Virgin Mobile Cross Site Scripting

Published
Credit
Risk
2015.10.28
Tommy DeVoss
Low
CWE
CVE
Local
Remote
CWE-79
N/A
No
Yes

Document Title:
===============
Virgin Mobile Client Side XSS Vulnerability

Release Date:
=============
2015-10-22

Common Vulnerability Scoring System:
====================================
3.4


Product & Service Introduction:
===============================
Virgin Mobile is a celluar company operating in the US and Canada.


Abstract Advisory Information:
==============================
An independent researcher discovered a client-side cross site scripting web vulnerability in the official Virgin Mobile online service web-application.


Vulnerability Disclosure Timeline:
==================================
2015-10-16: Discovery
2015-10-19: Initial contact to hello@virginmobile.ca
2015-10-19: Vendor replies and requests more information
2015-10-20: Additional information provided along with PoC
2015-10-22: Vendor Released Patch


Discovery Status:
=================
Published


Affected Product(s):
====================
Virgin Mobile


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
Request Method(s):
[+] GET

Vulnerable Service(s):
[+] Virgin Mobile (virginmobile.ca)

Vulnerable Module(s):
[+] Search

Vulnerable Parameter(s):
[+] q

Affected Section(s):
[+] Merchant Search Results


Proof of Concept (PoC):
=======================
The client-side cross site scripting web vulnerability can be exploited by remote attackers without privileged application user account and with low user interaction (click).
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.

PoC:

http://www.virginmobile.ca/en/search/search.html?q=%27%3E%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28String.fromCharCode%2888%2C83%2C83%2C80%2C79%2C83%2C69%2C68%29%29%3E&local=yes&x=54&y=25&province=ON&geoResult=failed

Solution - Fix & Patch:
=======================
2015-10-15: Vendor Fix/Patch (Virgin Mobile - Developer Team)


Credits & Authors:
==================
Tommy DeVoss - (dawgyg@gmail.com)



See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com