{"id":16631,"date":"2021-07-07T16:08:56","date_gmt":"2021-07-07T14:08:56","guid":{"rendered":"https:\/\/herolab-usd.formwandler.rocks\/security-advisories\/usd-2019-0057\/"},"modified":"2021-07-19T14:12:37","modified_gmt":"2021-07-19T12:12:37","slug":"usd-2019-0057","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2019-0057\/","title":{"rendered":"usd-2019-0057"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n

usd-2019-0057 | Userlike Chat<\/span><\/h1>\n

<\/span>
Advisory ID<\/strong>: usd-2019-0057<\/span>
CVE Number<\/strong>: CVE-2019-19213<\/span>
Affected Product<\/strong>: Userlike Chat<\/span>
Vulnerability Type<\/strong>: Cross-Site Scripting<\/span>
Security Risk<\/strong>: Critical<\/span>
Vendor URL<\/strong>: https:\/\/userlike.com<\/a><\/span>
Vendor Status<\/strong>: Fixed<\/span><\/p>\n

<\/h3>\n

Description<\/h3>\n

Userlike does not handle data received via websockets requests correctly, thus a malicious client may inject JavaScript that is run in the browser context of a chat operator.<\/span><\/p>\n

<\/span><\/p>\n

Introduction<\/h3>\n

Companies that want to use userlike.com need to register first. In order to install the chat on their website, there is a JavaScript Widget that can be downloaded and embedded. Once the chat is setup correctly, users may start a chat session with chat operators. Therefore operators need to login at https:\/\/userlike.com\/de\/<\/a> and open the chat panel.<\/p>\n

In this chat panel, chat operators may create screenshots of the customer\u2019s browser using the \u201e$screenshot\u201c<\/em> command. In the following the screenshot is then uploaded from the client (customer) to the userlike server. The server responds with the URL where the uploaded image may be found. This URL is sent to the chat operator using a websocket and finally embedded in an <img>-tag. Because of insufficient filtering, the URL may contain special characters enabling an attacker to escape the source of this <img>-tag and insert her own markup and XSS payload.<\/p>\n

Even though the interaction of the chat operator is required to perform this attack, this vulnerability is considered critical. Performing a social engineering attack an attacker may easily convince a chat operator to take a screenshot of the attacker\u2019s browser.<\/p>\n

 <\/p>\n

Proof of Concept (PoC)<\/h3>\n

1. [Operator] type <\/span>\u201e$screenshot\u201c<\/em><\/p>\n

[\/et_pb_text][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/1-3-1024x588-1.png\" title_text=\"1-3-1024x588\" _builder_version=\"4.9.4\" _module_preset=\"default\"][\/et_pb_image][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n

2. [Customer] start intercepting traffic (including websocket requests)<\/p>\n

3. [Operator] send message<\/p>\n

4. [Customer] forward websocket requests up to the message containing the screenshot URL:<\/p>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]433228[false,\"https:\/\/www.userlike.com\/api\/proxy\/screenshot\/123456\"]<\/code><\/pre>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" custom_margin=\"||27px||false|false\"]<\/p>\n

4.1. [Customer] extend the URL such that it contains the XSS payload and then forwa<\/span><\/p>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]433228[false,&quot;https:\/\/www.userlike.com\/api\/proxy\/screenshot\/123456?usd=\\&quot;&gt;&lt;img src=x onerror=alert(1)&gt;&quot;]<\/code><\/pre>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"default\"]<\/p>\n

5. The XSS Payload is run in the operator\u2019s browser:<\/span><\/p>\n

[\/et_pb_text][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/2-2.png\" title_text=\"2-2\" _builder_version=\"4.9.4\" _module_preset=\"default\" custom_margin=\"27px||43px||false|false\"][\/et_pb_image][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n

\n
\n

Fix<\/h3>\n

Treat websocket-requests that are sent by the client as regular user controlled data. Make sure to encode or filter user controlled content before embedding and replaying it.<\/span><\/p>\n

<\/h3>\n

Timeline<\/h3>\n
    \n
  • 2019-09-18 This vulnerability was found by Konstantin Samuel during a pentest<\/li>\n
  • 2019-11-14 Vendor schedules update for this date<\/li>\n
  • 2019-11-25 Vendor fixed the issue<\/li>\n
  • 2020-04-29\u00a0<\/span>Security advisory released<\/span><\/li>\n<\/ul>\n

    <\/h3>\n

    Credits<\/h3>\n

    This security vulnerabilities were found by Konstantin Samuel of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n

    [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

    usd-2019-0057 | Userlike Chat Advisory ID: usd-2019-0057CVE Number: CVE-2019-19213Affected Product: Userlike ChatVulnerability Type: Cross-Site ScriptingSecurity Risk: CriticalVendor URL: https:\/\/userlike.comVendor Status: Fixed Description Userlike does not handle data received via websockets requests correctly, thus a malicious client may inject JavaScript that is run in the browser context of a chat operator. Introduction Companies that want to […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16631","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16631","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16631"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16631\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16631"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}