lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 4 Mar 2020 00:38:06 +0000
From: Scott Baker via Fulldisclosure <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Cc: Paul O'Neil <paul.oneil@...tonmail.com>
Subject: [FD] Script Injection Vulnerability Remediated

A script injection vulnerability was discovered by a penetration tester hired by Prosper and later by a security professional. Thanks to Paul O’Neil at CyberScout for his responsible disclosure and assistance in confirming this vulnerability.



For the attack to be successful, the attacker needed to be logged into prosper.com<https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fprosper.com%2F&data=02%7C01%7Csbaker%40prosper.com%7C7b23dc89e8394767025f08d7befc24a0%7C924fb1d22d664b62aeca6517836f3b2f%7C1%7C0%7C637187862469813924&sdata=g7V%2ByRdKPP3UNH%2Fqr0XLa%2FvAlqGoMT4StOEsHCtB%2FsY%3D&reserved=0> and could potentially save scripts that would run against their account.   The Prosper information security team checked the database for persisted attacks and detected some benign proof of concepts.  Monitoring alerts were created to detect further attacks. Developers then implemented input validation to prevent further attacks from being saved to the database.  Encoding was added as a defense in depth measure such that saved attacks would not work. In addition, Prosper has enabled Content Security Policy headers site-wide to whitelist domains that are approved for use in the context of our site.



Scott Baker

Director, Information Security

[/var/folders/pp/z1x004w566s7p31cjl2505shtvw7m0/T/com.microsoft.Outlook/WebArchiveCopyPasteTempFiles/cidimage001.png@...3CA8A.F07D7DD0]

221 Main Street, Suite 300

San Francisco, CA 94105





CONFIDENTIALITY STATEMENT: This email message, together with all attachments, is intended only for the individual or entity to which it is addressed and may contain legally privileged or confidential information. Any dissemination, distribution or copying of this communication by persons or entities other than the intended recipient, is strictly prohibited, and may be unlawful. If you have received this communication in error please contact the sender immediately and delete the transmitted material and all copies from your system, or if received in hard copy format, return the material to us via the United States Postal Service. Thank you.

Download attachment "Outlook-_var_folde.png" of type "image/png" (3122 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists