree of efficiency and timeliness in conducting the daily operations of government, while residents receive improved and easier access to city hall through the on-line access to government services.

Our web-based applications can help your municipality to acheive its e-government goals. Type & click website content-management empowers the municipality to manage the website quickly and easily. Web page styles & formats are customizable by the municipality, and because the foundation is a database application, user security can be set for individual personnel and module applications. Our application modules can either be integrated into your existing municipal web site or implemented as a complete web site solution. It's your choice! Please contact us at info@cit-e.net to view a demonstration of our municipal web site solution if you are an elected official or member of municipal management and your municipality is looking for a cost efficient method for enhancing & improving municipal services. 

Interactive Applications

Online Service Requests

Online Tax Payments by ACH electronic-check or credit card.

Online Utility Payments by  ACH electronic-check or credit card.

Online General-Payments by ACH electronic-check or credit card.

Submit Volunteer Resume's Online for the municipality to match your skills with available openings."

(2) Vulnerability Details:

Cit-e-Access web application has a security bug problem. It can be exploited by XSS attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several similar products 0Day vulnerabilities have been found by some other bug hunter researchers before. Cit-i-Access has patched some of them. Open Sourced Vulnerability Database (OSVDB) is an independent and open-sourced database. The goal of the project is to provide accurate, detailed, current, and unbiased technical information on security vulnerabilities. The project promotes greater, open collaboration between companies and individuals. It has published suggestions, advisories, solutions details related to important vulnerabilities and cyber intelligence.

(2.1) The first programming code flaw occurs at "/eventscalendar/index.cfm?" page with "&DID" parameter in HTTP GET.

(2.2) The second programming code flaw occurs at "/search/index.cfm?" page with "&keyword" parameter in HTTP POST.

(2.3) The third programming code flaw occurs at "/news/index.cfm" page with "&jump2" "&DID" parameter in HTTP GET.

(2.4) The fourth programming code flaw occurs at "eventscalendar?" page with "&TPID" parameter in HTTP GET.

(2.5) The fifth programming code flaw occurs at "/meetings/index.cfm?" page with "&DID" parameter in HTTP GET.

(3) Solutions:

Leave message to vendor. No response.

http://www.cit-e.net/contact.cfm

References:

http://seclists.org/fulldisclosure/2015/Feb/48

http://lists.openwall.net/full-disclosure/2015/02/13/2

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1587

https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01683.html

https://computerpitch.wordpress.com/2015/06/07/cve-2014-8753/

http://webtechhut.blogspot.com/2015/06/cve-2014-8753.html

https://www.facebook.com/websecuritiesnews/posts/804176613035844

https://twitter.com/tetraphibious/status/607381197077946368

http://biboying.lofter.com/post/1cc9f4f5_7356826

http://shellmantis.tumblr.com/post/120903342496/securitypost-cve-2014-8753

http://itprompt.blogspot.com/2015/06/cve-2014-8753.html

http://whitehatpost.blog.163.com/blog/static/24223205420155710559404/

https://plus.google.com/u/0/113115469311022848114/posts/FomMK9BGGx2

https://www.facebook.com/pcwebsecurities/posts/702290949916825

http://securitypost.tumblr.com/post/120903225352/cve-2014-8753-cit-e-net

http://webtech.lofter.com/post/1cd3e0d3_7355910

http://www.inzeed.com/kaleidoscope/cves/cve-2014-8753/

http://diebiyi.com/articles/security/cve-2014-8753/

CNN cnn.com Travel XSS and ADS Open Redirect Web Security Vulnerabilities

CNN Travel.cnn.com XSS and Ads.cnn.com Open Redirect Web Security Vulnerabilities

Domain:

http://cnn.com

"The Cable News Network (CNN) is an American basic cable and satellite television channel that is owned by the Turner Broadcasting System division of Time Warner. The 24-hour cable news channel was founded in 1980 by American media proprietor Ted Turner. Upon its launch, CNN was the first television channel to provide 24-hour news coverage, and was the first all-news television channel in the United States. While the news channel has numerous affiliates, CNN primarily broadcasts from the Time Warner Center in New York City, and studios in Washington, D.C. and Los Angeles, its headquarters at the CNN Center in Atlanta is only used for weekend programming. CNN is sometimes referred to as CNN/U.S. to distinguish the American channel from its international sister network, CNN International. As of August 2010, CNN is available in over 100 million U.S. households. Broadcast coverage of the U.S. channel extends to over 890,000 American hotel rooms, as well as carriage on cable and satellite providers throughout Canada. Globally, CNN programming airs through CNN International, which can be seen by viewers in over 212 countries and territories. As of February 2015, CNN is available to approximately 96,289,000 cable, satellite and, telco television households (82.7% of households with at least one television set) in the United States." (Wikipedia)

Discovered and Reported by:

Jing Wang, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore.  (@justqdjing)

http://www.tetraph.com/wangjing/

Vulnerability Description:

CNN has a cyber security bug problem. It cab be exploited by XSS (Cross Site Scripting) and Open Redirect (Unvalidated Redirects and Forwards) attacks.

Based on news published, CNN users were hacked based on both Open Redirect and XSS vulnerabilities.

According to E Hacker News on June 06, 2013, (@BreakTheSec) came across a diet spam campaign that leverages the open redirect vulnerability in one of the top News organization CNN.

After the attack, CNN takes measures to detect Open Redirect vulnerabilities. The measure is quite good during the tests. Almost no links are vulnerable to Open Redirect attack on CNN's website, now. It takes long time to find a new Open Redirect vulnerability that is un-patched on its website.

CNN.com was hacked by Open Redirect in 2013. While the XSS attacks happened in 2007.

<1> "The tweet apparently shows cyber criminals managed to leverage the open redirect security flaw in the CNN to redirect twitter users to the Diet spam websites."

Figure from ehackingnews.com

At the same time, the cybercriminals have also leveraged a similar vulnerability in a Yahoo domain to trick users into thinking that the links point to a trusted website.

Yahoo Open Redirects Vulnerabilities:

http://securityrelated.blogspot.com/2014/12/yahoo-yahoocom-yahoocojp-open-redirect.html

<2> CNN.com XSS hacked

http://seclists.org/fulldisclosure/2007/Aug/216

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. CNN has patched some of them. BugTraq is a full disclosure moderated mailing list for the *detailed* discussion and announcement of computer security vulnerabilities: what they are, how to exploit them, and how to fix them. The below things be posted to the Bugtraq list: (a) Information on computer or network related security vulnerabilities (UNIX, Windows NT, or any other). (b) Exploit programs, scripts or detailed processes about the above. (c) Patches, workarounds, fixes. (d) Announcements, advisories or warnings. (e) Ideas, future plans or current works dealing with computer/network security. (f) Information material regarding vendor contacts and procedures. (g) Individual experiences in dealing with above vendors or security organizations. (h) Incident advisories or informational reporting. (i) New or updated security tools. A large number of the fllowing web securities have been published here, Buffer overflow, HTTP Response Splitting (CRLF), CMD Injection, SQL injection, Phishing, Cross-site scripting, CSRF, Cyber-attack, Unvalidated Redirects and Forwards, Information Leakage, Denial of Service, File Inclusion, Weak Encryption, Privilege Escalation, Directory Traversal, HTML Injection, Spam. It also publishes suggestions, advisories, solutions details related to XSS and URL Redirection vulnerabilities and cyber intelligence recommendations.

(1) CNN (cnn.com) Travel-City Related Links XSS (cross site scripting) Web Security Bugs

Domain:

travel.cnn.com/

Vulnerability Description:

The programming bug flaws occur at "/city/all" pages. All links under this URL are vulnerable to XSS attacks, e.g

http://travel.cnn.com/city/all/all/washington?page=0%2C1

http://travel.cnn.com/city/all/all/tokyo/all?page=0%2C1

XSS may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. Base on Acunetix, exploited XSS is commonly used to achieve the following malicious results

• Identity theft
• Accessing sensitive or restricted information
• Gaining free access to otherwise paid for content
• Spying on user’s web browsing habits
• Altering browser functionality
• Public defamation of an individual or corporation
• Web application defacement
• Denial of Service attacks

The code programming flaw can be exploited without user login. Tests were performed on Firefox (34.0) in Ubuntu (14.04) and IE (9.0.15) in Windows 7.

PoC:

http://travel.cnn.com/city/all/all/tokyo/all' /"><img src=x onerror=prompt(/justqdjing/)>

http://travel.cnn.com/city/all/all/bangkok/all' /"><img src=x onerror=prompt(/justqdjing/)>

(1.1) Poc Video:

https://www.youtube.com/watch?v=Cu47XiDV38M&feature=youtu.be

Blog Details:

http://securityrelated.blogspot.com/2014/12/cnn-cnncom-travel-city-related-links.html

(2) CNN cnn.com ADS Open Redirect Web Security Bug

Domain:

ads.cnn.com

Vulnerability Description:

The programming code flaw occurs at "event.ng" page with "&Redirect" parameter, i.e.

http://ads.cnn.com/event.ng/Type=click&FlightID=92160&AdID=125504&TargetID=1346&RawValues=&Redirect=http:%2f%2fgoogle.com

From OWASP, an open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

The vulnerabilities can be attacked without user login. Tests were performed on Microsoft IE (10.0.9200.16750) of Windows 8, Mozilla Firefox (34.0) & Google Chromium 39.0.2171.65-0 ubuntu0.14.04.1.1064 (64-bit) of Ubuntu (14.04)，Apple Safari 6.1.6 of Mac OS X Lion 10.7. 

(2.1) Use the following tests to illustrate the scenario painted above.

The redirected webpage address is "http://webcabinet.tumblr.com/". Suppose that this webpage is malicious.

Vulnerable URL:

http://ads.cnn.com/event.ng/Type=click&FlightID=92160&AdID=125504&TargetID=1346&RawValues=&Redirect=http:%2f%2fcnn.com

POC:

http://ads.cnn.com/event.ng/Type=click&FlightID=92160&AdID=125504&TargetID=1346&RawValues=&Redirect=http:%2f%2fwebcabinet.tumblr.com

Since CNN is well-known worldwide, this vulnerability can be used to do "Covert Redirect" attacks to other websites.

(2.1) Poc Video:

https://www.youtube.com/watch?v=FE8lhDvKGN0&feature=youtu.be

Blog Detail:

http://securityrelated.blogspot.com/2014/12/cnn-cnncom-ads-open-redirect-security.html

Those vulnerabilities were reported to CNN in early July by Contact from Here. But they are still not been patched yet.
http://edition.cnn.com/feedback/#cnn_FBKCNN_com

More Details:
http://seclists.org/fulldisclosure/2014/Dec/128
http://lists.openwall.net/full-disclosure/2014/12/29/6
http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1395
http://static-173-79-223-25.washdc.fios.verizon.net/?l=full-disclosure
http://securitypost.tumblr.com/post/107868680057/ithut-cnn-cnn-com-travel
http://ittechnology.lofter.com/post/1cfbf60d_5500df0
http://ithut.tumblr.com/post/120833062743/cnn-xss-url-redirection-bug

http://www.tetraph.com/blog/it-news/cnn-xss-url-redirect-bug/

http://tetraph.blogspot.com/2015/06/cnn-xss-redirect-bug.html

https://biyiniao.wordpress.com/2015/01/08/cnn-xss-open-redirect-bug/

http://whitehatpost.blog.163.com/blog/static/24223205420155613753998/

https://plus.google.com/u/0/+wangfeiblackcookie/posts/bFkukxiUfXK

https://www.facebook.com/permalink.php?story_fbid=674936469318135

http://diebiyi.com/articles/news/cnn-xss-url-redirect-bug/

https://twitter.com/yangziyou/status/607060937309159425

https://redysnowfox.wordpress.com/2014/12/31/cnn-xss-url-redirect-bug/

https://www.facebook.com/permalink.php?story_fbid=1043534509019886

http://whitehatpost.lofter.com/post/1cc773c8_7338196

http://securityrelated.blogspot.com/2014/12/cnn-cnncom-travel-xss-and

Alvorlig feil i utbredt innloggingssystem

Alvorlig feil i utbredt innloggingssystem

Benyttes av Facebook, Google, Yahoo, LinkedIn, Microsoft og mange flere.

Wang Jing, en doktorgradstudent ved Nanyang Technological University i Singapore, har oppdaget en alvorlig sårbarhet knyttet til autentiseringssystemene OAuth 2.0 og OpenID. Sårbarheten, som er av typen «covert redirect», dreier seg om at en applikasjon tar en parameter og omdirigerer en bruker til parameteren uten tilstrekkelig validering. Ifølge Jing skyldes dette ofte at nettsteder har for stor tillit til sine partnere.

– Nettstedet sjekker domenenavnet mot et «token» (tildelt til partneren som et middel for verifisering) i den omdirigerte URL-en. Dersom paret er i godkjent-listen i nettstedets database, vil det tillate omdirigeringen. Men dersom URL-en tilhører et domene som har en «open redirect»-sårbarhet, kan brukerne omdirigeres fra nettstedet til et sårbart nettsted og deretter til en ondsinnet nettsted, skriver Jing.

http://www.digi.no/928515/alvorlig-feil-i-utbredt-innloggingssystem

Xuất hiện lỗ hổng Covert Redirect, bản sao của "Trái tim rỉ máu"

Xuất hiện lỗ hổng Covert Redirect, bản sao của "Trái tim rỉ máu"

Một nghiên cứu sinh tại trường Đại học Công nghệ Nanyang (Singapore) vừa phát hiện một lỗ hổng bảo mật tồn tại trong phần mềm mã nguồn mở đang được rất nhiều website sử dụng. Thông tin mới nhất cho thấy lỗ hổng này ảnh hưởng đến cả Google, Facebook, Microsoft, LinkedIn, PayPal và một số công ty lớn khác.

Wang Jing, nghiên cứu sinh tiến sĩ tại Đại học Công nghệ Nanyang là người phát hiện ra lỗ hổng đang tồn tại trong công cụ đăng nhập mã nguồn mở OAuth và OpenID. Wang Jing gọi lỗ hổng này là "Covert Redirect" (tạm dịch là Bí mật chuyển hướng). Hacker có thể gài mã độc ẩn dưới dạng một cửa sổ pop-up, hiện ra khi người dùng đăng nhập vào một website có lỗ hổng. Chẳng hạn như khi người dùng gõ địa chỉ Facebook, một cửa sổ pop-up hiện ra yêu cầu điền tên đăng nhập và mật khẩu. Nếu người dùng đưa thông tin vào thì những thông tin ấy sẽ "bí mật chuyển hướng" đến hacker.

http://ictnews.vn/cntt/bao-mat/xuat-hien-lo-hong-covert-redirect-ban-sao-cua-trai-tim-ri-mau-116528.ict

Covert Redirect Mengancam OAuth 2.0 dan OpenID

Covert Redirect Mengancam OAuth 2.0 dan OpenID

Pada Jumat lalu, Wang Jing, seorang mahasiswa program PhD di Nanyang Technological University di Singapura, menerbitkan sebuah laporan yang memjabarkan tentang metode serangan yang disebut dengan “Covert Redirect” dan memperkenalkannya sebagai kerentanan atau vulnerable di OAuth 2.0 dan OpenID.

Cara kerja OAuth 2.0 dan OpenID sendiri adalah dengan memberikan akses bagi pengguna layanan ini untuk mendapatkan domain yang dapat mengakses menggunakan kredensial yang telah ada kepada website lain seperti Facebook, Google, Microsoft atau LinkedIn. Dengan akses yang didapatkan pengguna layanan ini dapat menghapus sebuah akun dan menggantinya dengan akun yang baru.


http://www.inzeed.com/kaleidoscope/computer-security/covert-redirect-mengancam-oauth-2-0-dan-openid/

Keep calm e fate attenzione: OpenID e OAuth sono vulnerabili

Keep calm e fate attenzione: OpenID e OAuth sono vulnerabili

Solo un paio di settimane dopo il preoccupante bug conosciuto come Heartbleed, un utente di Internet come me e voi ha scoperto una nuova e a quanto pare diffusa vulnerabilità, anche questa non facile da  risolvere. Si tratta del bug “Covert redirection”, scoperto di recente da Wang Jing, uno dottorando in matematica presso la Nanyang Technological University di Singapore. Il problema è stato riscontrato all’interno dei popolari protocolli Internet OpenID e OAuth. Il primo protocollo viene utilizzato quando si cerca di accedere a un sito web usando le credeziali già create per i servizi di Google, Facebook o LinkedIn. Il secondo viene utilizzato quando si autorizza un sito web, una app o alcuni servizi con Facebook, Google +, ecc… senza rivelare di fatto la password e le credenziali a siti esterni. Questi due metodi vengono spesso usati insieme e, a quanto pare, potrebbero permettere ai cybercriminali di mettere mano sulle informazioni degli utenti.

La minaccia

Su Threatpost sono disponibili maggiori informazioni tecniche sul bug e un link alla ricerca originale, in inglese. Ma andiamo la sodo e osserviamo come funziona un possibile attacco e quali sarebbero le sue conseguenze. In primo luogo, affinché si verifichi il problema, un utente dovrebbe visitare un sito di phishing dannoso dotato del tipico “Accedi con Facebook”. Il sito potrebbe assomigliare del tutto a un servizio popolare esterno, fingendosi e proponendosi come un nuovo servizio. Poi il vero Facebook, Google +  o LinkedIn lancia una popup che invita l’utente a inserire le credenziali di login e la password per autorizzare i servizi appena menzionati (e in teoria “rispettabili”) e permettere all’utente di accedere. Nell’ultima fase, l’autorizzazione a usare il profilo viene inviata a un sito diverso (di phishing), “redirezionando” le informazioni in forma impropria.




http://blog.kaspersky.it/facebook-openid-oauth-vulnerabili/3639/

Continúan los problemas: OAuth y OpenID también son vulnerables

Un nuevo fallo de seguridad amenaza Internet. En este caso se trata de Covert Redirect y ha sido descubierto por un estudiante chino en Singapur. Las empresas tienen en sus manos solucionar este problema.



























Cuando aún resuenan los ecos de Heartbleed y el terremoto que sacudió la red, nos acabamos de enterar que otra brecha de seguridad compromete Internet. En este caso se trata de un fallo que afecta a páginas como Google, Facebook, Microsoft, Linkedin, Yahoo, PayPal, GitHub o Mail.ru que usan estas herramientas de código abierto para autenticar a sus usuarios.



Este error permitiría a un atacante haga creer a un usuario que una nueva ventana que redirija a Facebook es segura cuando en realidad no lo es. Hasta aquí la técnica se parece al phishing pero lo que hace lo hace diferente es que Covert Redirect, que así se llama el nuevo exploit, usa el dominio real pero hace un bypass del servidor para conseguir la info. Lo mejor que podemos hacer cuando estemos navegando y pulsemos en un sitio que abre un pop up que nos pide logearnos en Facebook o Google es cerrar esa ventana para evitar que nos redirija a sitios sospechosos.



Wang Jing, estudiante de doctorado en la Universidad Técnica de Nanyang (Singapur), es quien ha descubierto la vulnerabilidad y le ha puesto nombre. El problema, según Jing, es que ni el proveedor ni la compañía quieren responsabilizarse de esta brecha ya que costaría mucho tiempo y dinero. Seguramente, ahora que se conoce el caso, las compañías se pondrán manos a la obra.








Artículos Relacionados:

http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discovered/

http://techxplore.com/news/2014-05-math-student-oauth-openid-vulnerability.html

http://phys.org/news/2014-05-math-student-oauth-openid-vulnerability.html

http://www.tomsguide.com/us/facebook-google-covert-redirect-flaw,news-18726.html

http://news.yahoo.com/facebook-google-users-threatened-security-192547549.html

http://thehackernews.com/2014/05/nasty-covert-redirect-vulnerability.html

http://www.scmagazine.com/covert-redirect-vulnerability-impacts-oauth-20-openid/article/345407/

http://computerobsess.blogspot.com/2014/10/id-oauth.html

http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html

http://russiapost.blogspot.ru/2014/11/openid-oauth-20.html?view=sidebar

https://hackertopic.wordpress.com/2014/07/11/oauth-openid-covert-redirect

http://germancast.blogspot.de/2014/11/sicherheitslucke-in-oauth-20-und-openid.html

http://diebiyi.com/articles/security/covert-redirect/sicherheitslucke-in-oauth-2-0-und-openid-gefunden/

http://www.inzeed.com/kaleidoscope/covert-redirect/openid-oauth-2.0

https://webtechwire.wordpress.com/2014/12/09/oauth%E3%81%A8openid%E3%81

http://tetraph.tumblr.com/post/118850487757/itinfotech-covert
http://webtechhut.blogspot.com/2014/12/continuan-los-problemas-oauth-y-openid.html

http://frenchairing.blogspot.fr/2014/11/des-vulnerabilites-pour-les-boutons.html

https://itswift.wordpress.com/2014/06/06/covert-redirect-openid-oauth

http://blog.kaspersky.com/facebook-openid-oauth-vulnerable/

http://whitehatpost.lofter.com/post/1cc773c8_6f0b389

http://itprompt.blogspot.com/2014/12/falha-de-seguranca-afeta-logins-de.html

http://www.foxnews.com/tech/2014/05/05/facebook-google-users-threatened-by-new-security-flaw/

http://www.tetraph.com/blog/covert-redirect/sicherheitslucke-in-oauth-2-0-und-openid-gefunden/

http://www.inzeed.com/kaleidoscope/covert-redirect/372/

The Weather Channel at Least 76.3% Links Vulnerable to XSS Attacks

The Weather Channel at Least 76.3% Links Vulnerable to XSS Attacks

Domain Description:

http://www.weather.com/

"The Weather Channel is an American basic cable and satellite television channel which broadcasts weather forecasts and weather-related news and analyses, along with documentaries and entertainment programming related to weather.  Launched on May 2, 1982, the channel broadcasts weather forecasts and weather-related news and analysis, along with documentaries and entertainment programming related to weather."

"As of February 2015, The Weather Channel was received by approximately 97.3 million American households that subscribe to a pay television service (83.6% of U.S. households with at least one television set), which gave it the highest national distribution of any U.S. cable channel. However, it was subsequently dropped by Verizon FiOS (losing its approximately 5.5 millions subscribers), giving the title of most distributed network to HLN. Actual viewership of the channel averaged 210,000 during 2013 and has been declining for several years. Content from The Weather Channel is available for purchase from the NBCUniversal Archives." (Wikipedia)

Vulnerability description:


The Weather Channel has a cyber security problem. Hacker can exploit it by XSS bugs.

Almost all links under the domain weather.com are vulnerable to XSS attacks. Attackers just need to add script at the end of The Weather Channel's URLs. Then the scripts will be executed.

10 thousands of Links were tested based a self-written tool. During the tests, 76.3% of links belong to weather.com were vulnerable to XSS attacks.

The reason of this vulnerability is that Weather Channel uses URLs to construct its HTML tags without filtering malicious script codes. 

The vulnerability can be attacked without user login. Tests were performed on Firefox (34.0) in Ubuntu (14.04) and IE (9.0.15) in Windows 8.

POC Codes, e.g.

http://www.weather.com/slideshows/main/"--/>"><img src=x onerror=prompt('justqdjing')>

http://www.weather.com/home-garden/home/white-house-lawns-20140316%22--/"--/>"><img src=x onerror=prompt('justqdjing')>t%28%27justqdjing%27%29%3E

http://www.weather.com/news/main/"><img src=x onerror=prompt('justqdjing')>

POC Video:

https://www.youtube.com/watch?v=Ij78WnzKB4M&feature=youtu.be

Blog Details:

http://securityrelated.blogspot.com/2014/11/the-weather-channel-weather.html

The Weather Channel has patched this Vulnerability in late November, 2014 (last Week).  "The Full Disclosure mailing list is a public forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. FD differs from other security lists in its open nature and support for researchers' right to decide how to disclose their own discovered bugs. The full disclosure movement has been credited with forcing vendors to better secure their products and to publicly acknowledge and fix flaws rather than hide them. Vendor legal intimidation and censorship attempts are not tolerated here!" A great many of the fllowing web securities have been published here, Buffer overflow, HTTP Response Splitting (CRLF), CMD Injection, SQL injection, Phishing, Cross-site scripting, CSRF, Cyber-attack, Unvalidated Redirects and Forwards, Information Leakage, Denial of Service, File Inclusion, Weak Encryption, Privilege Escalation, Directory Traversal, HTML Injection, Spam. This bug was published at The Full Disclosure in November, 2014.

Discovered by:

Jing Wang, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)

http://www.tetraph.com/wangjing

More Details:

http://seclists.org/fulldisclosure/2014/Nov/89

http://lists.openwall.net/full-disclosure/2014/11/27/3

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1253

https://progressive-comp.com/?l=full-disclosure&m=141705578527909&w=1

http://whitehatview.tumblr.com/post/104313615841/the-weather-channel-flaw

http://www.inzeed.com/kaleidoscope/xss-vulnerability/the-weather-channel-exploit

http://diebiyi.com/articles/security/the-weather-channel-bug

http://whitehatpost.lofter.com/post/1cc773c8_6f2d4a8

https://vulnerabilitypost.wordpress.com/2014/12/04/the-weather-channel-flaw

http://tetraph.blog.163.com/blog/static/234603051201411475314523/

http://tetraph.blogspot.com/2014/12/the-weather-channel-xss.html

http://ithut.tumblr.com/post/121916595448/weather-channel-xss

https://mathfas.wordpress.com/2014/12/04/the-weather-channel-weather-bug

http://computerobsess.blogspot.com/2014/12/the-weather-channel-xss.html

http://www.tetraph.com/blog/xss-vulnerability/the-weather-channel-bug