Document Title: =============== Adobe CreativeCloud - (Events ) Persistent Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1840 Release Date: ============= 2018-06-17 Vulnerability Laboratory ID (VL-ID): ==================================== 1840 Common Vulnerability Scoring System: ==================================== 3.5 Vulnerability Class: ==================== Cross Site Scripting - Persistent Current Estimated Price: ======================== 500€ - 1.000€ Product & Service Introduction: =============================== Whether it is a smartphone or tablet app, a game, a video, a digital magazine, a website, or an online experience, chances are that it was touched by Adobe technology. Our tools and services enable our customers to create groundbreaking digital content, deploy it across media and devices, and then continually measure and optimize it based on user data. By providing complete solutions that combine digital media creation with data-driven marketing, we help businesses improve their communications, strengthen their brands, and ultimately achieve greater business success. (Copy of the Vendor Homepage: http://www.adobe.com/aboutadobe/) Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered an application-side vulnerability in the official Adobe CreativeCloud Events online service web-application. Vulnerability Disclosure Timeline: ================================== 2018-06-18: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Adobe Systems Product: CreativeCloud - Online Service (Web-Application) 2016 Q2 Exploitation Technique: ======================= Remote Severity Level: =============== Low Authentication Type: ==================== Open Authentication (Anonymous Privileges) User Interaction: ================= Low User Interaction Disclosure Type: ================ Independent Security Research Technical Details & Description: ================================ An application-side input validation and encoding vulnerability has been discovered in the official Adobe Connect Events Webinar online service web-application. The vulnerability and encoding issue allows remote attackers to inject own malicious script codes to the application-side of the vulnerable modules context. The vulnerability is located in the `first_name` and `last_name` parameters of the `register` module submit POST method request. Remote attackers are able to inject own malicious script codes in the vulnerable parameters POST method request to manipulate the adobe creativecloud events service emails module. The email body does not encode the input values and the registration is not restricted on inputs as well, which results in the application-side script code execution. The injection point is the registration input form of the events in adobe creativecloud and the execution point occurs in the email body context of the registration confirmation. The security risk of the persistent input validation web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.5. Exploitation of the persistent input validation web vulnerability requires no low privileged web-application user account and only low user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent redirect to external sources and persistent manipulation of affected or connected service module context. Request Method(s): Inject [+] POST Vulnerable Module(s): [+] Events - Registration Form Vulnerable File(s): [+] ./register Vulnerable Parameter(s): [+] attendee first_name [+] attendee last_name Affected Module(s): [+] Email (Registration Confirmation) Proof of Concept (PoC): ======================= The application-side issue and mail encoding vulnerability can be exploited by remote attackers without privileged web-application user account and with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. PoC: Payloads ">