Script Injection Vulnerability Remediated

[Scott Baker via Fulldisclosure <fulldisclosure () seclists org>]

A script injection vulnerability was discovered by a penetration tester hired by Prosper and later by a security 
professional. Thanks to Paul O’Neil at CyberScout for his responsible disclosure and assistance in confirming this 
vulnerability.



For the attack to be successful, the attacker needed to be logged into 
prosper.com<https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fprosper.com%2F&data=02%7C01%7Csbaker%40prosper.com%7C7b23dc89e8394767025f08d7befc24a0%7C924fb1d22d664b62aeca6517836f3b2f%7C1%7C0%7C637187862469813924&sdata=g7V%2ByRdKPP3UNH%2Fqr0XLa%2FvAlqGoMT4StOEsHCtB%2FsY%3D&reserved=0>
 and could potentially save scripts that would run against their account.   The Prosper information security team 
checked the database for persisted attacks and detected some benign proof of concepts.  Monitoring alerts were created 
to detect further attacks. Developers then implemented input validation to prevent further attacks from being saved to 
the database.  Encoding was added as a defense in depth measure such that saved attacks would not work. In addition, 
Prosper has enabled Content Security Policy headers site-wide to whitelist domains that are approved for use in the 
context of our site.



Scott Baker

Director, Information Security

[/var/folders/pp/z1x004w566s7p31cjl2505shtvw7m0/T/com.microsoft.Outlook/WebArchiveCopyPasteTempFiles/cidimage001.png@01D3CA8A.F07D7DD0]

221 Main Street, Suite 300

San Francisco, CA 94105





CONFIDENTIALITY STATEMENT: This email message, together with all attachments, is intended only for the individual or 
entity to which it is addressed and may contain legally privileged or confidential information. Any dissemination, 
distribution or copying of this communication by persons or entities other than the intended recipient, is strictly 
prohibited, and may be unlawful. If you have received this communication in error please contact the sender immediately 
and delete the transmitted material and all copies from your system, or if received in hard copy format, return the 
material to us via the United States Postal Service. Thank you.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/