Wednesday, December 10, 2014

AliExpress XSS vulnerability - take over any seller account

In this blog post I will discuss a XSS vulnerability I’ve found in AliExpress website.
I discovered this vulnerability while i bought items in the website, i wanted to contact with the seller so i sent him a message. As an application security expert i suspected that the messages system might be vulnerable to XSS so i started investigate it.
after a full investigation i found that it is possible to inject HTML <b> tag into the message, and it will be rendered as HTML code in the recipients' browser.
By injection the following malicious script payload in a message content parameter, the seller will browse to the message center in AliExpress website, thus, the malicious script will be executed on his browser:

Hello Seller :)<b style="position:fixed;top:0;left:0;display:block;width:100%;height:100%" onmouseover="alert('Barak Tawily, AppSec Labs')">PoC</b>

Note: the system doesn't allow send HTML tags in the content of the message, but it allows <b> tag only, thats why the payload to exploit the vulnerability is <b> tag and not any other.




The vulnerability allows the attacker to execute malicious code on the seller's browser, thereby putting in danger all of the AliExpress sellers.

The attack scenario:
1. An attacker sends a message to a store via the "contact now" feature.
2. The attacker sends a malicious script injected inside the message content.
3. The seller browses to the AliExpress message center.
4. The malicious script executed on the seller's browser, which can be lead to several attacks such as perform actions on behalf of a seller, phishing attacks, steal the victim's sessions identifier, etc.
5. The attacker succeeds in executing malicious code in the seller's browser and will take it over on his store.

Skilled hacker might exploit this vulnerability and perform ranged attack by sending malicious messages to all AliExpress sellers and will cause a huge damage to AliExpress website.

A Proof of Concept (PoC) video can be found at the following link:
https://www.youtube.com/watch?v=78Y0CEQYN1Q

16 comments:

  1. This comment has been removed by the author.

    ReplyDelete
    Replies
    1. Hello my name is Lauren i'm from USA i want to testify of a great and powerful spell caster my husband left me and the kids for 2 weeks when i called him he didn't pick up when he came back home the 3rd week he told me he wanted a divorce i was so sad i cried all night he left again i was so lonely the next day i was searching for something online when i found a spell caster called Priest Ade who have helped so many people with their problems so i contacted him with my problems he told me it will take 24hrs and my husband will be back to me i did every thing he told me to do and the next day my husband came back kneeling and begging he canceled the divorce we are now happy together Priest Ade can help you too Email him at

      ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

      Blogs: https://relationshipspell.blogspot.com

      Website http://ancientspiritspellcast.website2.me

      WhatsApp +2347059715465






      Hello my name is Lauren i'm from USA i want to testify of a great and powerful spell caster my husband left me and the kids for 2 weeks when i called him he didn't pick up when he came back home the 3rd week he told me he wanted a divorce i was so sad i cried all night he left again i was so lonely the next day i was searching for something online when i found a spell caster called Priest Ade who have helped so many people with their problems so i contacted him with my problems he told me it will take 24hrs and my husband will be back to me i did every thing he told me to do and the next day my husband came back kneeling and begging he canceled the divorce we are now happy together Priest Ade can help you too Email him at

      ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

      Blogs: https://relationshipspell.blogspot.com

      Website http://ancientspiritspellcast.website2.me

      WhatsApp +2347059715465



















































































































































































































































































































































      Delete
    2. MY HUSBAND IS BACK WITH THE GREAT HELP OF DR SAM LOVE SPELL

      I'm so excited my broken Marriage has been restored my ex husband is back after he left me and our 2kids for another woman. i was so happy to met Dr. Sam Blogs https://supremespellcast.blogspot.com how he help many people to bring there Lover back so i contact him to help me too. that was how Dr. Sam help me to bring my husband back.. A big thank to you Dr. Sam because I never thought my ex Husband will be back to me so quickly with your spell. You are the best and world greatest. if you are here and you need your Ex Lover back or your husband moved to another woman, do not cry anymore, contact this powerful spell caster now. Here’s his contact:
      Email him at: supremespellcast@gmail.com Or supremespellcast@yahoo.com

      You can also Call/WhatsApp:+2347087462033
      You can also visit his website: http://supremespellcast.website2.me Or http://shallymilly09.blogspot.com/





      MY HUSBAND IS BACK WITH THE GREAT HELP OF DR SAM LOVE SPELL

      I'm so excited my broken Marriage has been restored my ex husband is back after he left me and our 2kids for another woman. i was so happy to met Dr. Sam Blogs https://supremespellcast.blogspot.com how he help many people to bring there Lover back so i contact him to help me too. that was how Dr. Sam help me to bring my husband back.. A big thank to you Dr. Sam because I never thought my ex Husband will be back to me so quickly with your spell. You are the best and world greatest. if you are here and you need your Ex Lover back or your husband moved to another woman, do not cry anymore, contact this powerful spell caster now. Here’s his contact:
      Email him at: supremespellcast@gmail.com Or supremespellcast@yahoo.com

      You can also Call/WhatsApp:+2347087462033
      You can also visit his website: http://supremespellcast.website2.me Or http://shallymilly09.blogspot.com/






      MY HUSBAND IS BACK WITH THE GREAT HELP OF DR SAM LOVE SPELL

      I'm so excited my broken Marriage has been restored my ex husband is back after he left me and our 2kids for another woman. i was so happy to met Dr. Sam Blogs https://supremespellcast.blogspot.com how he help many people to bring there Lover back so i contact him to help me too. that was how Dr. Sam help me to bring my husband back.. A big thank to you Dr. Sam because I never thought my ex Husband will be back to me so quickly with your spell. You are the best and world greatest. if you are here and you need your Ex Lover back or your husband moved to another woman, do not cry anymore, contact this powerful spell caster now. Here’s his contact:
      Email him at: supremespellcast@gmail.com Or supremespellcast@yahoo.com

      You can also Call/WhatsApp:+2347087462033
      You can also visit his website: http://supremespellcast.website2.me Or http://shallymilly09.blogspot.com/




























































































































      Delete
    3. MY HUSBAND IS BACK WITH THE GREAT HELP OF DR SAM LOVE SPELL

      I'm so excited my broken Marriage has been restored my ex husband is back after he left me and our 2kids for another woman. i was so happy to met Dr. Sam Blogs https://supremespellcast.blogspot.com how he help many people to bring there Lover back so i contact him to help me too. that was how Dr. Sam help me to bring my husband back.. A big thank to you Dr. Sam because I never thought my ex Husband will be back to me so quickly with your spell. You are the best and world greatest. if you are here and you need your Ex Lover back or your husband moved to another woman, do not cry anymore, contact this powerful spell caster now. Here’s his contact:
      Email him at: supremespellcast@gmail.com Or supremespellcast@yahoo.com

      You can also Call/WhatsApp:+2347087462033
      You can also visit his website: http://supremespellcast.website2.me Or http://shallymilly09.blogspot.com/





























































































































































































































































































































































































































































































































      Delete
  2. Replies
    1. My names is Cathy i want to testify about the great spell caster called Priest Ade my husband and i have been married for 5 years now we don't have a child and the doctor told us i can't give birth because my womb have been damaged due to wrong drugs prescription this got me so worried and my husband was not happy so he decided to get married to another girl and divorce me i was so sad i told my friend about it she told me about a powerful spell caster she gave me his email address well i never believe in it that much though i just decided to give him a try and he told me it will take 24hrs to get my husband back to me and i will get pregnant i doubted him the 3rd day my husband came back to me and was crying he said he didn't want the divorce anymore 3 weeks after the doctor confirmed that i was pregnant he can also help you contact him at

      ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

      Blog: https://effectivespell1.blogspot.com

      Website http://ancientspiritspellcast.website2.me

      WhatsApp +2347059715465

      Delete
    2. I want to use this opportunity I have to say a big thanks to Dr Great for getting back my ex husband. I'm Linda Gibson from USA, after 7 years of marriage my husband left me for another woman I did whatever I could to get him back but all I did was in vain I was sad, but I didn't lose hope of getting him back because I had faith in God. So I search online on how to get my husband back, and I came across a post of Dr Great of how he helped a lady to get back her ex, I contacted him and told him the pain I was going through, he told me what to do and I did it, then he casted a love spell for me 48 hours later my husband called me and told me he is sorry for what he did and that he misses me very much, later that day he came back home and beg for my forgiveness, since then our love grew stronger. For the marvelous things Dr Great has done for me it would be unfair for me not to let the whole world know that such a powerful spell caster do live. If you want to get back your ex fast email Dr Great at infinitylovespell@gmail.com or infinitylovespell@yahoo.com or add him up on WhatsApp +2348118829899 Blog: lindagibson90.blogspot.com

      Delete
  3. My names is Cathy i want to testify about the great spell caster called Priest Ade my husband and i have been married for 5 years now we don't have a child and the doctor told us i can't give birth because my womb have been damaged due to wrong drugs prescription this got me so worried and my husband was not happy so he decided to get married to another girl and divorce me i was so sad i told my friend about it she told me about a powerful spell caster she gave me his email address well i never believe in it that much though i just decided to give him a try and he told me it will take 24hrs to get my husband back to me and i will get pregnant i doubted him the 3rd day my husband came back to me and was crying he said he didn't want the divorce anymore 3 weeks after the doctor confirmed that i was pregnant he can also help you contact him at

    ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

    Blog: https://effectivespell1.blogspot.com

    Website http://ancientspiritspellcast.website2.me

    WhatsApp +2347059715465

    ReplyDelete
  4. Hello everyone i am happy to spread my testimony of a strong spell caster called Dr Great. I'm Kaitlyn Houston and i live in USA, my husband and i had a little fight because of that he wanted to divorce me i was so afraid to lose him because i love him very much so i search online for help and i saw alot of people's testimonies on how Dr Great help them and came out with positive results like Divorces, Cancers, lotteries, fertilities and others. So i emailed him and told him my problem and he told me what to do and I did it as he instructed, 24 hours later he told me he is done with the spell and my husband will no longer divorce me and when my husband came back from work he told me he won't divorce me anymore he said he didn't know what came over him that he is sorry I was so happy and I thank Dr Great for his help If you need Dr Great help email him at infinitylovespell@gmail.com you can also add him him on WhatsApp +2348118829899 and he will put an end to your problem

    ReplyDelete
  5. Hello everyone i am happy to spread my testimony of a strong spell caster called Dr Great. I'm Kaitlyn Houston and i live in USA, my husband and i had a little fight because of that he wanted to divorce me i was so afraid to lose him because i love him very much so i search online for help and i saw alot of people's testimonies on how Dr Great help them and came out with positive results like Divorces, Cancers, lotteries, fertilities and others. So i emailed him and told him my problem and he told me what to do and I did it as he instructed, 24 hours later he told me he is done with the spell and my husband will no longer divorce me and when my husband came back from work he told me he won't divorce me anymore he said he didn't know what came over him that he is sorry I was so happy and I thank Dr Great for his help If you need Dr Great help email him at infinitylovespell@gmail.com you can also add him him on WhatsApp +2348118829899 and he will put an end to your problem

    ReplyDelete
  6. Hello everyone i am happy to spread my testimony of a strong spell caster called Dr Great. I'm Kaitlyn Houston and i live in USA, my husband and i had a little fight because of that he wanted to divorce me i was so afraid to lose him because i love him very much so i search online for help and i saw alot of people's testimonies on how Dr Great help them and came out with positive results like Divorces, Cancers, lotteries, fertilities and others. So i emailed him and told him my problem and he told me what to do and I did it as he instructed, 24 hours later he told me he is done with the spell and my husband will no longer divorce me and when my husband came back from work he told me he won't divorce me anymore he said he didn't know what came over him that he is sorry I was so happy and I thank Dr Great for his help If you need Dr Great help email him at infinitylovespell@gmail.com you can also add him him on WhatsApp +2348118829899 and he will put an end to your problem

    ReplyDelete
  7. Hello my name is Lauren i'm from USA i want to testify of a great and powerful spell caster my husband left me and the kids for 2 weeks when i called him he didn't pick up when he came back home the 3rd week he told me he wanted a divorce i was so sad i cried all night he left again i was so lonely the next day i was searching for something online when i found a spell caster called Priest Ade who have helped so many people with their problems so i contacted him with my problems he told me it will take 24hrs and my husband will be back to me i did every thing he told me to do and the next day my husband came back kneeling and begging he canceled the divorce we are now happy together Priest Ade can help you too Email him at

    ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

    Blogs: https://relationshipspell.blogspot.com

    Website http://ancientspiritspellcast.website2.me

    WhatsApp +2347059715465

    ReplyDelete
  8. I want to use this opportunity I have to say a big thanks to Dr Great for getting back my ex husband. I'm Linda Gibson from USA, after 7 years of marriage my husband left me for another woman I did whatever I could to get him back but all I did was in vain I was sad, but I didn't lose hope of getting him back because I had faith in God. So I search online on how to get my husband back, and I came across a post of Dr Great of how he helped a lady to get back her ex, I contacted him and told him the pain I was going through, he told me what to do and I did it, then he casted a love spell for me 48 hours later my husband called me and told me he is sorry for what he did and that he misses me very much, later that day he came back home and beg for my forgiveness, since then our love grew stronger. For the marvelous things Dr Great has done for me it would be unfair for me not to let the whole world know that such a powerful spell caster do live. If you want to get back your ex fast email Dr Great at infinitylovespell@gmail.com or infinitylovespell@yahoo.com or add him up on WhatsApp +2348118829899 Blog: lindagibson90.blogspot.com

    ReplyDelete
  9. MY HUSBAND IS BACK WITH THE GREAT HELP OF DR SAM LOVE SPELL

    I'm so excited my broken Marriage has been restored my ex husband is back after he left me and our 2kids for another woman. i was so happy to met Dr. Sam Blogs https://supremespellcast.blogspot.com how he help many people to bring there Lover back so i contact him to help me too. that was how Dr. Sam help me to bring my husband back.. A big thank to you Dr. Sam because I never thought my ex Husband will be back to me so quickly with your spell. You are the best and world greatest. if you are here and you need your Ex Lover back or your husband moved to another woman, do not cry anymore, contact this powerful spell caster now. Here’s his contact:
    Email him at: supremespellcast@gmail.com Or supremespellcast@yahoo.com

    You can also Call/WhatsApp:+2347087462033
    You can also visit his website: http://supremespellcast.website2.me Or http://shallymilly09.blogspot.com/









    MY HUSBAND IS BACK WITH THE GREAT HELP OF DR SAM LOVE SPELL

    I'm so excited my broken Marriage has been restored my ex husband is back after he left me and our 2kids for another woman. i was so happy to met Dr. Sam Blogs https://supremespellcast.blogspot.com how he help many people to bring there Lover back so i contact him to help me too. that was how Dr. Sam help me to bring my husband back.. A big thank to you Dr. Sam because I never thought my ex Husband will be back to me so quickly with your spell. You are the best and world greatest. if you are here and you need your Ex Lover back or your husband moved to another woman, do not cry anymore, contact this powerful spell caster now. Here’s his contact:
    Email him at: supremespellcast@gmail.com Or supremespellcast@yahoo.com

    You can also Call/WhatsApp:+2347087462033
    You can also visit his website: http://supremespellcast.website2.me Or http://shallymilly09.blogspot.com/





    MY HUSBAND IS BACK WITH THE GREAT HELP OF DR SAM LOVE SPELL

    I'm so excited my broken Marriage has been restored my ex husband is back after he left me and our 2kids for another woman. i was so happy to met Dr. Sam Blogs https://supremespellcast.blogspot.com how he help many people to bring there Lover back so i contact him to help me too. that was how Dr. Sam help me to bring my husband back.. A big thank to you Dr. Sam because I never thought my ex Husband will be back to me so quickly with your spell. You are the best and world greatest. if you are here and you need your Ex Lover back or your husband moved to another woman, do not cry anymore, contact this powerful spell caster now. Here’s his contact:
    Email him at: supremespellcast@gmail.com Or supremespellcast@yahoo.com

    You can also Call/WhatsApp:+2347087462033
    You can also visit his website: http://supremespellcast.website2.me Or http://shallymilly09.blogspot.com/

    ReplyDelete
  10. Hello everyone i am happy to spread my testimony of a strong spell caster called Dr Great. I'm Kaitlyn Houston and i live in USA, my husband and i had a little fight because of that he wanted to divorce me i was so afraid to lose him because i love him very much so i search online for help and i saw alot of people's testimonies on how Dr Great help them and came out with positive results like Divorces, Cancers, lotteries, fertilities and others. So i emailed him and told him my problem and he told me what to do and I did it as he instructed, 24 hours later he told me he is done with the spell and my husband will no longer divorce me and when my husband came back from work he told me he won't divorce me anymore he said he didn't know what came over him that he is sorry I was so happy and I thank Dr Great for his help If you need Dr Great help email him at infinitylovespell@gmail.com or infinitylovespell@yahoo.com my page https://kaitlynhouston19.blogspot.com you can also add him on WhatsApp +2348118829899 and he will put an end to your problem

    ReplyDelete
  11. Hello everyone i am happy to spread my testimony of a strong spell caster called Dr Great. I'm Kaitlyn Houston and i live in USA, my husband and i had a little fight because of that he wanted to divorce me i was so afraid to lose him because i love him very much so i search online for help and i saw alot of people's testimonies on how Dr Great help them and came out with positive results like Divorces, Cancers, lotteries, fertilities and others. So i emailed him and told him my problem and he told me what to do and I did it as he instructed, 24 hours later he told me he is done with the spell and my husband will no longer divorce me and when my husband came back from work he told me he won't divorce me anymore he said he didn't know what came over him that he is sorry I was so happy and I thank Dr Great for his help If you need Dr Great help email him at infinitylovespell@gmail.com or infinitylovespell@yahoo.com my page https://kaitlynhouston19.blogspot.com you can also add him on WhatsApp +2348118829899 and he will put an end to your problem

    ReplyDelete