XSSing Open Web Analytics version 1.5.7 and older

Hello everyone,

While laying on my couch, surfing my Twitter's timeline on my mobile, I noticed that KIWI.KI have started their program on HackerOne.

I opened the program's page to read the guidelines and learn about the targets, then I started to enumerate the subdomains that are in-scope for the program to start looking for bugs in them.

I found the subdomain https://web.kiwi.ki, calling that URL in my browser's address bar resulted in a 302 redirect to the login form located at https://web.kiwi.ki/index.php?owa_do=base.loginForm&owa_go=https://web.kiwi.ki/&.

Noticing that the values of the GET parameters owa_do and owa_go appear inside two hidden <input> fields in the source of the page, I started testing them for XSS.

I couldn't inject into the parameter owa_do as changing/adding/removing characters from the initial value of this parameter causes the page to break and show a blank page, so I was left with the other parameter to test.

Injecting a simple testing probe like <"xss', I found that the injection breaks out of the value parameter of the hidden <input> field due to the lack of encoding/filtering/escaping of all the special characters in the string.

Triggering an alert box in this case was as easy as injecting the payload "><svg onload="alert(domain).

The XSS here is cross-browser because any injection of the form <x> was completely stripped and removed, which allows us to bypass Chrome's XSS auditor and Edge's XSS filter.

After succeeding to create this beautiful alert box, I started scraping the page source to find the vendors of the service, as it was clearly not developed by KIWI. I found a link to http://www.openwebanalytics.com, which is an "open source web analytics software that you can use to track and analyze how people use your websites and applications", according to their landing page.

Knowing that the software is not actually KIWI's, I started to search the web to find more sites that use the service, and I actually found a bunch of web applications that use it.

I reported this bug on 25/2/2016 and it was fixed on 28/2/2016 in the following commit:

https://github.com/padams/Open-Web-Analytics/commit/4ee856074f93fa9e4a49efb8d45319e7783b6aee

Thanks for reading, have a nice day ;)

Microsoft's Parature XSS

Hello,

One day, I decided to test ask.com and it's subdomains for XSS. While doing so, I came across a link that points to their help center, which is located at help.ask.com.

Clicking on the link, the URL was translated to http://help.ask.com/ics/support/default.asp?deptID=30018&_referrer= , I started testing the parameter "_referrer" to see if it was vulnerable to open redirects.

I found that the value of the parameter gets reflected inside a function inside a <script>, so I quitted testing for open redirects and started looking for a way to trigger an XSS, see the following picture:

The developers did not sanitize the value of "_referrer" properly, double quotes, alert() and similar functions, and </script> tags were all allowed. So all I needed at this stage was some help from my friend and teacher, Brute Logic. He noticed that the function exitSupport() was never called on the page, so all he needed to do was to break out of it.
The following two screenshots show the code after the injection of the payload and the alert box:

 After we successfully triggered the alert box, Brute suggested that I should look deeper into the bug, saying "don't stop there, try to figure out where the rabbit hole really goes".

He then told me to look for websites containing the same code inside the script tag. He advised me to use nerdydata.com, so I went to the mentioned website and started searching for the function exitSupport(). And there was the surprise, I found dozens of websites using the flawed piece of software. See the picture below:

Going further into the research, Brute quickly identified the origin of the flawed script using whatweb.net , the following screenshot shows the name of the flawed service:

We only realized that the product was owned and developed by Microsoft after we visited Parature's official website, parature.com :

The following is an excerpt from parature.com :

"Parature is a cloud-based customer service solution that empowers brands and organizations to deliver consistent care anytime, anywhere through a powerful combination of knowledge management, self-service and multi-channel engagement. Quick to deploy, scalable and flexible, and mobile-responsive, discover the customer support software solution that many of the world’s leading brands are using to deliver productive, proactive and personalized customer care.".

Then, we decided to look for other websites being affected by the flaw, and we found some big names, below is a GIF containing some of these names:

Timeline:

• 17-11-2015 Initial report, Microsoft replied that they couldn't reproduce the issue, further explanation of the issue is sent
• 18-11-2015 Microsoft replied that they opened a case for the bug
• 30-11-2015 I sent an email asking if the bug has been fixed
• 02-12-2015 Microsoft replied that the issue is fixed and asked for our names for the Hall of Fame
• 19-01-2015 The Hall of Fame for the month of December is released

Beware !! Vodafone's spying on you

Hello,

Today, while surfing on Twitter, I noticed Brute Logic's Tweet about the JS event handler "onbeforescriptexecute", which makes a tag execute JS right before every <script> tag on the page starts execution.

I followed the link provided in the tweet anticipating that only one alert will be there because of the <script> tag that is already in the page, but I was surprised to see that actually two alert boxes appeared.

I inspected the source code of the page, and was thrilled to see a completely new <script> tag there, which was not there in the first place on the page, neither was it injected in the payload. See the following screenshot:

After some research on Google, I found out that the script gets injected by my ISP, Vodafone. This means that they are intercepting and eavesdropping on EVERY request I make to EVERY page that doesn't use HTTPS as protocol, and of course EVERYONE else's requests as well.

The script basically replaces all the images in a given page with low quality ones, saving bandwidth for Vodafone, and giving them the opportunity to inspect every request issued by the devices connected to them.
 
Reference: http://www.sphaero.org/blog:2012:0418_am_i_hacked_oh_it_s_just_vodafone