malerisch.net

Details Vendor Site: Avant browser ( www.avantbrowser.com ) Date: December, 5 2012 – CVE (TBA) Affected Software: Avant Browser Ultimate 2012 Build 28 and potentially previous versions Status: Unpatched Researcher: Roberto Suggi Liverani -  @malerisch PDF version:  Avant_multiple_vulnerabilities_advisory.pdf Stored Cross Site Scripting - Feed Reader (browser://localhost/lst?*) A malicious user can inject and store arbitrary JavaScript/HTML code via multiple RSS feed elements. Vulnerable elements are the following: <title>  element: JavaScript injection using HTML encoded payload <link>  element: JavaScript injection using javascript: pseudouri ( this is rendered in about:blank zone.) <description>  element: JavaScript injection using HTML encoded payload The following table shows an example of malicious RSS feed: <?xml version='1.0' encoding="ISO-8859-1"?> <rss version='2.0'> <channel> <...

Details Vendor Site: Avant browser ( www.avantbrowser.com ) Date: December, 5 2012 – CVE (TBA) Affected Software: Avant Browser Ultimate 2012 Build 27 and potentially previous versions Status: Unpatched Researcher: Roberto Suggi Liverani -  @malerisch PDF version:  Avant_multiple_vulnerabilities_advisory.pdf Cross Context Scripting – browser:home – Most Visited And History Tabs A malicious user can inject arbitrary JavaScript/HTML code through the websites visited with the Avant Browser. The code injection is rendered into the both the Most Visited and History tabs within the browser:home page,  which displays URL and the title of the page. A malicious user can inject and store JavaScript/HTML content by using the <title> HTML element, as shown in the table below: <title>aaa"><img src=a onerror='var vstr = {value: ""};window.navigator.AFRunCommand(60003, vstr);alert(vstr.value);'></title> Injected payload is render...

Details Vendor Site: Avant browser ( www.avantbrowser.com ) Date: December, 5 2012 – CVE (TBA) Affected Software: Avant Browser Ultimate 2012 Build 28 and potentially previous versions Status: Unpatched Researcher: Roberto Suggi Liverani -  @malerisch PDF version: Avant_multiple_vulnerabilities_advisory.pdf Same of Origin Policy Bypass A malicious user can execute arbitrary JavaScript/HTML code on the privileged browser:home page from an untrusted web page on Internet (http:// zone). This is possible by creating an iframe element pointing to the browser:home page and then invoking privileged commands using a window object reference to the iframe element, as shown in the example below: <iframe name="test2" src=" browser:home "></iframe> <script> window['test2'].navigator.AFRunCommand(id_of_privileged_command, vstr) </script> This code allows interaction from an untrusted zone (http://) to a trusted and priv...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Patched Researcher: Roberto Suggi Liverani -  @malerisch PDF version:  Maxthon_multiple_vulnerabilities_advisory.pdf Incorrect Executable File Handling The way local executable files are handled by the Maxthon browser seems related to the fact that external tools such as Calc, Desktop, and others can be launched from the browser itself. This design is insecure as it allows JavaScript to directly invoke an executable. As shown in previous exploits, this design can aid exploitation by chaining different vulnerabilities at the same time, allowing for arbitrary command execution. This vulnerability can be exploited in multiple ways: Scenario 1 1. User visits a page which invokes the window.open() function against an executable file – e.g. file:///C:/windows/system32/cmd.exe 2. User unblocks the pop up bl...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.3.3.1000 and previous versions Status: Patched Researcher: Roberto Suggi Liverani -  @malerisch PDF version:  Maxthon_multiple_vulnerabilities_advisory.pdf Cross Context Scripting Cross Context Scripting   (XCS) is a particular code injection attack vector where the injection occurs from an untrusted zone (e.g. Internet) into a privileged browser zone. In this case, it is possible to inject arbitrary JavaScript/HTML code from an untrusted page into Maxthon browser privileged zone - mx://res/*. Description It is possible to inject JavaScript/HTML payload via the “title” parameter of the “Add to Favorites” form. In Maxthon, bookmark UI security controls are weak and allow a trivial exploitation, even for an attentive user, considering the following factors: window.external.addFavorite() can be invoked in an automated fashion; The tit...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 6 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Patched Researcher: Roberto Suggi Liverani -  @malerisch Privileged APIs Available on i.maxthon.com The web site i.maxthon.com can access and use privileged Maxthon DOM object (e.g. maxthon.*). Such Maxthon object interfaces can be used to read last visited pages or favorites, as shown in the following screen shot. Such information can only be retrieved by using privileged Maxthon functions. Different issues were identified regarding this design: No control on resolution of IP address for i.maxthon.com domain; No use of SSL to serve the i.maxthon.com web site; Use of icon "Trusted site" on the URL bar even when i.maxthon.com resolves to a different IP address. Exploitation This vulnerability can be exploited in several ways, as listed below: DNS poisoning - Force resolution of i.maxthon.com...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Unpatched (at the time of publishing) Researcher: Roberto Suggi Liverani -  @malerisch PDF version: Maxthon_multiple_vulnerabilities_advisory.pdf Cross Context Scripting Cross Context Scripting   (XCS) is a particular code injection attack vector where the injection occurs from an untrusted zone (e.g. Internet) into a privileged browser zone. In this case, it is possible to inject arbitrary JavaScript/HTML code from an untrusted page into Maxthon browser privileged zone - mx://res/*. Description A malicious user can inject arbitrary JavaScript/HTML code via multiple RSS feed elements. Vulnerable elements are the following: <title> element: JavaScript injection using HTML encoded payload <link> element: JavaScript injection using javascript: pseudouri <description> element:...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Unpatched (at the time of publishing) Researcher: Roberto Suggi Liverani - @malerisch PDF version:  Maxthon_multiple_vulnerabilities_advisory.pdf Cross Context Scripting Cross Context Scripting  (XCS) is a particular code injection attack vector where the injection occurs from an untrusted zone (e.g. Internet) into a privileged browser zone. In this case, it is possible to inject arbitrary JavaScript/HTML code from an untrusted page into Maxthon browser privileged zone - mx://res/*. Description A malicious user can inject arbitrary JavaScript/HTML code through the websites visited with the Maxthon browser. The code injection is rendered into the History page (about:history), which displays URL and a short description of the visited pages. A malicious user can inject JavaScript/HTML content by using the l...

During a security review, I have found a quick way to perform PIN brute force attack against accounts registered with a Cisco Unified Communications Manager (CallManager). A quick google "callmanager brute force" didn't bring any relevant results, so I thought to share the simple technique I have used. When looking at the phone handset configuration, some URLs are set to allow the handset to retrieve Personal Address Book details or access the Fast Dials. That caught my attention and I immediately pointed my web proxy to those URLs, forgetting about the handset interface. What happens when using the handset is that the handset itself performs HTTP requests to the CallManager. A simple HTTP GET request is performed by the handset to initiate the login sequence with a request as the one below: 1) GET - https://x.x.x.x/ccmpd/pdCheckLogin.do?name=undefined The response contains a reference to the login.do page along with a "sid" token, which is used ...

I have promised I would have something written about my Hack In the Box 2012 Amsterdam  conference experience. First thing, it was one of the best security conference I have ever been. Big props to Dhillon ( @l33tdawg ) and the HITB crew for organising such event. I have been organising conferences in the past ( OWASP NZ Day 2009 and 2010 ) and I know something about what happens in the background. The conference venue was awesome, a pimping five stars hotel ;-) and again need to thank the crew for the wise choice. Bad thing is that I checked out with my wallet "lighter" than usual, after having dinners at the Japanese restaurants and trying all the amenities of the fitness center. My talk ( pdf || slideshare ) was on the first day along with two other media interviews with Mirko Zorz ( @helpnetsecurity ) of Help Net Security and Edward Kovacs ( @EduardKovacs ) of Softpedia. Both interviews went pretty well and they will be published soon. Unfortunately,...

Following disclosure of Oracle bugs , here is another bug found in Oracle GlassFish Server 3.1.1. The interesting part of this advisory is the exploit. When looking at the features of the Oracle GlassFish Server, I have noticed that with a XSS it would be possible to steal the session token and bypass HTTPOnly protection. I have found this condition to be true if a user is authenticated to the REST interface, which does not have the same security controls of the main web administrative interface. Quite an interesting point to keep in consideration when testing applications that come with a standard interface and a REST interface as well. Details Vendor Site: Oracle (www.oracle.com) Date: April, 19th 2012 – CVE 2012-0551 Affected Software: Oracle GlassFish Server 3.1.1 (build 12) Researcher: Roberto Suggi Liverani PDF version: http://www.security-assessment.com/files/documents/advisory/Oracle_GlassFish_Server_Multiple_XSS.pdf Description Security-Assessment.com has discover...

Time for some disclosure. Below, details of a CSRF bug discovered in Oracle GlassFish Server 3.1.1 few months ago. Interesting to observe that Oracle rates this as the third most critical bug fixed among the Oracle Sun Products. I guess that's because of the exploit which was included in the original report and which I am releasing as part of this advisory. I found a curios angle to exploit this bug, as arbitrary file upload of a WAR archive can be performed. A quite cool way to exploit a CSRF and own Oracle GlassFish, if you ask me :-). Enjoy. Details Vendor Site:  Oracle (www.oracle.com) Date:  April, 19th 2012 – CVE 2012-0550 Affected Software:  Oracle GlassFish Server 3.1.1 (build 12) Researcher:  Roberto Suggi Liverani PDF version:  http://www.security-assessment.com/files/documents/advisory/Oracle_GlassFish_Server_REST_CSRF.pdf Description Security-Assessment.com has discovered that the Oracle GlassFish Server REST interface is vulnerable to C...

In about six weeks time, I will be in .eu presenting at Hack In The Box Amsterdam 2012 . I am very excited about it as that will be my first HITB conference. Also, the speakers line-up and conference agenda are impressive. This time, I will be presenting with Scott Bell, my colleague at Security-Assessment.com . The presentation will cover the results of our research which focuses on browser bug hunting. Certainly, there is no fun without dropping some 0days... so expect to see some cool bugs if you are attending our talk. If not, you will be able to grab demos, videos and slides following the conference. Here is the talk abstract: Window Shopping: Browser Bug Hunting in 2012 Web browsers have become part of everyday life, and are relied upon by millions of internet citizens each day. The feature rich online world has turned the once simple web browser into a highly complex (and very often insecure) desktop application. As browser vendors have extended functionality and supp...