262 lines
No EOL
11 KiB
Text
262 lines
No EOL
11 KiB
Text
Document Title:
|
|
===============
|
|
SevenIT SevDesk 3.10 - Multiple Web Vulnerabilities
|
|
|
|
|
|
References (Source):
|
|
====================
|
|
http://www.vulnerability-lab.com/get_content.php?id=1314
|
|
|
|
|
|
Release Date:
|
|
=============
|
|
2015-03-23
|
|
|
|
|
|
Vulnerability Laboratory ID (VL-ID):
|
|
====================================
|
|
1314
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
5.9
|
|
|
|
|
|
Product & Service Introduction:
|
|
===============================
|
|
The integrated customer management, digital customer file is the central record for a single customer. invoices, facilities and operations
|
|
to a customer are stored centrally automated in one place. So the customer file is always up to date. For faster retrieval or reporting
|
|
contacts can be tagged. In addition, with powerful. Search options you have as the entire customer base better than ever in view.
|
|
|
|
Daily backup
|
|
256bit SSL encryption
|
|
TÜV certified datacenter
|
|
|
|
Free version
|
|
No hidden costs
|
|
No minimum contract term
|
|
|
|
iPhone App
|
|
Runs in any browser
|
|
No installation required on the PC
|
|
|
|
Easy to use
|
|
Reduced to the essentials
|
|
Automated, where it is only Possible
|
|
|
|
(Copy of the Vendor Homepage: https://sevdesk.de/)
|
|
|
|
|
|
Abstract Advisory Information:
|
|
==============================
|
|
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official SEVENIT GmbH SevDesk v3.10 web-application & cloud online-service.
|
|
|
|
|
|
Vulnerability Disclosure Timeline:
|
|
==================================
|
|
2014-09-01: Researcher Notification & Coordination (Benjamin Kunz Mejri)
|
|
2014-09-02: Vendor Notification (SevDesk Developer Team)
|
|
2014-09-07: Vendor Response/Feedback (SevDesk Developer Team)
|
|
2015-02-01: Vendor Fix/Patch Notification (SevDesk Developer Team)
|
|
2015-03-23: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Discovery Status:
|
|
=================
|
|
Published
|
|
|
|
|
|
Affected Product(s):
|
|
====================
|
|
SevenIT
|
|
Product: SevDesk - Web Application 3.1.0
|
|
|
|
|
|
Exploitation Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity Level:
|
|
===============
|
|
High
|
|
|
|
|
|
Technical Details & Description:
|
|
================================
|
|
Multiple persistent input validation web vulnerabilities are detected in the official SEVENIT Software GmbH - sevDesk v3.10 web-application.
|
|
The vulnerability allows remote attackers or low privileged user account to inject own malicious script codes to the application-side of the
|
|
vulnerable web-application module or service.
|
|
|
|
The security vulnerability is located in the `firstname`, `surname` & `family` name values of the main sevDesk `Dasboard` application module.
|
|
Remote attackers are able to inject own codes to the main dashboard service by manipulation of the registration username. The execution of
|
|
the injected script code occurs on the application-side in the main dasboard module through the rightHead and feedcontent class. The attack
|
|
vector is persistent and the request method to inject the code is POST. The victim user can also change the name by usage of the application
|
|
which does not require an admins interaction on successful exploitation.
|
|
|
|
The security risk of the persistent script code inject web vulnerabilities is estimated as medium with a cvss (common vulnerability scoring system)
|
|
count of 5.9. Exploitation of the persistent vulnerability requires a low privileged sevdesk user account with restricted access and no direct
|
|
user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent external redirects
|
|
to malicious source and persistent manipulation of affected or connected application modules.
|
|
|
|
|
|
Request Method(s):
|
|
[+] POST
|
|
|
|
Vulnerable Module(s):
|
|
[+] Registration to SevDesk
|
|
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] surname
|
|
[+] firstname
|
|
[+] family name
|
|
|
|
Affected Module(s):
|
|
[+] Dasboard Index - rightHead & feedcontent
|
|
|
|
|
|
Proof of Concept (PoC):
|
|
=======================
|
|
The persistent input validation web vulnerability can be exploited by low privileged application user accounts with low user interaction.
|
|
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
|
|
|
|
Manual steps to reproduce the vulnerability
|
|
|
|
1. Register an account by usage of the following webpage https://my.sevdesk.de/register/
|
|
2. Include to the surname, family name and firstname your own script code as payload
|
|
3. Save the registration form and go to the website https://my.sevdesk.de/
|
|
4. Login with the user account data
|
|
5. The execution of the injected script code occurs after the registration POST method request and next to the redirect in the main dasboard index (rightHead < name > feedcontent)
|
|
6. Successful reproduce of the application-side security vulnerability!
|
|
|
|
|
|
PoC: rightHead > Displayname (First- & Lastname)
|
|
|
|
<div id="middleHead">
|
|
<input id="suche" type="text" onfocus="this.value = ''" value="Gehe zu Kontakt, Projekt, Dokument..." />
|
|
</div>
|
|
<div id="rightHead">
|
|
<div style="float:right;margin-top:5px;text-align: right;padding-right:5px;">
|
|
<div style="color:#fff;padding:3px;margin-bottom:2px;">
|
|
<span style="color:#f5d385;font-weight:bold;">a>"<[PERSISTENT INJECTED SCRIPT CODE VIA NAME VALUE!]> b>"</span></div>
|
|
<a href="/admin/company">Einstellungen</a> |
|
|
<a href="http://portal.sevdesk.de/" target="_blank">Hilfe</a> | <a href="./auth/logout/">Logout</a>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div id="headNav" style="top:80px;">
|
|
<div class="headwrapper">
|
|
<ul id="mainNavigation">
|
|
|
|
|
|
PoC: Verlauf > feedcontent
|
|
|
|
<div>
|
|
<div class="feed" id_feed="393424"><div class="imgpos"><img src="/img/icons/24x24/offer.png"></div><div class="feedbody">
|
|
<div class="headline">Samstag, 30. August 2014 - 02:14</div><div class="feedcontent">
|
|
a>"<[PERSISTENT INJECTED SCRIPT CODE VIA NAME VALUE!]> b>"<[PERSISTENT INJECTED SCRIPT CODE VIA NAME VALUE!]> hat den Status des
|
|
<img src="/img/icons/16x16/offer.png"> <a href="/om/detail/index/id/60547">Angebots - 1007</a> auf
|
|
"archiviert" geändert
|
|
</div></div><div class="clearfix"></div></div>
|
|
<div class="feed" id_feed="393423"><div class="imgpos"><img src="/img/icons/24x24/offer.png"/></div><div class="feedbody">
|
|
<div class="headline">Samstag, 30. August 2014 - 02:14
|
|
|
|
|
|
|
|
--- PoC Session Logs [POST] (Registration sevDesk) ---
|
|
Status: 200[OK]
|
|
POST https://my.sevdesk.de/register/save Load Flags[LOAD_BYPASS_CACHE LOAD_BACKGROUND ] Größe des Inhalts[94] Mime Type[text/html]
|
|
Request Header:
|
|
Host[my.sevdesk.de]
|
|
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0]
|
|
Accept[application/json, text/javascript, */*; q=0.01]
|
|
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
|
Accept-Encoding[gzip, deflate]
|
|
Content-Type[application/x-www-form-urlencoded; charset=UTF-8]
|
|
X-Requested-With[XMLHttpRequest]
|
|
Referer[https://my.sevdesk.de/register]
|
|
Content-Length[119]
|
|
Cookie[PHPSESSID=63m788aic41f173a01akttgp24; optimizelySegments=%7B%7D; optimizelyEndUserId=oeu1409658038644r0.9444753343384411;
|
|
optimizelyBuckets=%7B%7D; __utma=47898149.1078820709.1409658041.1409658041.1409658041.1; __utmb=47898149.3.10.1409658041; __utmc=47898149;
|
|
__utmz=47898149.1409658041.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); kvcd=1409658049586;
|
|
km_ai=5La%2FUBeVvA7zRXwSTd4gSRBJccE%3D; km_uq=; km_vs=1; km_lv=1409658050; _ga=GA1.2.1078820709.1409658041]
|
|
Connection[keep-alive]
|
|
Pragma[no-cache]
|
|
Cache-Control[no-cache]
|
|
POST-Daten:
|
|
name[[PERSISTENT INJECTED SCRIPT CODE VIA NAME VALUE!]]
|
|
surename[[PERSISTENT INJECTED SCRIPT CODE VIA SURNAME VALUE!]]
|
|
familyname[[PERSISTENT INJECTED SCRIPT CODE VIA FAMILY NAME VALUE!]]
|
|
username[support%40vulnerability-lab.com]
|
|
password[chaos666]
|
|
Response Header:
|
|
Date[Tue, 02 Sep 2014 11:44:30 GMT]
|
|
Server[Apache/2.2.22 (Debian)]
|
|
X-Powered-By[PHP/5.4.4-14+deb7u7]
|
|
Expires[Thu, 19 Nov 1981 08:52:00 GMT]
|
|
Cache-Control[no-store, no-cache, must-revalidate, post-check=0, pre-check=0]
|
|
Pragma[no-cache]
|
|
Vary[Accept-Encoding]
|
|
Content-Encoding[gzip]
|
|
Content-Length[94]
|
|
Keep-Alive[timeout=5, max=99]
|
|
Connection[Keep-Alive]
|
|
Content-Type[text/html; charset=utf-8]
|
|
|
|
|
|
Reference(s):
|
|
https://my.sevdesk.de/register/save
|
|
|
|
|
|
Solution - Fix & Patch:
|
|
=======================
|
|
The vulnerbility can be patched by a secure parse and encode of the affected rightHead & feedcontent values in the dashboard application index.
|
|
Filter and restrict the user registration input form with a secure mask or exception-handling to prevent persistent code injections in the important name values.
|
|
|
|
Note: The issue has been patched by the manufacturer since 2015-02-01
|
|
|
|
|
|
Security Risk:
|
|
==============
|
|
The security risk of the persistent input validation web vulnerabilities in the main dasboard application is estimated as medium. (CVSS 5.9)
|
|
|
|
|
|
Credits & Authors:
|
|
==================
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
|
|
|
|
|
Disclaimer & Information:
|
|
=========================
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
|
|
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
|
|
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
|
|
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
|
|
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
|
|
policies, deface websites, hack into databases or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
|
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
|
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
|
|
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
|
|
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
|
|
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
|
|
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY LABORATORY - RESEARCH TEAM
|
|
SERVICE: www.vulnerability-lab.com
|
|
CONTACT: research@vulnerability-lab.com
|
|
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt |