Document Title: =============== Sparkasse Online Banking - Filter Bypass Vulnerability Date: ===== 2021-10-17 References: =========== https://www.vulnerability-lab.com/get_content.php?id=2264 VL-ID: ===== 2264 Common Vulnerability Scoring System: ==================================== 5.2 Vulnerability Class: ==================== Filter or Protection Mechanism Bypass Introduction: ============= The German Savings Banks Finance Group (Sparkassen-Finanzgruppe) is the most numerous sub-sector with 431 savings banks using the Sparkasse brand, 8 Landesbanken including the DekaBank using separate brands and 10 real-estate financing banks using the LBS brand. The Deutscher Sparkassen- und Giroverband (German Savings Banks and Clearing Association, DSGV) represents the interests of the Sparkassen-Finanzgruppe on a national and international level concerning law and the financial services industry. It also coordinates, promotes and harmonises the interests of Sparkassen. (Copy of the Homepage: https://en.wikipedia.org/wiki/German_public_bank#Sparkassen ) Abstract: ========= The vulnerability laboratory core research team discovered a filter bypass web vulnerability in the Sparkasse Online Banking web-application (cms). Affected Product(s): ==================== Sparkasse Product: Online Banking (Web-Application) [CMS] Report-Timeline: ================ 2020-09-01: Researcher Notification & Coordination (Security Researcher) 2020-09-02: Vendor Notification (Security Department) 2020-09-04: Vendor Response/Feedback (Security Department) 2021-10-01: Vendor Fix/Patch by Check (Service Developer Team) 2021-10-18: Public Disclosure (Vulnerability Laboratory) Status: ======== Published Exploitation-Technique: ======================= Remote Severity: ========= Medium Details: ======== The Sparkasse has installed a new function on its website to update address data. The user is asked whether all data from the registration process is still up-to-date. In the form itself it is possible to edit the location and other variables. But if you enter a non-existing city, the form will alternatively ask without secure parsing if the data should be accepted anyway. Attackers can now store their own payloads with the address data, which can lead directly to an execution in the interfaces. Normally, contents with special characters are blocked directly and do not appear in the database. Here profile information can be manipulated now in such a way that in forms or applications those as interfaces are used, the manipulated contract information of the profile is used. This allows vulnerabilities such as Cross Site Scripting or Server Side Request Forgery to be exploited to persistently manipulate the online banking application or linked services. The validation class of the forms normally does not allow the transfer of the contents, because the function is new here the secure verification by the integration was forgotten for verification. All transferred content that requires content in HTML for e-mails, automated printing/writing or even for delivery in combination with the address can execute any codes. Remark: Normally invalid content or wrong input is encoded or escaped directly by the rudimentary Java class. In this case the input is stored in the database, bypassing all validation mechanisms, and then in third modules individual manipulations with persistent attack vectors are called up. This can be the manipulation of the address data of an email or any content that is output by HTML / Javascript functions. Request Method(s): [+] POST Vulnerable Module(s): [+] Personendaten (Update) Vulnerable Parameter(s): [+] Ort Affected Module(s): [+] Hauptwohnsitz – (User Profil Data) Proof of Concept: ================= The filter bypass vulnerability can be exploited by remote attackers with low user account privileges and wihtout user interaction. For security demonstration or to reproduce the web vulnerability follow the provided information and steps below to continue. --- Session Logs (Demo Sparkasse Kassel) --- Referenz: *-sparkasse.de/de/home/login-online-banking/personendaten-aktualisieren.html - https://www.kasseler-sparkasse.de/if/neo.proxy/pdm/neo/?services=pdm.anschriftpruefen Host: www.kasseler-sparkasse.de User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0 Accept: */* Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate, br Content-Type: application/json; charset=utf-8 Content-Length: 1481 Origin: https://www.kasseler-sparkasse.de Connection: keep-alive Referer: https://www.kasseler-sparkasse.de/de/home/login-online-banking/personendaten-aktualisieren.html?n=true Cookie: JSESSIONID=0000n1KJiK2E8f6NnCYAFQjLIyf:b3cb3f1c5; IF6CONTEXT=SVBTVEFOREFSRDo1MjA1MDM1MzpkZTpJRjpmYWxzZTprYXNzZWxlci1zcGs=; IFCLONE=b3cb3f1c5; IF_SPKDE_CHECK=SPKDE_CHECK {"clientRequestId":"27466cff-63fb-40df-b11e-f2510333c4c0","requests":[{"id":"0","service":"pdm.anschriftpruefen","data":{"F_99973$$" :"Seitzemabacherweg","F_25022$$":"22","F_18080$$":"34251","F_14553$$":"Vellmar">