TeleGraph All Photo (Picture) Pages Have Been Vulnerable to XSS Cyber Attacks

TeleGraph All Photo (Picture) Pages Have Been Vulnerable to XSS Cyber Attacks

Website Description:

http://www.telegraph.co.uk

"The Daily Telegraph is a British daily morning English-language broadsheet newspaper, published in London by Telegraph Media Group and distributed throughout the United Kingdom and internationally. The newspaper was founded by Arthur B. Sleigh in June 1855 as The Daily Telegraph and Courier, and since 2004 has been owned by David and Frederick Barclay. It had a daily circulation of 523,048 in March 2014, down from 552,065 in early 2013. In comparison, The Times had an average daily circulation of 400,060, down to 394,448. The Daily Telegraph has a sister paper, The Sunday Telegraph, that was started in 1961, which had circulation of 418,670 as of March 2014. The two printed papers currently are run separately with different editorial staff, but there is cross-usage of stories. News articles published in either, plus online Telegraph articles, may also be published on the Telegraph Media Group's www.telegraph.co.uk website, all under The Telegraph title." (From Wikipedia)

(1) Vulnerability Description:

Telegraph has a Web security bug problem. It is vulnerable to XSS attacks. In fact, all its photo pages are vulnerable to XSS (Cross-Site Scripting) vulnerabilities. Telegraph's picture pages use "&frame" as its parameter. All its web pages use "&frame" are vulnerable to the bugs. Those vulnerabilities have been patched now.

Examples of Vulnerable Links:

http://www.telegraph.co.uk/culture/culturepicturegalleries/10663967/The-worlds-most-spectacular-theatres.html?frame=2836095

http://www.telegraph.co.uk/property/investmentinproperty/10609314/For-sale-top-20-properties-ripe-for-investment.html?frame=2808162

http://www.telegraph.co.uk/foodanddrink/foodanddrinkpicturegalleries/9737226/Elephant-dung-coffee-Black-Ivory-beans-passed-through-the-animals-guts.html?frame=2424280

http://www.telegraph.co.uk/education/9487434/Graduate-jobs-Best-languages-to-study.html?frame=2314790

http://www.telegraph.co.uk/motoring/picturegalleries/10782171/The-20-best-cars-to-own-in-2014.html?frame=2890278

POC Code:

http://www.telegraph.co.uk/culture/culturepicturegalleries/10663967/The-worlds-most-spectacular-theatres.html?frame=2836095"><img src=x onerror=prompt('justqdjing')>

http://www.telegraph.co.uk/property/investmentinproperty/10609314/For-sale-top-20-properties-ripe-for-investment.html?frame=2808162"><img src=x onerror=prompt('justqdjing')>

http://www.telegraph.co.uk/foodanddrink/foodanddrinkpicturegalleries/9737226/Elephant-dung-coffee-Black-Ivory-beans-passed-through-the-animals-guts.html?frame=2424280"><img src=x onerror=prompt('justqdjing')>

http://www.telegraph.co.uk/education/9487434/Graduate-jobs-Best-languages-to-study.html?frame=2314790"><img src=x onerror=prompt('justqdjing')>

http://www.telegraph.co.uk/motoring/picturegalleries/10782171/The-20-best-cars-to-own-in-2014.html?frame=2890278"><img src=x onerror=prompt('justqdjing')>

The vulnerability can be attacked without user login. Tests were performed on Firefox (37.02) in Ubuntu (14.04) and IE (8.0. 7601) in Windows 7. The bugs found by using CSXDS.

 







(2) XSS Description:

The description of XSS is: "Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it." (OWSAP)

Poc Video:

https://www.youtube.com/watch?v=SqjlabJ1OzA&feature=youtu.be

Blog Details:

http://www.tetraph.com/security/website-test/telegraph-xss/

http://securityrelated.blogspot.com/2015/10/telegraph-xss-0day.html

https://vulnerabilitypost.wordpress.com/2015/10/30/telegraph-bug/

(3) Vulnerability Disclosure:

Those vulnerabilities are patched now.

Discoved and Disclosured By:

Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)

http://www.tetraph.com/wangjing

References:
http://lists.openwall.net/full-disclosure/2015/11/03/7

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/2642

http://russiapost.blogspot.com/2015/11/telegraph-xss.html

https://itinfotechnology.wordpress.com/2015/11/01/telegraph-xss/

https://www.mail-archive.com/fulldisclosure%40seclists.org/msg02682.html

https://cxsecurity.com/issue/WLB-2015110023

http://marc.info/?l=full-disclosure&m=144651821527165&w=4

http://germancast.blogspot.com/2015/11/telegraph-xss.html

http://itsecurity.lofter.com/post/1cfbf9e7_8d3ea9e

http://whitehatview.tumblr.com/post/132723700196/telegraph-xss

https://itswift.wordpress.com/2015/11/02/telegraph-xss/

http://seclists.org/fulldisclosure/2015/Nov/4

CVE-2014-9558 SmartCMS Multiple SQL Injection Security Web Application Zero Day Bug

CVE-2014-9558 SmartCMS Multiple SQL Injection Security Web Application Zero Day Bug

Exploit Title: Smartwebsites SmartCMS v.2 Multiple SQL Injection Security Vulnerabilities
Product: SmartCMS v.2
Vendor: Smartwebsites
Vulnerable Versions: v.2
Tested Version: v.2
Advisory Publication: Jan 22, 2015
Latest Update: Jan 22, 2015
Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) (CWE-89)
CVE Reference: CVE-2014-9558
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)
Impact Subscore: 6.4
Exploitability Subscore: 10.0
CVSS Version 2 Metrics:
Access Vector: Network exploitable
Access Complexity: Low
Authentication: Not required to exploit
Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service
Writer and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Advisory Details:

(1) Vendor & Product Description

Vendor: 
Smartwebsites

Product & Version: 
SmartCMS 
v.2

Vendor URL & Download:

http://www.smartwebsites.com.cy/index.php?pageid=13&lang=en

Product Description:

“SmartCMS is one of the most user friendly and smart content management systems there is in the Cyprus market. It makes the content management of a webpage very easy and simple, regardless of the user's technical skills. When we designed the SmartCMS - Online Content Management System, we had you, the user, in mind. We have put ourselves in your shoes and wandered what would be like to have a simple, yet powerful system that would make the update of a website something fun to do. And here we are now! 6 years passed since the first release of SmartCMS. Now it is a popular and successful system which helps many companies become more competitive and successful online. The SmartCMS systems comes with a batch of useful tools and modules which make your online content management experience enjoyable, while increasing your productivity instantly.

SmartCMS offers you the following:

One complete solution for the content management of your website.

Professional design.

Minimal running cost.

Maximum security and scalability.

Unlimited number of pages, images and files.

Complete control over your website, without the need for specialized technical skills and without any dependencies on third party.

Support for multiple languages.

Quality and reliable professional customer support.

Improved customer service.”

(2) Vulnerability Details:

SmartCMS web application has a computer cyber security bug problem. Hacker can exploit it by SQL Injection attacks. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. SmartCMS has patched some of them. CXSECurity is a huge collection of information on data communications safety. Its main objective is to inform about errors in various applications. It also publishes suggestions, advisories, solutions details related to SQL Injection vulnerabilities and cyber intelligence recommendations.

(2.1) The first code flaw occurs at “index.php?” page with “pageid” “lang” multiple parameters.

(2.2) The second code flaw occurs at “sitemap.php?” page with “pageid” “lang” multiple parameters.

References:

http://www.tetraph.com/security/cves/cve-2014-9558

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1501

http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-201501-607

http://packetstormsecurity.com/files/130075/SmartCMS-2-SQL-Injection.html

http://webtechhut.blogspot.com/2015/02/cve-2014-9558-smartcms-multiple-sql.html

https://biyiniao.wordpress.com/2015/02/11/cve-2014-9558

http://frenchairing.blogspot.fr/2015/10/smartcms-sql-injection.html
https://progressive-comp.com/?l=full-disclosure&m=142196683916392&w=1

http://lifegrey.tumblr.com/post/110700573094/ithut-cve-2014-9558-smartcms-multiple-sql

http://milw00rm.com/exploits/6672

http://guyuzui.lofter.com/post/1ccdcda4_5c409ca

http://www.inzeed.com/kaleidoscope/cves/cve-2014-9558
http://russiapost.blogspot.ru/2015/09/smartcms-sql-injection.html
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01601.html

http://whitehatpost.blog.163.com/blog/static/242232054201511112757529/

CVE-2014-8754 WordPress "Ad-Manager Plugin" Unvalidated Redirects and Forwards Web Security Vulnerability

CVE-2014-8754 WordPress "Ad-Manager Plugin" Unvalidated Redirects and Forwards Web Security Vulnerability



Exploit Title: WordPress Ad-Manager Plugin Unvalidated Redirects and Forwards Vulnerability
Product: WordPress Ad-Manager Plugin
Vendor: CodeCanyon
Vulnerable Versions: 1.1.2
Tested Version: 1.1.2
Advisory Publication: November 25, 2014
Latest Update: December 15, 2014
Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]
CVE Reference: CVE-2014-8754
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification

Writer and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Caution Details:


(1) Vendor & Product Description:


Vendor:
CodeCanyon



Product & Vulnerable Versions:
WordPress Ad-Manager Plugin
1.1.2



Vendor URL & Download:
Product can be obtained from here,
http://codecanyon.net/item/wordpress-admanager/544421





Product Introduction Overview:
"Wordpress Ad-Manager offers you a simple solution to implement advertising into your posts, your blog or any other Wordpress page. You can use pictures and images or HTML snippets like Google AdSense to incorporate advertising in an easy way. You are able to select ads via Ad Zones, to re-size them or to limit the height or the width. Wordpress Ad-Manager also offers statistics for the site admin. However, Wordpress Ad-Manager’s best feature is its simplicity. It’s easy to set up and also comes with a widget. What more could one want?"



(2) Vulnerability Details:
Ad-Manager Plugin web application has a computer cyber security problem. Hacker can exploit it by Unvalidated Redirects and Forwards (URL Redirection) attacks. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Such attacks  are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. Ad-Manager Plugin has patched some of them. The Full Disclosure mailing list is a public forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. FD differs from other security lists in its open nature and support for researchers' right to decide how to disclose their own discovered bugs. The full disclosure movement has been credited with forcing vendors to better secure their products and to publicly acknowledge and fix flaws rather than hide them. Vendor legal intimidation and censorship attempts are not tolerated here! It also publishs suggestions, advisories, solutions details related to Open Redirect vulnerabilities and cyber intelligence recommendations.


(2.1) The Dest Redirect Privilege Escalation code flaw occurs at "track-click.php" page with "&out" parameter.










References:
http://tetraph.com/security/cves/cve-2014-8754
http://computerobsess.blogspot.com/2014/12/cve-2014-8754-wordpress-ad-manager.html
http://www.cnnvd.org.cn/vulnerability/show/cv_id/2014110533
http://seclists.org/fulldisclosure/2014/Nov/93
http://www.osvdb.org/creditees/12822-wang-jing
https://progressive-comp.com/?l=full-disclosure&m=141705602927943&w=1
https://packetstormsecurity.com/files/129290/WordPress-Ad-Manager
http://cxsecurity.com/issue/WLB-2014120003
http://www.cnvd.org.cn/flaw/show/CNVD-2014-08598
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01370.html
http://russiapost.blogspot.com/2014/12/wordpress-ad-manager-open-redirect.html
http://marc.info/?l=full-disclosure&m=141705602927943&w=4

CVE-2014-7292 Newtelligence dasBlog Dest Redirect Privilege Escalation Web Application Zero Day Bug

 

Exploit Title: Newtelligence dasBlog Dest Redirect Privilege Escalation Vulnerability

Product: dasBlog

Vendor:  Newtelligence

Vulnerable Versions: 2.3 (2.3.9074.18820) 2.2 (2.2.8279.16125) 2.1(2.1.8102.813)

Tested Version: 2.3 (2.3.9074.18820)

Advisory Publication: OCT 15, 2014

Latest Update:   OCT 15, 2014

Vulnerability Type: URL Redirection to Untrusted Site ('Open Redirect') [CWE-601]

CVE Reference: *

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend)

Impact Subscore: 4.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification

Writer and Reporter: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Proposition Details:

(1) Vendor & Product Description:

Vendor:

Newtelligence

Product & Vulnerable Versions:

dasBlog

2.3 (2.3.9074.18820) 2.2 (2.2.8279.16125) 2.1(2.1.8102.813)

Vendor URL & download:

dasBlog can be obtained from here,

http://dasblog.codeplex.com/documentation

What is dasBlog?
"dasBlog Community Edition is an ASP.NET weblogging application. It runs on ASP.NET 1.1 and is developed in C#. dasBlog, an evolution of the BlogX weblog engine, adds lots of additional features like Trackback, Pingback, Mail notifications, full Blogger/M."

"This dasBlog 2.3.1 release comes almost 3 years since the release of dasBlog 2.3, we know this is an internet lifetime, and in many cases our user base may have moved on to other applications, (and/or are just checking back in to see what we have to offer, or you stuck with us and you may be outgrowing your current dasBlog installation! That said, if this is your first experience with dasBlog or you’re looking for improvements in your current dasBlog, you will find that dasBlog 2.3.1 is an incremental improvement, now supporting .NET 4 and resolving some minor support operations issues, and is even more robust and stable than it ever has been. What you will not find is a host of new features or much expansion of the existing features."









(2) Advisory Details:
Newtelligence dasBlog ct.ashx is vulnerable to Open Redirect attacks. Hacker can exploit it by Unvalidated Redirects and Forwards (Open Redirect or URL Redirection) attacks. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

dasBlog supports a feature called Click-Through which basically tracks all links clicked inside your blog posts. It's a nice feature that allows the blogger to stay informed what kind of content readers like. If Click-Through is turned on, all URLs inside blog entries will be replaced with <URL to your blog>/ct.ashx?id=<Blog entry ID>&url=<URL-encoded original URL> which of course breaks WebSnapr previews.
 

 Web.config code:
<add verb="*" path="ct.ashx" type="newtelligence.DasBlog.Web.Services.ClickThroughHandler, newtelligence.DasBlog.Web.Services"/>

 

(2.1) The vulnerability occurs at "ct.ashx?" page, with "&url" parameter,.









(3) Solutions:
2014-10-15 Public disclosure with self-written patch.






References:
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01235.html

http://marc.info/?l=full-disclosure&m=141378771804426&w=4
http://computerobsess.blogspot.com/2014/12/cve-2014-7292-newtelligence-dasblog.html
http://www.securityfocus.com/bid/70654

http://cxsecurity.com/cveshow/CVE-2014-7292/

http://securitynewswire.com/securitynews2012/article.php?title=CVE20147292_

http://www.venustech.com.cn/NewsInfo/124/30608.Html
http://japanbroad.blogspot.com/2014/11/dasblog-open-redirect-zero-day.html

http://www.scip.ch/en/?vuldb.13185
https://progressive-comp.com/?l=full-disclosure&m=141378771804426&w=1

http://www.tetraph.com/blog/cves/cve-2014-7292

https://packetstormsecurity.com/files/128749/Newtelligence-dasBlog-2.3-Open-Redirect.htmlml

CVE-2014-7290 Atlas Systems Aeon Web Application Service XSS (Cross-Site Scripting) Vulnerability

Exploit Title: Atlas Systems Aeon XSS Vulnerability
Product: Aeon

Vendor: Atlas Systems

Vulnerable Versions: 3.6 3.5

Tested Version: 3.6

Advisory Publication: Nov 12, 2014

Latest Update: February 14, 2015

CVE Reference: CVE-2014-7290

Vulnerability Type: Cross-Site Scripting [CWE-79]
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Solution Status: Fixed by Vendor
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Caution Details:


(1) Vendor & Product Description:


Vendor:
Atlas



Product & Vulnerable Versions:
Aeon
3.6 3.5



Vendor URL & Download:
Product can be obtained from here,
http://www.atlas-sys.com/aeon/

What is Aeon?
"Aeon is special collections circulation and workflow automation software for your special collections library designed by special collections librarians.

Aeon improves customer service and staff efficiency while providing unparalleled item tracking, security and statistics.

Aeon is request and workflow management software specifically designed for special collections libraries and archives. Aeon improves patron service and maximizes staff efficiency while providing unparalleled item tracking, security and statistics.The Aeon Web Interface enables your patrons to request items directly from your online catalog and finding aids for viewing in your reading room or ordering duplication and digital imaging services, and allows them to monitor fulfillment of their requests through a personalized web account. The Aeon Staff Client permits your staff to manage every step of every transaction, from shelf to patron and back again, with full control and ease. The Aeon Web Reports and custom search features provide quick access to complete patron and item request histories and offer a wide array of usage analyses"

About Atlas:
"Atlas Systems, Inc. is a software development company headquartered in Virginia Beach, VA dedicated to serving libraries. Founded in July 1995 with the mission of “promoting library excellence through efficiency,” Atlas is best known for creating  the ILLiad interlibrary loan management system now exclusively distributed by OCLC and used by more than 1,000 libraries worldwide. Focused on bringing the benefits of automation to library processes that have not been addressed by other software services, Atlas has introduced Ares, an electronic reserves solution, and Aeon, an online request and workflow management system specifically designed for special collections libraries and archives. Atlas takes a process-driven approach to software development. Atlas developers work closely with librarians first to understand the specific user services environment and then to design a system that improves service quality while achieving optimum efficiency and process control. Once the software has been created, Atlas provides implementation, training and ongoing product support, including continual development of new features and enhancements in response to client needs and desires. This workflow review and improvement approach to software design sets Atlas apart in the library automation market."


From:
https://www.atlas-sys.com/products/aeon/downloads/10_112_aeon_broch_web.pdf







(2) Vulnerability Details:
Aeon web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug researchers before. Aeon has patched some of them. "scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training".

(2.1) The first code flaw occurs at “aeon.dll?” page, with “&Action” parameter.

(2.2) The second code flaw occurs at “aeon.dll?” page, with “&Form” parameter.

(3) Solutions:

2014-09-01: Report vulnerability to Vendor

2014-10-05: Vendor replied with thanks and vendor will change the source code

References:

http://tetraph.com/security/xss-vulnerability/cve-2014-7290
https://progressive-comp.com/?l=full-disclosure&m=141599346408756&w=1

http://germancast.blogspot.com/2015/01/aeon-xss-zero-day-bug.html

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7290

http://www.securityfocus.com/bid/71185

http://computerobsess.blogspot.com/2014/11/cve-2014-7290-atlas-systems-aeon-xss.html
http://www.scap.org.cn/CVE-2014-7290.html
https://cxsecurity.com/issue/WLB-2014110105

https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01309.html
http://marc.info/?l=full-disclosure&m=141599346408756&w=4
https://packetstormsecurity.com/files/129114/Atlas-Systems-Aeon

https://vulnerabilitypost.wordpress.com/2014/12/04/cve-2014-7290