Document Title:
===============
Ebay Inc Xcom #6 - Persistent POST Inject Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1227
Release Date:
=============
2015-03-24
Vulnerability Laboratory ID (VL-ID):
====================================
1227
Common Vulnerability Scoring System:
====================================
3.9
Product & Service Introduction:
===============================
eBay Inc. is an American multinational internet consumer-to-consumer corporation, headquartered in San Jose, California. It was founded by Pierre Omidyar in 1995,
and became a notable success story of the dot-com bubble; it is now a multi-billion dollar business with operations localized in over thirty countries. The company
manages eBay.com, an online auction and shopping website in which people and businesses buy and sell a broad variety of goods and services worldwide. In addition to
its auction-style sellings, the website has since expanded to include `Buy It Now` standard shopping; shopping by UPC, ISBN, or other kind of SKU (via Half.com);
online classified advertisements online event ticket trading online money transfers and other services.
(Copy of the Homepage: http://en.wikipedia.org/wiki/EBay )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered mutliple persistent input validation web vulnerabilities in the official Ebay Magento Web-Application (CMS & API).
Vulnerability Disclosure Timeline:
==================================
2014-03-16: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH)
2014-03-17: Vendor Notification (eBay Inc - Security Research Team)
2014-04-16: Vendor Response/Feedback (eBay Inc - Security Research Team)
2015-03-19: Vendor Fix/Patch (eBay Inc - Xcom Developer Team)
2015-03-24: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Ebay Inc.
Product: Ebay Inc - Official WebSite Application & API
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
Two persistent input validation web vulnerabilities has been discovered in the official Ebay Magento Web-Application (CMS & API).
A persistent vulnerability allows remote attackers to inject malicious script codes on the application-side of the affected web-application.
The vulnerability is located in the real `name change` (`Namensänderung`) formular. The input validation of the vulnerable `first- & lastname` does
not encode scipt codes. Remote attackers are able to jungle over the main website to the real name change module. In the real name change module the
change the registration name with an payload. The scipt code executes in both scenarios but only in case without doublequotes it will be changed
(written) in the database. The execution occurs directly in the formular and in the top user name context location. The attack vector is persistent
and the request method to inject is POST. After the save of the payload it is possible to attack platform users with the manipulated profile values.
The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.9.
Exploitation of the persistent web vulnerability requires a low privileged web-application user account and low user interaction. Successful exploitation
results in session hijacking, persistent phishings attacks, persistent external redirect and malware loads or persistent manipulation of affected or
connected module context.
Vulnerable Module(s):
[+] Startseite > Namensänderung > [Namensänderung]
Vulnerable Parameter(s):
[+] firstname
[+] lastname
Affected Domain(s):
[+] ebay.com
[+] namechange.ebay.*
Proof of Concept (PoC):
=======================
The persistent input validation web vulnerability can be exploited by remote attackers with low privileged application user account and low or medium user interaction.
For security demonstration or to reproduce the vulnerability follow the provided steps and information below to continue.
PoC: firstname