full-disclosure - INSECT Pro - Advisory 2011 0823 - Zero day

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <475c3ff2c0aba287fe6a8f313a40aaca@insecurityresearch.com>
Date: Tue, 23 Aug 2011 13:02:17 -0300
From: Juan Sacco <jsacco@...ecurityresearch.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: INSECT Pro - Advisory 2011 0823 - Zero day - XSS
	in BING.COM

Information
--------------------
Name : XSS Reflected on BING.COM
Software : BING.COM MAPS
Vendor Homepage : http://www.bing.com
Vulnerability Type : XSS Reflected
Severity : Very High
Researcher : Juan Sacco (runlvl) <jsacco [at] insecurityresearch [dot] 
com>

Description
------------------
BING.COM is prone to a XSS vulnerability because the application fails 
to properly perform adequate boundary checks on user-supplied data.
An attacker can exploit this issue to execute arbitrary code in the 
victim's browser.

Details
-------------------
The reflected XSS vulnerability is a variant of a cross-site scripting 
flaw: it occurs when the data provided by the attacker is exectued by 
the browser, and then displayed on "normal" pages returned to other 
users in the course of regular browsing, without proper HTML escaping. A 
classic example of this is with online message boards where users are 
allowed to post HTML formatted messages for other users to read

Exploit example as follow
-----------------------------

http://www.bing.com/maps/embed/Customize.aspx
?v=2
&cp=-34.59999847400003~-58.45000076200001
&lvl=6
&dir=0
&sty=c
&eo=
&where1=';alert(String.fromCharCode(88,83,83,32,98,121,32,114,117,110,108,118,108))//</SCRIPT>
&form=LMLTEW

The vulnerability is caused by the following code and affected by the 
Generate Code map

<div id="LME_mapLinks" style="line-height: 20px">
         <a id="LME_largerMap" //--&gt;&quot;&gt;'&gt; on Bing Maps (New 
window)">View Larger Map</a>
</div>

Solution
-------------------
No patch are available at this time.

Credits
-------------------
Manual discovered by Insecurity Research Labs
Juan Sacco (runlvl) - http://www.insecurityresearch.com

-- 
_________________________________________________
Insecurity Research - Security auditing and testing software
Web: http://www.insecurityresearch.com
Insect Pro 2.6.1 was released stay tunned

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/