Web Technology Hut

Saturday, 9 May 2015

ESPN Are Suffering Serious XSS and Dest Redirect Privilege Escalation Security Vulnerabilities

ESPN Are Suffering Serious XSS and Dest Redirect Privilege Escalation Security Vulnerabilities

Popular ESPN website (espn.go.com) has been found to be vulnerable to multiple serious XSS and Dest Redirect Privilege Escalation security vulnerabilities according to Jing Wang, a mathematics student from the School of Physical and Mathematical Sciences at Nanyang Technological University in Singapore.

Wang found a large number of ESPN’s credible links were vulnerable to XSS and Dest Redirect Privilege Escalation attacks. These vulnerabilities occur at ESPN’s “login” & “register” pages.

ESPN is one of the most common U.S.-based cable and satellite TV channel with close to 100 million subscribers. Its Alexa global rank is 63 and US rank is 14. Based on eBizMBA, “As of December 1, 2014, ESPN has an estimated 80,000,000 unique monthly visitors.” At the same time, ESPN broadcasts in more than 200 countries.

Wang posted his findings on the Full Disclosure forum. He wrote that he had reported the issues to ESPN in early May 2014 but the vulnerabilities are still unpatched. According to Wang, “Those vulnerabilities are very dangerous. Since they happen at ESPN’s “login” & “register” pages that are credible. Attackers can abuse those links to mislead ESPN’s users. The success rate of attacks may be high.“

Proof of concept videos have also been released on YouTube to illustrate an attack.

(1)XSS DEMO
https://www.youtube.com/watch?v=gGEZO8wbTBU

(2)Dest Redirect Privilege Escalation DEMO
https://www.youtube.com/watch?v=lCvBt8Elj9w

According to OWASP, “XSS allows attackers to execute scripts in the victims browser which can hijack user sessions, deface websites or redirect the user to malicious sites.” While Dest Redirect Privilege Escalation “is used in phishing attacks to get users to visit malicious sites without realizing it.”
If ESPN’s users were exploited, attackers can get their identity. Those attacks can also be used to steal password, perform denial of service attacks, spy users’ habits, alter browser functionality, access sensitive information and so on.

Wang wrote his tests were using Firefox (33.0) in Ubuntu (14.04) and IE (8.0. 7601) in Windows 8. And the attack could work without a user being logged in.

Yahoo and Yahoo Japan May be Vulnerable to Spams

Yahoo and Yahoo Japan May be Vulnerable to Spams

Student security researcher Wang Jing from School of Physical and Mathematical Science at Nanyang Technological University, Singapore, has found new security vulnerabilities related to Yahoo.

After reporting several Open Redirect vulnerabilities to Yahoo. Yahoo's responses were "It is working as designed". It seems that Yahoo do not take the vulnerabilities seriously at all.

Based on Wang's report on Full Disclosure "Multiple Open Redirect vulnerabilities were reported Yahoo. All Yahoo's responses were "this intended behavior". However, these vulnerabilities were patched later."

The vulnerability of Yahoo occurs at "ard.yahoo.com" page. While the vulnerability of Yahoo Japan happens at sensitive page "http://order.store.yahoo.co.jp".

Proof of concept on YouTube were also released to illustrate exploits.

(1)Yahoo Open Redirect

https://www.youtube.com/watch?v=k4eFLsTyZkg

(2)Yahoo Japan Open Redirect

https://www.youtube.com/watch?v=2SM78WKAVr8

In fact, Yahoo's users were attacked based on redirection this year. Base on CNET on January 4, 2014, "Yahoo.com visitors over the last few days may have been served with malware via the Yahoo ad network, according to Fox IT, a security firm in the Netherlands. Users visiting pages with the malicious ads were redirected to sites armed with code that exploits vulnerabilities in Java and installs a variety of different malware. "

Wang wrote that the attack could work without a user being logged in. And his tests were using Firefox (33.0) in Ubuntu (14.04) and IE (10.0.9200.16521) in Windows 8.

Redirect can ensure a good user experience. However, if it is not properly provided. Attackers can use this to trick users. This is common in Phishing attacks and Spams.

On 21 December, 2014. Yahoo.com's Alexa ranking is 4. While Yahoo.co.jp's Alexa ranking is 17. Both of them are very popular around the world. From Wikipedia, "Yahoo during July 2013 surpassed Google on the number of United States visitors to its Web sites for the first time since May 2011, set at 196 million United States visitors, having increased by 21 percent in a year."

Open redirect is listed in OWASP top 10. The general consensus of it is "avoiding such flaws is extremely important, as they are a favorite target of phishers trying to gain the user's trust."

Wednesday, 6 May 2015

Maxwell’s Formulation – Differential Forms on Euclidean Space

Maxwell’s Formulation – Differential Forms on Euclidean Space
Author: Jing Wang
Institute: School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore

One of the greatest advances in theoretical physics of the nineteenth century was Maxwell’s formulation of the the equations of electromagnetism. This article uses differential forms to solve a problem related to Maxwell’s formulation. The notion of differential form encompasses such ideas as elements of surface area and volume elements, the work exerted by a force, the flow of a fluid, and the curvature of a surface, space or hyperspace. An important operation on differential forms is exterior differentiation, which generalizes the operators div, grad, curl of vector calculus. the study of differential forms, which was initiated by E.Cartan in the years around 1900, is often termed the exterior differential calculus.However, Maxwell’s equations have many very important implications in the life of a modern person, so much so that people use devices that function off the principles in Maxwell’s equations every day without even knowing it.

Source:
http://itinfotech.tumblr.com/post/118278078526/maxwells-formulation-differential-forms-on

Delaunay Triangulation - From 2-D Delaunay to 3-D Delaunay

Delaunay Triangulation - From 2-D Delaunay to 3-D Delaunay
Author: Jing Wang
Institute: School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore

Delaunay triangulation are widely used in scientific computing in many diverse applications. While there are numerous algorithms for computing triangulations, it is the favorable geometric properties of the Delaunay triangulation that make it so useful.

The fundamental property is the Delaunay criterion. In the case of 2-D triangulations, this is often called the empty circumcircle criterion. For a set of points in 2-D, a Delaunay triangulation of these points ensures the circumcircle associated with each triangle contains no other point in its interior. This property is important. In the illustration below, the circumcircle associated with T1 is empty. It does not contain a point in its interior. The circumcircle associated with T2 is empty. It does not contain a point in its interior. This triangulation is a Delaunay triangulation. This presentation discusses how to extend 2-D Delaunay to 3-D Delaynay.

Source:
http://mathswift.blogspot.com/2015/05/delaunay-triangulation-from-2-d.html

Wednesday, 11 February 2015

CVE-2014-9560 Softbb.net SoftBB SQL Injection Security Vulnerabilities

Exploit Title: Softbb.net SoftBB /redir_last_post_list.php post Parameter SQL Injection

Product: SoftBB (mods)

Vendor: Softbb.net

Vulnerable Versions: v0.1.3

Tested Version: v0.1.3

Advisory Publication: Jan 10, 2015

Latest Update: Jan 10, 2015

Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

CVE Reference: CVE-2014-9560

CVSS Severity (version 2.0):

CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 10.0

Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore]

http://www.inzeed.com/kaleidoscope/sql-injection-vulnerability/cve-2014-9560-softbb-net-softbb-sql-injection-security-vulnerability/

CVE-2014-9561 Softbb.net SoftBB XSS (Cross-Site Scripting) Security Vulnerability

Exploit Title: Softbb.net SoftBB /redir_last_post_list.php post Parameter XSS

Product: SoftBB (mods)

Vendor: Softbb.net

Vulnerable Versions: v0.1.3

Tested Version: v0.1.3

Advisory Publication: Jan 10, 2015

Latest Update: Jan 10, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-9561

CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore]

http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/xss-vulnerability/cve-2014-9561-softbb-net-softbb-xss-cross-site-scripting-security-vulnerability/

CVE-2014-7294 NYU OpenSSO Integration 2.1 Dest Privilege Escalation Web Security Vulnerability

CVE-2014-7294 NYU OpenSSO Integration 2.1 Dest Privilege Escalation Web Security Vulnerability

Exploit Title: NYU OpenSSO Integration Logon Page url Parameter Open Redirect

Product: OpenSSO Integration

Vendor: NYU

Vulnerable Versions: 2.1 and probability prior

Tested Version: 2.1

Advisory Publication: December 14, 2014

Latest Update: January 05, 2015

Vulnerability Type: Open Redirect [CWE-601]

CVE Reference: CVE-2014-7294

mpact CVSS Severity (version 2.0):

CVSS v2 Base Score: 6.4 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:P/A:N) (legend)

Impact Subscore: 4.9

Exploitability Subscore: 10.0

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification

Discover and Writer: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Suggestion Details:

(1) Vendor & Product Description:

Vendor:

NYU

Product & Vulnerable Versions:

OpenSSO Integration

2.1

Vendor URL & Download:

OpenSSO Integration can be obtrained from here,

http://www.exlibrisgroup.org/display/CrossProductCC/PDS+OpenSSO+Integration

Product Description:

"NYU has integrated PDS with Sun's OpenSSO Identity Management application. The PDS/OpenSSO integration uses PDS as the NYU Libraries' single sign-on system and leverages NYU's OpenSSO system to provide seamless interaction between library applications and university services. The integration merges patron information from OpenSSO (e.g. name, email, e-resources access) with patron information from Aleph (e.g. borrower status and type) to ensure access to the multitude of library services."

"The NYU Libraries operate in a consortial environment in which not all users are in OpenSSO and not all OpenSSO users are in Aleph. PDS is hosted in an active/passive capacity on our Primo front-end servers. Due to the nature of PDS and Aleph, patrons are required to have an Aleph account in order to login to the library's SSO environment. The exception to this rule is EZProxy."

"Author: Scot Dalton

Additional author(s):

Institution: New York University

Year: 2009

License: BSD style

Short description: Use, modification and distribution of the code are permitted provided the copyright notice, list of conditions and disclaimer appear in all related material.

Link to terms: [Detailed license terms]"

(2) Vulnerability Details:

NYU Opensso Integration web application has a computer security bug problem. It can be exploited by Unvalidated Redirects and Forwards (URL Redirection) attacks. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

Other similar products 0day vulnerabilities have been found by some other bug hunter researchers before. NYU has patched some of them. Web Security Watch is an aggregator of security reports coming from various sources. It aims to provide a single point of tracking for all publicly disclosed security issues that matter. "Its unique tagging system enables you to see a relevant set of tags associated with each security alert for a quick overview of the affected products. What's more, you can now subscribe to an RSS feed containing the specific tags that you are interested in - you will then only receive alerts related to those tags." It has published suggestions, advisories, solutions details related to website vulnerabilities.

(2.1) The vulnerability occurs at "PDS" service's logon page, with "&url" parameter.