Hello list!
I want to warn you about Brute Force and Cross-Site Scripting
vulnerabilities in system IFOBS.
IFOBS - it's Internet-banking system, which is widespread and particularly
it's used by large number of Ukrainian banks.
These are the first 38 vulnerabilities in IFOBS: 2 BF and 36 XSS.
-------------------------
Affected products:
-------------------------
Vulnerable are all versions of IFOBS. The developers have ignored and not
fixed these vulnerabilities (all holes from three advisories).
----------
Details:
----------
Brute Force (WASC-11):
In login form http://site/ifobsClient/loginlite.jsp there is no protection
against picking up password (captcha).
In login form http://site/ifobsClient/loginsecurity.jsp there is no
protection against picking up password (captcha).
Cross-Site Scripting (WASC-08):
POST request at page http://site/ifobsClient/regclientprint.jsp in
parameters: secondName, firstName, thirdName, BirthDay, BirthMonth,
BirthYear, address, livePlace, nationality, passportSerial, passportNumber,
passportIssueAgency, PassportDay, PassportMonth, PassportYear,
tempDocSerial, tempDocNumber, DocDay, DocMonth, DocYear, idCodeNumber,
idCodeRegPlace, CodeRegDay, CodeRegMonth, CodeRegYear, phone, email,
pmcountry, pmnumber, keyword, bankOblastSelect, bankCitySelect,
bankRegionSelect, bankDepSelect, bankAddress, bankContacts.
Exploits for the first five vulnerabilities (in parameters secondName,
firstName, thirdName, BirthDay, BirthMonth):
IFOBS XSS-1.html
IFOBS XSS exploit (C) 2012 MustLive.
http://websecurity.com.ua
IFOBS XSS-2.html
IFOBS XSS exploit (C) 2012 MustLive.
http://websecurity.com.ua
IFOBS XSS-3.html
IFOBS XSS exploit (C) 2012 MustLive.
http://websecurity.com.ua
IFOBS XSS-4.html
IFOBS XSS exploit (C) 2012 MustLive.
http://websecurity.com.ua
IFOBS XSS-5.html
IFOBS XSS exploit (C) 2012 MustLive.
http://websecurity.com.ua
------------
Timeline:
------------
2012.05.04 - found vulnerabilities during pentest. After I've informed my
client, he could inform the developers.
2012.05.29 - announced at my site.
2012.06.01 - informed the developers about vulnerabilities (the first
advisory).
2012.06.01 - informed the developers about vulnerabilities (the second
advisory).
2012.06.02 - informed the developers about vulnerabilities (the third
advisory).
2012.09.14 - disclosed at my site (http://websecurity.com.ua/5852/).
Best wishes & regards,
Eugene Dokukin aka MustLive
Administrator of Websecurity web site
http://websecurity.com.ua