Monday, September 18, 2017

Gem in a box XSS vulnerability - CVE-2017-14506

In this short blogpost I will give a short explain of XSS vulnerability i found on geminabox v0.13.5. which is a gems manager like rubygems.org so you can upload and download gems
Geminabox parses the uploaded gems and gives the users list of the gems on the system as the following image:


As you can see, the system parses the gem's details and present it on the web UI.
After few times, I succeeded to create a GEM file to exploit XSS, the attack scenario goes as follows:







  • Malicious attacker create GEM file with crafted homepage value (gem.homepage in .gemspec file) includes XSS payload as the following image:
  • The attacker access geminabox system and uploads the gem file (or uses CSRF/SSRF attack to do so). 
  • From now on, any user access Geminabox web server, executes the malicious XSS payload, that will delete any gems on the server, and won't let users use the geminabox anymore. (make victim's browser crash or redirect them to other hosts).

PoC video:



4 comments:

  1. You have spotted a potential problem with the web interface to Geminabox - in that it will allow a malicious gem to modify the web page and inject JavaScript code into the page. However, I fail to see how that will "delete any gems on the server" or "won't let users use the geminabox anymore."

    ReplyDelete
    Replies
    1. Via XSS attack, you can send requests to the server on behalf of who is visiting the website,
      the malicious javascript runs under the geminabox host, so whenever one visit the webisite, the malicious script will enumerate the uploaded gems, sends the relevant DELETE requests to the server, and they will be deleted.
      In addition, it is possible to cause DoS to the web application by injecting malicious javascript that crash the browser while clients accessing geminabox web app or just redirect the user's from the index page so they won't be able to use it.

      Delete
    2. My names is Cathy i want to testify about the great spell caster called Priest Ade my husband and i have been married for 5 years now we don't have a child and the doctor told us i can't give birth because my womb have been damaged due to wrong drugs prescription this got me so worried and my husband was not happy so he decided to get married to another girl and divorce me i was so sad i told my friend about it she told me about a powerful spell caster she gave me his email address well i never believe in it that much though i just decided to give him a try and he told me it will take 24hrs to get my husband back to me and i will get pregnant i doubted him the 3rd day my husband came back to me and was crying he said he didn't want the divorce anymore 3 weeks after the doctor confirmed that i was pregnant he can also help you contact him at

      ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

      Blog: https://effectivespell1.blogspot.com

      Website http://ancientspiritspellcast.website2.me

      WhatsApp +2347059715465

      Delete
  2. My names is Cathy i want to testify about the great spell caster called Priest Ade my husband and i have been married for 5 years now we don't have a child and the doctor told us i can't give birth because my womb have been damaged due to wrong drugs prescription this got me so worried and my husband was not happy so he decided to get married to another girl and divorce me i was so sad i told my friend about it she told me about a powerful spell caster she gave me his email address well i never believe in it that much though i just decided to give him a try and he told me it will take 24hrs to get my husband back to me and i will get pregnant i doubted him the 3rd day my husband came back to me and was crying he said he didn't want the divorce anymore 3 weeks after the doctor confirmed that i was pregnant he can also help you contact him at

    ancientspiritspellcast@yahoo.com or ancientspiritspellcast@gmail.com

    Blog: https://effectivespell1.blogspot.com

    Website http://ancientspiritspellcast.website2.me

    WhatsApp +2347059715465

    ReplyDelete