Date: Tue, 15 May 2018 08:43:17 +0200
From: SEC Consult Vulnerability Lab <research@...-consult.com>
To: <fulldisclosure@...lists.org>, <bugtraq@...urityfocus.com>
Subject: Re: [FD] SEC Consult SA-20180514-0 :: Arbitrary File Upload &
 Cross-site scripting in MyBiz MyProcureNet

The following CVE numbers have been assigned now:
XSS issue: CVE-2018-11090
Arbitrary File Upload: CVE-2018-11091


On 2018-05-14 13:25, SEC Consult Vulnerability Lab wrote:
> SEC Consult Vulnerability Lab Security Advisory < 20180514-0 >
> =======================================================================
>               title: Arbitrary File Upload & Cross-site scripting
>             product: MyBiz MyProcureNet
>  vulnerable version: 5.0.0
>       fixed version: unknown
>          CVE number: -
>              impact: Critical
>            homepage: http://www.mybiz.net/
>               found: 2018-01-29
>                  by: Ahmad Ramadhan Amizudin (Office Kuala Lumpur)
>                      Fikri Fadzil (Office Singapore)
>                      Wan Ikram (Office Kuala Lumpur)
>                      Jasveer Singh (Office Kuala Lumpur)
>                      SEC Consult Vulnerability Lab
> 
>                      An integrated part of SEC Consult
>                      Europe | Asia | North America
> 
>                      https://www.sec-consult.com
> 
> =======================================================================
> 
> Vendor description:
> -------------------
> "MyBiz is a company fixated on developing technology which transforms the way
> business is done online. At the intersection of what one business needs from
> another is the potential for value to be created differently. This
> intersection for the exchange of value requires technology but in
> fundamentally very different ways from traditional enterprise systems. MyBiz
> believes that the chemistry of business is the business relationships between
> enterprises. The strength of the business relationship drives the success and
> future of the business. MyBiz believes that these business relationships need
> to be captured and orchestrated. MyBiz developed our proprietary Business
> Relationship Network engine, a platform to capture business relationships as
> data to drive new business services which create value efficiently."
> 
> Source: http://www.mybiz.net/copy-of-our-story
> 
> 
> Business recommendation:
> ------------------------
> The vendor did not reply to our inquiries since February 2018 hence the issues
> might still exist in current versions.
> 
> SEC Consult recommends not use this product until a thorough security review
> has been performed by security professionals and all identified issues have
> been resolved. It is assumed that MyBiz products are affected by further
> critical security issues.
> 
> 
> Vulnerability overview/description:
> -----------------------------------
> The identified vulnerabilities can be exploited after authentication but
> the registration for the application is usually open for anyone.
> 
> 1. Arbitrary File Upload
> A malicious file can be uploaded to the webserver by an attacker. It is
> possible for an attacker to upload a script to issue operating system
> commands.
> 
> This vulnerability occurs because an attacker is able to adjust the
> "HiddenFieldControlCustomWhiteListedExtensions" parameter and add arbitrary
> extensions to the whitelist during the upload.
> 
> For instance, if the extension .asp is added to the
> "HiddenFieldControlCustomWhiteListedExtensions" parameter, the server
> accepts "secctest.asp" as legitimate file. Hence malicious files can be
> uploaded in order to execute arbitrary commands to take over the server.
> 
> 
> 2. Reflected Cross-site scripting
> This vulnerability within "ProxyPage.aspx" allows an attacker to inject
> malicious client side scripting which will be executed in the browser of
> users if they visit the manipulated site.
> 
> 
> Proof of concept:
> -----------------
> The proof of concept has been removed as no patch is available.
> 
> 
> Vulnerable / tested versions:
> -----------------------------
> MyBiz MyProcureNet version 5.0.0 has been tested and found to be vulnerable. This
> was the latest version available at the time of the test.
> 
> 
> Vendor contact timeline:
> ------------------------
> 2018-02-22: Contacting vendor through info@...iz.net (no response)
> 2018-02-27: Request update from vendor (no response)
> 2018-03-13: Trying to contact via web form http://www.mybiz.net/contact-us
>             (no response)
> 2018-05-14: Public release of security advisory
> 
> 
> Solution:
> ---------
> None
> 
> 
> Workaround:
> -----------
> None
> 
> 
> Advisory URL:
> -------------
> https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html
> 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> SEC Consult Vulnerability Lab
> 
> SEC Consult
> Europe | Asia | North America
> 
> About SEC Consult Vulnerability Lab
> The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
> ensures the continued knowledge gain of SEC Consult in the field of network
> and application security to stay ahead of the attacker. The SEC Consult
> Vulnerability Lab supports high-quality penetration testing and the evaluation
> of new offensive and defensive technologies for our customers. Hence our
> customers obtain the most current information about vulnerabilities and valid
> recommendation about the risk profile of new technologies.
> 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Interested to work with the experts of SEC Consult?
> Send us your application https://www.sec-consult.com/en/career/index.html
> 
> Interested in improving your cyber security with the experts of SEC Consult?
> Contact our local offices https://www.sec-consult.com/en/contact/index.html
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> Mail: research at sec-consult dot com
> Web: https://www.sec-consult.com
> Blog: http://blog.sec-consult.com
> Twitter: https://twitter.com/sec_consult
> 
> EOF Ahmad Ramadhan / @2018
> 



Download attachment "smime.p7s" of type "application/pkcs7-signature" (3995 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists