full-disclosure - [FD] Script Injection Vulnerability Remediated

Open Source and information security mailing list archives

Message-ID: <SN6PR1501MB21586186FF0D4FC9DAE5BB29C0E50@SN6PR1501MB2158.namprd15.prod.outlook.com>
Date: Wed, 4 Mar 2020 00:38:06 +0000
From: Scott Baker via Fulldisclosure <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Cc: Paul O'Neil <paul.oneil@...tonmail.com>
Subject: [FD] Script Injection Vulnerability Remediated

A script injection vulnerability was discovered by a penetration tester hired by Prosper and later by a security professional. Thanks to Paul O’Neil at CyberScout for his responsible disclosure and assistance in confirming this vulnerability.

For the attack to be successful, the attacker needed to be logged into prosper.com<https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fprosper.com%2F&data=02%7C01%7Csbaker%40prosper.com%7C7b23dc89e8394767025f08d7befc24a0%7C924fb1d22d664b62aeca6517836f3b2f%7C1%7C0%7C637187862469813924&sdata=g7V%2ByRdKPP3UNH%2Fqr0XLa%2FvAlqGoMT4StOEsHCtB%2FsY%3D&reserved=0> and could potentially save scripts that would run against their account.   The Prosper information security team checked the database for persisted attacks and detected some benign proof of concepts.  Monitoring alerts were created to detect further attacks. Developers then implemented input validation to prevent further attacks from being saved to the database.  Encoding was added as a defense in depth measure such that saved attacks would not work. In addition, Prosper has enabled Content Security Policy headers site-wide to whitelist domains that are approved for use in the context of our site.

Scott Baker

Director, Information Security

[/var/folders/pp/z1x004w566s7p31cjl2505shtvw7m0/T/com.microsoft.Outlook/WebArchiveCopyPasteTempFiles/cidimage001.png@...3CA8A.F07D7DD0]

221 Main Street, Suite 300

San Francisco, CA 94105

CONFIDENTIALITY STATEMENT: This email message, together with all attachments, is intended only for the individual or entity to which it is addressed and may contain legally privileged or confidential information. Any dissemination, distribution or copying of this communication by persons or entities other than the intended recipient, is strictly prohibited, and may be unlawful. If you have received this communication in error please contact the sender immediately and delete the transmitted material and all copies from your system, or if received in hard copy format, return the material to us via the United States Postal Service. Thank you.

Download attachment "Outlook-_var_folde.png" of type "image/png" (3122 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives