[FD] Kaspersky Company Account - Response XSS Vulnerability

Document Title: =============== Kaspersky Company Account - Response XSS Vulnerability References (Source): ==================== http://ift.tt/2cli4Ez Release Date: ============= 2016-08-29 Vulnerability Laboratory ID (VL-ID): ==================================== 1934 Common Vulnerability Scoring System: ==================================== 3.5 Product & Service Introduction: =============================== Kaspersky CompanyAccount is a web service used for delivering and tracking user requests submitted to Kaspersky Lab. This system allows submitting requests to the Technical Support, VirusLab, and other departments. A CompanyAccount is created not for a single person but for a Company. All officers of that company are grouped into a single CompanyAccount by a license. This allows transferring CompanyAccount administration permissions from one officer to another with ease. A CompanyAccount administrator can review all the requests submitted by all the Company officers, create new user profiles, change passwords, and assign permissions. When a new user joins the CompanyAccount (self-registration), the administrator receives a notification hereof. (Copy of the Vendor Homepage: http://ift.tt/2bJVmmX ) Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered an application-side input validation web vulnerability in the kaspersky company web-application. Vulnerability Disclosure Timeline: ================================== 2016-08-28: Vendor Fix/Patch (Kaspersky Security Department - APT) 2016-08-29: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Kaspersky Labs Product: Company Account Application - (Web-Application) 2016 Q3 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ An application-side input validation vulnerability has been discovered in the official Kaspersky Company Account online service web-application. The vulnerability allows remote attackers to inject own malicious script codes to the application-side of the vulnerable web module or function. Remote attackers are able to inject a persistent cross site scripting (xss) vulnerability malicious code in main function of the responding service. The vulnerable module : `/arsys/forms/cssapp/SRS%3AServiceRequestConsole/` allows attackers to handle the subject of response request and to inject own malicious code in the subject field without secure parse. The request method to perform the malicious context request is GET and the attack vector is located on the application-side. The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.3. Exploitation of the persistent input validation web vulnerability requires a low privileged web-application user account and low or medium user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent external redirects to malicious source and persistent manipulation of affected or connected application modules. Vulnerable Request(s): [+] GET Vulnerable Module(s): [+] /arsys/BackChannel/ Vulnerable Parameter(s): [+] param Proof of Concept (PoC): ======================= Persistent web vulnerability can be exploited by remote attackers with privileged web-application user account and low or medium user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. User moves to request which status "is on progress" 2. User add response to it by clicking on add response file 3. User injects script code payload (example: ">