Anti-Phishing Research, Tombstones

Thursday, November 17, 2011

reseller.apple.com, XSS, Resolved, Cross Site Scripting, CWE-79, CAPEC-86, Best Practices

Resolved, XSS in reseller.apple.com

Reported to Apple Product Security on September 28, 2011 and reported as resolved at URL http://support.apple.com/kb/HT1318 which should be reviewed if you've found a Bug or vulnerability in Apple Products or Services.

The RXSS was notable for its evasion of WebKit and MSHTML.DLL. NoScript neutered the PoC.

Summary

Severity: High
Confidence: Certain
Host: https://reseller.apple.com
Path: /asb2b/init.do

Issue detail

The value of the dscountry request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload '%3bprompt(document.location)// was submitted in the dscountry parameter.


This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
XSS in reseller.apple.com, XSS, DORK, GHDB, Cross Site Scripting, CWE-79, CAPEC-86

No comments:

Post a Comment