Document Title: =============== SevenIT SevDesk 3.10 - Multiple Web Vulnerabilities References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1314 Release Date: ============= 2015-03-23 Vulnerability Laboratory ID (VL-ID): ==================================== 1314 Common Vulnerability Scoring System: ==================================== 5.9 Product & Service Introduction: =============================== The integrated customer management, digital customer file is the central record for a single customer. invoices, facilities and operations to a customer are stored centrally automated in one place. So the customer file is always up to date. For faster retrieval or reporting contacts can be tagged. In addition, with powerful. Search options you have as the entire customer base better than ever in view. Daily backup 256bit SSL encryption TÜV certified datacenter Free version No hidden costs No minimum contract term iPhone App Runs in any browser No installation required on the PC Easy to use Reduced to the essentials Automated, where it is only Possible (Copy of the Vendor Homepage: https://sevdesk.de/) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official SEVENIT GmbH SevDesk v3.10 web-application & cloud online-service. Vulnerability Disclosure Timeline: ================================== 2014-09-01: Researcher Notification & Coordination (Benjamin Kunz Mejri) 2014-09-02: Vendor Notification (SevDesk Developer Team) 2014-09-07: Vendor Response/Feedback (SevDesk Developer Team) 2015-02-01: Vendor Fix/Patch Notification (SevDesk Developer Team) 2015-03-23: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== SevenIT Product: SevDesk - Web Application 3.1.0 Exploitation Technique: ======================= Remote Severity Level: =============== High Technical Details & Description: ================================ Multiple persistent input validation web vulnerabilities are detected in the official SEVENIT Software GmbH - sevDesk v3.10 web-application. The vulnerability allows remote attackers or low privileged user account to inject own malicious script codes to the application-side of the vulnerable web-application module or service. The security vulnerability is located in the `firstname`, `surname` & `family` name values of the main sevDesk `Dasboard` application module. Remote attackers are able to inject own codes to the main dashboard service by manipulation of the registration username. The execution of the injected script code occurs on the application-side in the main dasboard module through the rightHead and feedcontent class. The attack vector is persistent and the request method to inject the code is POST. The victim user can also change the name by usage of the application which does not require an admins interaction on successful exploitation. The security risk of the persistent script code inject web vulnerabilities is estimated as medium with a cvss (common vulnerability scoring system) count of 5.9. Exploitation of the persistent vulnerability requires a low privileged sevdesk user account with restricted access and no direct user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent external redirects to malicious source and persistent manipulation of affected or connected application modules. Request Method(s): [+] POST Vulnerable Module(s): [+] Registration to SevDesk Vulnerable Parameter(s): [+] surname [+] firstname [+] family name Affected Module(s): [+] Dasboard Index - rightHead & feedcontent Proof of Concept (PoC): ======================= The persistent input validation web vulnerability can be exploited by low privileged application user accounts with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability 1. Register an account by usage of the following webpage https://my.sevdesk.de/register/ 2. Include to the surname, family name and firstname your own script code as payload 3. Save the registration form and go to the website https://my.sevdesk.de/ 4. Login with the user account data 5. The execution of the injected script code occurs after the registration POST method request and next to the redirect in the main dasboard index (rightHead < name > feedcontent) 6. Successful reproduce of the application-side security vulnerability! PoC: rightHead > Displayname (First- & Lastname)
a>"<[PERSISTENT INJECTED SCRIPT CODE VIA NAME VALUE!]> b>"
Einstellungen | Hilfe | Logout