Title: ====== Sony PSN Community - Persistent Web Vulnerability Date: ===== 2013-05-04 References: =========== http://www.vulnerability-lab.com/get_content.php?id=746 VL-ID: ===== 746 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: ============= PlayStation Network, often abbreviated as PSN, is an online multiplayer gaming and digital media delivery service provided/run by Sony Computer Entertainment for use with the PlayStation 3, PlayStation Portable, and PlayStation Vita video game consoles. The PlayStation Network is the video game portion of the Sony Entertainment Network. (Copy of the Homepage: http://en.wikipedia.org/wiki/PlayStation_Network) Abstract: ========= The Vulnerability Laboratory Research Team discovered a persistent web vulnerability in Sony`s official PSN Community Website Application. Report-Timeline: ================ 2012-11-01: Researcher Notification & Coordination 2012-11-02: Vendor Notification 2013-05-05: Public Disclosure Status: ======== Published Affected Products: ================== Sony Product: PSN Community - Lithium Forums 2012 Q4 Exploitation-Technique: ======================= Remote Severity: ========= High Details: ======== Multiple persistent input validation vulnerabilities are located in Sony`s official PSN Community Website Application. The bug allows remote attackers with low account privileges to inject via editor & replace function own malicious persistent script codes. The vulnerabilities are located in the forum editor module with the replace function and the bound vulnerable message titel, subject and link parameters. Remote attackers can compose malicious forum posts to hijack psn admin/moderator/customer accounts. Successful exploitation result in persistent web context manipulation, application side phishing, persistent malware loads, external redirects or persistent session hijacking via forum messages. Vulnerable Section(s): [+] Skype Community (Forums) - Lithium Forum Vulnerable Module(s): [+] Editor (in combination with the replace all function to execute) Vulnerable Parameter(s): [+] Message Subject, Topic Title & Link Widget Proof of Concept: ================= The vulnerability can be exploited by remote attackers with low or medium required user inter action and with low privileged psn application service user account. For demonstration or reproduce ... PoC: "<>>"><[PERSISTENT INECTED SCRIPT CODE!]"Re: Bug Report VL ID 740 " id="lia-subject" name="subject" type="text"> ... or in the body >"><[PERSISTENT INECTED SCRIPT CODE!]" data-mce-href="<>>"><[PERSISTENT INECTED SCRIPT CODE!] >" <>"<<>>"><[PERSISTENT INECTED SCRIPT CODE!]>" href="http://>"<>"<<>>"><[PERSISTENT INECTED SCRIPT CODE!]>.com >"<>"<<>>"><[PERSISTENT INECTED SCRIPT CODE!]>">>"<>"<<>>"><[PERSISTENT INECTED SCRIPT CODE!]"> >"<>" Reference(s): (SIMULATION - TEST) http://community.eu.playstation.com/t5/forums/replypage/board-id/bDE_PSNSupport/message-id/18905 Reference(s): ../compose.htm ../compose2.htm Picture(s): ../1.png ../2.png ../3.png ../4.png Risk: ===== The security risk of the persistent input validation vulnerabilities are estimated as medium(+)||(-)high. Credits: ======== Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com) Disclaimer: =========== The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright © 2013 | Vulnerability Laboratory -- VULNERABILITY RESEARCH LABORATORY LABORATORY RESEARCH TEAM CONTACT: research@vulnerability-lab.com