Document Title:
===============
Virgin Mobile Client Side XSS Vulnerability
Release Date:
=============
2015-10-22
Common Vulnerability Scoring System:
====================================
3.4
Product & Service Introduction:
===============================
Virgin Mobile is a celluar company operating in the US and Canada.
Abstract Advisory Information:
==============================
An independent researcher discovered a client-side cross site scripting web vulnerability in the official Virgin Mobile online service web-application.
Vulnerability Disclosure Timeline:
==================================
2015-10-16: Discovery
2015-10-19: Initial contact to hello@virginmobile.ca
2015-10-19: Vendor replies and requests more information
2015-10-20: Additional information provided along with PoC
2015-10-22: Vendor Released Patch
Discovery Status:
=================
Published
Affected Product(s):
====================
Virgin Mobile
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
Request Method(s):
[+] GET
Vulnerable Service(s):
[+] Virgin Mobile (virginmobile.ca)
Vulnerable Module(s):
[+] Search
Vulnerable Parameter(s):
[+] q
Affected Section(s):
[+] Merchant Search Results
Proof of Concept (PoC):
=======================
The client-side cross site scripting web vulnerability can be exploited by remote attackers without privileged application user account and with low user interaction (click).
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
PoC:
http://www.virginmobile.ca/en/search/search.html?q=%27%3E%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28String.fromCharCode%2888%2C83%2C83%2C80%2C79%2C83%2C69%2C68%29%29%3E&local=yes&x=54&y=25&province=ON&geoResult=failed
Solution - Fix & Patch:
=======================
2015-10-15: Vendor Fix/Patch (Virgin Mobile - Developer Team)
Credits & Authors:
==================
Tommy DeVoss - (dawgyg@gmail.com)