Document Title:
===============
Ebay Inc (Pages) - Client Side Cross Site Scripting Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1626
Release Date:
=============
2016-02-07
Vulnerability Laboratory ID (VL-ID):
====================================
1626
Common Vulnerability Scoring System:
====================================
3.4
Product & Service Introduction:
===============================
eBay Inc. is an American multinational internet consumer-to-consumer corporation, headquartered in San Jose, California. It was founded by Pierre Omidyar in 1995,
and became a notable success story of the dot-com bubble; it is now a multi-billion dollar business with operations localized in over thirty countries. The company
manages eBay.com, an online auction and shopping website in which people and businesses buy and sell a broad variety of goods and services worldwide. In addition to
its auction-style sellings, the website has since expanded to include `Buy It Now` standard shopping; shopping by UPC, ISBN, or other kind of SKU (via Half.com);
online classified advertisements online event ticket trading online money transfers and other services.
(Copy of the Homepage: http://en.wikipedia.org/wiki/EBay )
Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered multiple client-side vulnerabilities in the official Ebay Inc Pages online service web-application.
Vulnerability Disclosure Timeline:
==================================
2015-10-27: Researcher Notification & Coordination (Daniel Diaz)
2015-10-27: Vendor Notification (Ebay Inc - Security Team)
2015-11-03: Vendor Response/Feedback (Ebay Inc - Security Team)
2016-02-06: Vendor Fix/Patch (Ebay Inc - Security Team)
2016-02-07: Vendor Fix/Patch (Ebay Inc - Developer Team) [Acknowledgements]
2016-02-07: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Ebay Inc.
Product: Ebay Pages - Online Service (Web-Application) 2015 Q4
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
Multiple client-side web vulnerabilities has been discovered in the official Ebay Pages online service web-application.
The first vulnerability allows remote attacker to inject client-side script codes to compromise browser to application requests.
The second vulnerability allows remote attacker to redirect client-side browser to application request for external manipulation.
The first vulnerability is a client-side cross site scripting vulnerability that is located in the nav value of the vulnerable link module.
The domain pages.ebay.com/link/ has two parameters `nav` and `url`. The `nav` parameter receives as argument `webview`. If an attacker sends
a javascript code like `javascript:alert(document.cookie)` the code will execute in the same reply. The attack vector of the issue is non-
persistent and the request method to inject/execute is GET.
The second vulnerability is a client-side open redirect web vulnerability that is located in the url value of the vulnerable link module.
The `url` parameter receives as argument an url or javascript code. If an attacker sends an url like `http://www.google.es` the application
will open the malicious webpage. The attack vector of the issue is non-persistent and the request method to redirect is GET.
The security risk of the client-side vulnerabilities is estimated as medium with a cvss (common vulnerability scoring system) count of 3.4.
Exploitation of the security vulnerabilities requires no privilege web-application user account and low or medium user interaction.
Successful exploitation of the vulnerabilities results in session hijacking, non-persistent phishing, non-persistent external redirects,
non-persistent load of malicious script codes or non-persistent web module context manipulation.
Request Method(s):
[+] GET
Vulnerable Module(s):
[+] Ebay Pages > /link
Vulnerable Parameter(s):
[+] nav
[+] url
Affected Module(s):
[+] webview
Proof of Concept (PoC):
=======================
The vulnerabilities can be exploited by remote attackers without privileged web-application user account and with low or medium user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
PoC: Client Side Cross Site Scripting
http://pages.ebay.com/link/?nav=webview&url=javascript:alert(document.domain)
http://pages.ebay.com/link/?nav=webview&url=javascript:alert(document.cookie)
http://pages.ebay.com/link/?nav=webview&url=iframe:src=http://www.vulnerability-lab.com
PoC: Source
