Virgin Mobile Cross Site Scripting
Posted on 27 October 2015
Document Title: =============== Virgin Mobile Client Side XSS Vulnerability Release Date: ============= 2015-10-22 Common Vulnerability Scoring System: ==================================== 3.4 Product & Service Introduction: =============================== Virgin Mobile is a celluar company operating in the US and Canada. Abstract Advisory Information: ============================== An independent researcher discovered a client-side cross site scripting web vulnerability in the official Virgin Mobile online service web-application. Vulnerability Disclosure Timeline: ================================== 2015-10-16: Discovery 2015-10-19: Initial contact to hello@virginmobile.ca 2015-10-19: Vendor replies and requests more information 2015-10-20: Additional information provided along with PoC 2015-10-22: Vendor Released Patch Discovery Status: ================= Published Affected Product(s): ==================== Virgin Mobile Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ Request Method(s): [+] GET Vulnerable Service(s): [+] Virgin Mobile (virginmobile.ca) Vulnerable Module(s): [+] Search Vulnerable Parameter(s): [+] q Affected Section(s): [+] Merchant Search Results Proof of Concept (PoC): ======================= The client-side cross site scripting web vulnerability can be exploited by remote attackers without privileged application user account and with low user interaction (click). For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. PoC: http://www.virginmobile.ca/en/search/search.html?q=%27%3E%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28String.fromCharCode%2888%2C83%2C83%2C80%2C79%2C83%2C69%2C68%29%29%3E&local=yes&x=54&y=25&province=ON&geoResult=failed Solution - Fix & Patch: ======================= 2015-10-15: Vendor Fix/Patch (Virgin Mobile - Developer Team) Credits & Authors: ================== Tommy DeVoss - (dawgyg@gmail.com)
