Document Title: =============== Magento Products T1 - Bypass & Persistent Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1919 Release Date: ============= 2018-06-19 Vulnerability Laboratory ID (VL-ID): ==================================== 1919 Common Vulnerability Scoring System: ==================================== 4.2 Vulnerability Class: ==================== Cross Site Scripting - Persistent Current Estimated Price: ======================== 500€ - 1.000€ Product & Service Introduction: =============================== Magento is an open source e-commerce web application that was launched on March 31, 2008 under the name Bento. It was developed by Varien (now Magento, a division of eBay) with help from the programmers within the open source community but is now owned solely by eBay Inc. Magento was built using parts of the Zend Framework. It uses the entity-attribute-value (EAV) database model to store data. In November 2013, W3Techs estimated that Magento was used by 0.9% of all websites. Our team of security professionals works hard to keep Magento customer information secure. What`s equally important to protecting this data? Our security researchers and user community. If you find a site that isn`t following our policies, or a vulnerability inside our system, please tell us right away. ( Copy of the Vendor Homepage: http://magento.com/security & http://magento.com/security ) Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered an application-side validation and filter bypass vulnerability in the magento products tier 1 application. Vulnerability Disclosure Timeline: ================================== 2018-06-20: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Magento Product: Magento - Web Application Service 2016 Q3 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Authentication Type: ==================== Open Authentication (Anonymous Privileges) User Interaction: ================= Low User Interaction Disclosure Type: ================ Responsible Disclosure Technical Details & Description: ================================ The filter bypass issue and persistent mail encode vulnerability has been discovered in the official magento demo service in tier1 (sender: productdemo@magento.com). The vulnerability allows remote attackers to bypass the validation procedure of the main magento tier 1 application and to execute malicious persistent scripts in affected modules or functions. The magento online service web application located on tier 1 does allow to inject script code as values to the database. After performing thus an internal employee takes the information to encode a link for a permanent registration via magento customer html database. The imported/exported database does contain wrong parsed context and is get send to the inbox of the followup request through the registration form of the magento website. Normally the validation prevents payloads inserted or as generated form to deny malicious interaction. In case of the new website module in tier one the employee that acts via web-application perform to encode the context. After that the attacker has a valid registration link via email2 server (http://email2.magento.com/) with id malicious id CGP00H0dX0FG0qs32402D01. Thus id can be used to perform malicious request with all email servers that are in use by magento and connected to the technologie. Thus impact tier 1 and tier 2 web-application of magento. The arrived email comes of the main productdemo@magento.com email in tier one and the validation runs as well through the basic tier 1 infrastructure of magento. The leadCapture/save bug in marketo has already been reported with bounty by our core team. The issue is mainly refering to the filter bypass that results in the followup exploitation. The cases should be resolved and recognized separatly. The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.8. Exploitation of the application-side validation web vulnerability requires no privileged web-application user account and only low user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent redirect to external sources and persistent manipulation of affected or connected service module context. Request Method(s): [+] [POST] Vulnerable Domain(s): [+] Magento (.com) - Tier 1 Vulnerable Module(s): [+] Magento Product Demo Registration Forms [+] Magento Email Registration Link Vulnerable Parameter(s): [+] firstname [+] lastname Affected Module(s): [+] Magento Tier 1 - join us for a Magento 2.1 demo next week [+] Magento Tier 2 - All contact form masks with the same conditions to generate the reg id link Proof of Concept (PoC): ======================= The vulnerability can be exploited by remote attackers without privileged web-application user account and with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Register for the main service with a script code payload in the firstname and lastname values 2. Wait for the generate of the link by the moderating employee "Brian Benic" Note: On generate the saved values get connected without secure validation to the id request 3. Open your target inbox of the registration and the first execute occurs in the mail body next to the introduction words 4. Click the generated link in the email (exp. http://email2.magento.com/CGP00H0dX0FG0qs32402D01) 5. Now the payload is loaded of the database without secure parse and allow to insert a second time to the next formular request 6. Check the target inbox after the second registration and see that the same issue occurs again via filter bypass to another formular as well Note: Attackers can now use the id of the email2 subdomain to request in other contact formulars connected to magento the same malicious request 6. Successful reproduce of the remote vulnerability in two different stages of the magento tier 1 application! PoC: Payload Example ">