计算机网络技术

Web News, Technology, Science, etc

网络技术是从1990年代中期发展起来的新技术,它把互联网上分散的资源融为有机整体,实现资源的全面共享和有机协作,使人们能够透明地使用资源的整体能力并按需获取信息。

KnowledgeTree OSS 3.0.3b Application Reflected XSS (Cross-site Scripting) Web Security 0Day Vulnerability




Exploit Title: KnowledgeTree login.php &errorMessage parameter Reflected XSS Web Security Vulnerability

Product: Knowledge Tree Document Management System

Vendor: Knowledge Inc

Vulnerable Versions: OSS 3.0.3b

Tested Version: OSS 3.0.3b

Advisory Publication: August 22, 2015

Latest Update: August 31, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference:

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized modification

Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)





Recommendation Details:



(1) Vendor & Product Description:



Vendor:

KnowledgeTree




Product & Vulnerable Versions:

Knowledge Tree Document Management System

OSS 3.0.3b




Vendor URL & Download:

Product can be obtained from here,

http://download.cnet.com/KnowledgeTree-Document-Management-System/3000-10743_4-10632972.html

http://www.knowledgetree.com/





Product Introduction Overview:

"KnowledgeTree is open source document management software designed for business people to use and install. Seamlessly connect people, ideas, and processes to satisfy all your collaboration, compliance, and business process requirements. KnowledgeTree works with Microsoft® Office®, Microsoft® Windows® and Linux®."








(2) Vulnerability Details:

KnowledgeTree web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.


Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. KnowledgeTree has patched some of them. "Bugtraq is an electronic mailing list dedicated to issues about computer security. On-topic issues are new discussions about vulnerabilities, vendor security-related announcements, methods of exploitation, and how to fix them. It is a high-volume mailing list, and almost all new vulnerabilities are discussed there.". It has listed similar exploits, such as Bugtraq (Security Focus) 32920.




(2.1) The code flaw occurs at "&errorMessage" parameter in "login.php" page.


One similar bug is CVE-2008-5858. Its X-Force ID is 47529.






References:
http://seclists.org/oss-sec/2015/q3/458
http://tetraph.com/security/xss-vulnerability/knowledgetree-oss-3-0-3b-reflected-xss/
https://progressive-comp.com/?l=oss-security&m=144094021709472
https://infoswift.wordpress.com/2015/08/31/knowledge-tree-xss/
http://japanbroad.blogspot.jp/2015/08/knowledge-tree-bug-exploit.html
http://marc.info/?l=full-disclosure&m=144099659719456&w=4
http://tetraph.blog.163.com/blog/static/234603051201573144123156/
http://www.openwall.com/lists/oss-security/2015/08/30/2
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg02446.html
http://itinfotech.tumblr.com/post/128016383831/knowledge-tree-xss
http://germancast.blogspot.com/2015/08/knowledge-tree-xss.html
http://permalink.gmane.org/gmane.comp.security.oss.general/17655
http://webtech.lofter.com/post/1cd3e0d3_806e1d4


测试想法:

IT 计算机&信息网络 技术:

白帽子计算机安全:

CNN Travel.cnn.com XSS and Ads.cnn.com Open Redirect Web Security Vulnerabilities


Domain:
cnn.com


"The Cable News Network (CNN) is an American basic cable and satellite television channel that is owned by the Turner Broadcasting System division of Time Warner. The 24-hour cable news channel was founded in 1980 by American media proprietor Ted Turner. Upon its launch, CNN was the first television channel to provide 24-hour news coverage, and was the first all-news television channel in the United States. While the news channel has numerous affiliates, CNN primarily broadcasts from the Time Warner Center in New York City, and studios in Washington, D.C. and Los Angeles, its headquarters at the CNN Center in Atlanta is only used for weekend programming. CNN is sometimes referred to as CNN/U.S. to distinguish the American channel from its international sister network, CNN International. As of August 2010, CNN is available in over 100 million U.S. households. Broadcast coverage of the U.S. channel extends to over 890,000 American hotel rooms, as well as carriage on cable and satellite providers throughout Canada. Globally, CNN programming airs through CNN International, which can be seen by viewers in over 212 countries and territories. As of February 2015, CNN is available to approximately 96,289,000 cable, satellite and, telco television households (82.7% of households with at least one television set) in the United States." (Wikipedia)


Discovered and Reported by:
Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore.  (@justqdjing)
http://www.tetraph.com/wangjing/



Vulnerability Description:
CNN has a cyber security bug problem. It cab be exploited by XSS (Cross Site Scripting) and Open Redirect (Unvalidated Redirects and Forwards) attacks.

Based on news published, CNN users were hacked based on both Open Redirect and XSS vulnerabilities.

According to E Hacker News on June 06, 2013, (@BreakTheSec) came across a diet spam campaign that leverages the open redirect vulnerability in one of the top News organization CNN.

After the attack, CNN takes measures to detect Open Redirect vulnerabilities. The measure is quite good during the tests. Almost no links are vulnerable to Open Redirect attack on CNN's website, now. It takes long time to find a new Open Redirect vulnerability that is un-patched on its website.

CNN.com was hacked by Open Redirect in 2013. While the XSS attacks happened in 2007.



<1> There are some tweets complaining about hacked with links from CNN.

At the same time, the cybercriminals have also leveraged a similar vulnerability in a Yahoo domain to trick users into thinking that the links point to a trusted website.


Yahoo Open Redirects Vulnerabilities:
http://securityrelated.blogspot.com/2014/12/yahoo-yahoocom-yahoocojp-open-redirect.html





<2> CNN.com XSS hacked
http://seclists.org/fulldisclosure/2007/Aug/216


Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. CNN has patched some of them. BugTraq is a full disclosure moderated mailing list for the *detailed* discussion and announcement of computer security vulnerabilities: what they are, how to exploit them, and how to fix them. The below things be posted to the Bugtraq list: (a) Information on computer or network related security vulnerabilities (UNIX, Windows NT, or any other). (b) Exploit programs, scripts or detailed processes about the above. (c) Patches, workarounds, fixes. (d) Announcements, advisories or warnings. (e) Ideas, future plans or current works dealing with computer/network security. (f) Information material regarding vendor contacts and procedures. (g) Individual experiences in dealing with above vendors or security organizations. (h) Incident advisories or informational reporting. (i) New or updated security tools. A large number of the fllowing web securities have been published here, Buffer overflow, HTTP Response Splitting (CRLF), CMD Injection, SQL injection, Phishing, Cross-site scripting, CSRF, Cyber-attack, Unvalidated Redirects and Forwards, Information Leakage, Denial of Service, File Inclusion, Weak Encryption, Privilege Escalation, Directory Traversal, HTML Injection, Spam. It also publishes suggestions, advisories, solutions details related to XSS and URL Redirection vulnerabilities and cyber intelligence recommendations.



Detail:
http://seclists.org/fulldisclosure/2014/Dec/128




Related Articles:
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01507.html
https://packetstormsecurity.com/files/129754/cnn-xssredirect.txt
http://cxsecurity.com/issue/WLB-2014120196
https://progressive-comp.com/?l=full-disclosure&m=141988778706126&w=1
https://itinfotechnology.wordpress.com/2015/01/01/cnn-travel-cn
http://russiapost.blogspot.com/2015/06/cnn-travelcnncom-xss
https://www.facebook.com/permalink.php?story_fbid=745810602196352
http://www.weibo.com/5337321538/Clij19Krr?from=page_1005055337321538
https://plus.google.com/u/0/112682696109623633489/posts/TyipiFnULRj
http://webcabinet.tumblr.com/post/116075198227/ithut-cnn-cnn
http://mathdaily.lofter.com/post/1cc75b20_4f0a751
https://twitter.com/tetraphibious/status/607085555776561152
http://qianqiuxue.tumblr.com/post/120838173915/ithut-cnn-xss-url-redirection-bug
http://itprompt.blogspot.com/2015/06/cnn-travelcnncom-xss
https://www.facebook.com/permalink.php?story_fbid=891722397533572
http://tetraph.com/security/xss-vulnerability/cnn-xss-url-redirect-bug/
http://ittechnology.lofter.com/post/1cfbf60d_7338770
https://hackertopic.wordpress.com/2015/01/04/cnn-travel-cnn
http://www.inzeed.com/kaleidoscope/xss-vulnerability/cnn-xss-url-redirect-bug/



IT 计算机信息网络安全技术:

New York Times Articles Before 2013 May Vulnerable to XSS Attack

 

New York Times articles’ pages dated before 2013 may suffer from an XSS (Cross-site Scripting) vulnerability, according to the report posted by security researcher Wang Jing. Wang is a mathematics Ph.D student from School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore. He published his discovery in well-known security mail list Full Disclosure.

 

According to Wang, all pages before 2013 that contain buttons such as “PRINT”,”SINGLE PAGE”, “Page” and “NEXT PAGE” are affected by the XSS vulnerability. Meanwhile, the researcher also published a proof of concept video to prove the existence of the XSS flaw.

 

As of yet, there are no known cases of criminals exploiting the Times’ XSS issue in order to attack users. However, according to Wang, the threat is possible, and the New York Times has a big enough audience that an XSS attack, even via its older articles, could still affect a broad number of users. The affected New York Times articles are still indexed in Google search engines, and are still frequently hyperlinked in other articles.

 

However according to the researcher, New York Times has now a much safer mechanism, implemented sometime in 2013, that sanitizes all URLs sent to its server.

 

Cross-site scripting (XSS) vulnerabilities usually reside in web applications and can be used by attackers to modify the normal flow of the web page. A cybercriminal can use it easily to perform URL redirect, mine for victim’s browser details, session hijacking, phishing, or even steal cookies.

 

XSS issues are not entirely uncommon. So far we have seen that Google, Amazon, Yahoo, Microsoft and Facebook all had this kind issue reported.

 
 



 

Related News:

http://www.tomsguide.com/us/xss-flaw-ny-times,news-19784.html

http://www.hotforsecurity.com/blog/cross-site-scripting-xss-vulnerability-in-new-york-times-articles-before-2013-10555.html

http://news.softpedia.com/news/XSS-Risk-Found-In-Links-to-New-York-Times-Articles-Prior-to-2013-462334.shtml

http://tetraph.com/security/xss-vulnerability/all-links-to-new-york-times-articles-prior-to-2013-vulnerable-to-xss-attacks/

http://japanbroad.blogspot.jp/2014/11/xss2013.html

http://mathpost.tumblr.com/post/103788575340/whitehatview-urls-to-articles-in-new-york-times

http://itsecurity.lofter.com/post/1cfbf9e7_6f57b38

http://canghaixiao.tumblr.com/post/118998729442/2013-xss

http://www.hotforsecurity.com/blog/cross-site-scripting-vulnerability-in-mozillas-cross-reference-sub-domains-10607.html

http://www.techenet.com/2014/12/doubleclick-do-google-pode-ser-vulneravel-a-ataques/

https://infoswift.wordpress.com/2014/11/09/new-york-times-xss/

http://germancast.blogspot.de/2014/11/alle-links-zu-new-york-times-artikel.html

http://diebiyi.com/articles/security/new-york-times-xss/

  


IT 计算机信息网络安全技术:

Yahoo and Yahoo Japan May be Vulnerable to Spams


Student security researcher Wang Jing from School of Physical and Mathematical Sciences at Nanyang Technological University, Singapore, has found new security vulnerabilities related to Yahoo.


After reporting several Open Redirect vulnerabilities to Yahoo. Yahoo’s responses were “It is working as designed”. It seems that Yahoo do not take the vulnerabilities seriously at all.


Based on Wang’s report on Full Disclosure “Multiple Open Redirect vulnerabilities were reported Yahoo. All Yahoo’s responses were “this intended behavior”. However, these vulnerabilities were patched later.“


The vulnerability of Yahoo occurs at “ard.yahoo.com” page. While the vulnerability of Yahoo Japan happens at sensitive page “http://order.store.yahoo.co.jp”.
Proof of concept on YouTube were also released to illustrate exploits. 

(1)Yahoo Open Redirect
https://www.youtube.com/watch?v=k4eFLsTyZkg
(2)Yahoo Japan Unvalidated Redirects and Forwards (URF)
https://www.youtube.com/watch?v=2SM78WKAVr8

In fact, Yahoo’s users were attacked based on redirection this year. Base on CNET on January 4, 2014, “Yahoo.com visitors over the last few days may have been served with malware via the Yahoo ad network, according to Fox IT, a security firm in the Netherlands. Users visiting pages with the malicious ads were redirected to sites armed with code that exploits vulnerabilities in Java and installs a variety of different malware. ” 


Wang wrote that the attack could work without a user being logged in. And his tests were using Firefox (33.0) in Ubuntu (14.04) and IE (10.0.9200.16521) in Windows 8.
Redirect can ensure a good user experience. However, if it is not properly provided. Attackers can use this to trick users. This is common in Phishing attacks and Spams.


On 21 December, 2014. Yahoo.com’s Alexa ranking is 4. While Yahoo.co.jp’s Alexa ranking is 17. Both of them are very popular around the world. From Wikipedia, “Yahoo during July 2013 surpassed Google on the number of United States visitors to its Web sites for the first time since May 2011, set at 196 million United States visitors, having increased by 21 percent in a year.” 

 
Open redirect is listed in OWASP top 10. The general consensus of it is “avoiding such flaws is extremely important, as they are a favorite target of phishers trying to gain the user’s trust.”