what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

KeeWeb 1.14.0 HTML Injection

KeeWeb 1.14.0 HTML Injection
Posted May 7, 2020
Authored by Benjamin Kunz Mejri, Vulnerability Laboratory | Site vulnerability-lab.com

KeeWeb version 1.14.0 suffers from an html injection vulnerability.

tags | exploit
SHA-256 | dcf6726234a72d047650ced3804b3b8746b24423b2bf51390adbcf2035677a9f

KeeWeb 1.14.0 HTML Injection

Change Mirror Download
Document Title:
===============
KeeWeb v1.14.0 - (Notes) Html Inject Web Vulnerability


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2237


Release Date:
=============
2020-05-06


Vulnerability Laboratory ID (VL-ID):
====================================
2237


Common Vulnerability Scoring System:
====================================
4.2


Vulnerability Class:
====================
Script Code Injection


Current Estimated Price:
========================
1.000€ - 2.000€


Product & Service Introduction:
===============================
Free cross-platform password manager compatible with KeePass. Web
version has almost all features available in desktop apps.
It doesn't require any installation and works in all modern browsers.
Desktop apps look beautiful on each platform: macOS,
Windows and Linux. You can open local files in Desktop apps.

(Copy of the Homepage: https://keeweb.info/ & https://app.keeweb.info/)


Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a html
injection web vulnerability in the KeeWeb v1.14.0 online service
web-application.


Affected Product(s):
====================
KeeWeb
Product: KeeWeb v1.14.0 - Online Service (Web-Application)
Product: KeeWeb v1.14.0 x64 - Windows Desktop Client (Software)


Vulnerability Disclosure Timeline:
==================================
2020-05-06: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Authentication Type:
====================
Restricted authentication (user/moderator) - User privileges


User Interaction:
=================
Medium User Interaction


Disclosure Type:
================
Independent Security Research


Technical Details & Description:
================================
A html injection web vulnerability has been discovered in the official
KeeWeb v1.14.0 online service web-application.
The vulnerability allows remote attackers to inject own malicious html
codes with persistent attack vector to compromise browser
to web-application requests from the application-side.

The html inject web vulnerability is located in the notes input field of
the new entry add module. Local privileged accounts are able
to compromise the stored database entries by inject of simple html code.
After the inject the execution points of the issue are located
in the New Entry or on export as HTML5 file. The execute occurs in both
cases on review in the vulnerable marked fields of the input.
The request method to inject is POST and the attack vector is located on
the application-side. The issue is a classic html injection.
There is already a poc exploit in the wild available with the expected
client database format to import after the export.

Successful exploitation of the web vulnerability results in persistent
phishing attacks, persistent external redirects to malicious
source and persistent manipulation of affected application modules.

Request Method(s):
[+] POST

Vulnerable Module(s):
[+] New

Vulnerable Parameter(s):
[+] Notes

Affected Module(s):
[+] New entries on preview
[+] Export as HTML5 file


Proof of Concept (PoC):
=======================
The html inject web vulnerability can be exploited by remote attackers
with privileged user account or via medium user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.


Manual steps to reproduce the vulnerability ...
1. Open the KeeWeb application
2. Add a new Database
3. Include a new entry
4. Inject to the Notes input field your html payload with external request
5. Save the entry and export the kdbx or as html5
Note: The execution of the html code occurs on preview of the entry or
open of the html file
6. Successful reproduce of the vulnerability!


PoC: Payload
<img%20src="https://www.evolution-sec.com/evosec-logo.png"%20onload=alert(document.domain)>


PoC: Vulnerable Source (Export HTML5)
<td>Notes</td><td>
<div class="markdown"><blockquote>
<p><img%20src="https://www.evolution-sec.com/evosec-logo.png"%20onload=alert(document.domain)></p>
</blockquote>
</div></td></tr>
<tr><td>New Field</td>


PoC: Exploit (kdbx - aes encrypted) (passwd:test)
Ù¢šgûKµ   1Áòæ¿qCP¾X!jüZÿ  
ód嵡üª­_7uŽŸaHÞ3j2¨sfòKÙî
A¶C½3âÀ¥éWí>P9-C5sÍj™P‚yå à“  nhÉOTÇQMÜ3Ñë.
T[1øGæT.ŸíÔ·Y
FÓjh·‡Õ'Ê,®}&èo nyü¢.½üõ2=§Ô® @:¸æZEJ]Ö,<RÄh
   Э
TìJ§«kA0¥5Zš¥Y©y뉝*ÊÃÃÚeÝþ™;w
¹ˆeÙóäÞ…©‡BGö†g/ìNnoyy­…èî5±2H
ìsh©?bÖ. ÿøqfž6‰#qåæÿ;“›Ì…=³sýG¶õ~n÷Ê͸
¿Ø,@@™«9àíÈEqþô«Ö‚èSn's5Gt"QÎÊ¢ XžíXZ‚˜µN-
©©›¥í`4W«õŽâÞÄè(XžÓG­Ä{¨àšÆð¨Žklð
>Ó ¬¯ct«’l"ŠãMga.OkðvéÉ4?]ÚJ&ƒèðµ¶t!U|kM -ÎÕã+
©ˆczŒ[pݪœ²õ€Aiµ¦Îoj ÎoåðLè©ì¹°ÍùšÏ/‘g¤Ò
ZÖÖDít½¦4¬´óŽåG冖®¢Ë¥°ëœßójj¬cW2¹* ³µ± ¯¿3fÒ#
s(?«… ]Sö°ïKÜ¥2ð1˜ˆK{^ÛíQÁŒ
¹ëK5%õQ,Dô7¡Øwa-Qš–æ.ÌÏ Eó,] 4mnýì–¥¦89³âÁnì² šÄmÔã<""þh^]ü
’ΤC gaLœ®ä+.úíæE`î
íEö
àY(&h’ã³užÞ:šjŽ@á&£w×Ubb~çìrM:tŽ£úŠµœ­¨®®íç&ÜHºÑ(©AÓÜÞ^Ó²ïaÅâƒÉÒŸÆjȯUÆuiS‰ª½1²2‚®Lñéæ6ìàºâM&$ÂO•iP¨~4-
ÚÄfezt©ñ@Ú´Ÿi¨5%ý”ԏè&²zh%¥h*8±R‘¶3±ì¥6OŸF<ÂŒWNÚ¸oúìÿo:1½«·Gˆ¡¶ÏåoèžyÛ40p÷ê9«Ú_‹GÖiYä—¨=H$Qxw‹EV ©Ëq7×›[öBLõ(Ìñ±ívoQ­°âHÀÚæ^5&SP
W0&:ìRjæÍmΓ„ÿ¨Œ6aå²·ìtiÍxÚQèHV¿*l¦_éëΆé1ûÁ
êö›s…j@W¨z ñ#ŠX/2ã¬Êj
A·‰¥=ç ›¼GË5œEéƒïÔxs
ûÎÒŸc5yÔpm%ä}4TFbø³rk7`„ÇepÍ‚<ÍTÒŸ Ú<ˆ|¼÷vÉã×@s0ùC6xíz>‘—G
4Ò¸R0#|€K¹Ï‚®NMot¯@GØ]ª’ßëÙˆðé8š2.F@ç½ú$-ÏsÀaŸÉpÍã ˆ$Õ›Å
; sPÀŠü1&z}£1Ý;昒QuœÃ™½-*†°ÑÌ»AP͘:ÍÁ³%¤ Ž2«Vî~|–bds9.
ºR*k­.îrÿã»<|Ðx_±jÃvyù¢êoì¶ugF·u'Š£Cr‹F+dt ËtÃÒM} ”­°jÚbå¼ìjY‰¿˜¤cšb
Ë#Gõ2$W¸t;äz傼ñžì?'ør·n’öÍ7æªÚ-‹Ë÷(‡¢x…ÖG¬’랇ärAF=;-Ï<Áô.Sî(aWìé|Y®ÖPb@ô.Q©_•‡×?Aq˜ŒUÒ
s‡¯L <Ò2–æ&õ€œ't×ì6X9þ
š&%TÜJ‘s=a"—‰c{r?QdiÒwîk@Ô¸}õzV{œ@’±wüù¸Ù´C‡oQR.49#‹YïÓæùD”ñ58Ú


Solution - Fix & Patch:
=======================
The vulnerability can be resolved by an encode of the vulnerable output
parameters in the html5 files on export.
In a second step the input fields of the notes and others needs to be
restricted to disallow script code injects
The notes parameter needs to be escaped to ensure the injection point is
resolved.


Credits & Authors:
==================
Vulnerability-Lab -
https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
Benjamin Kunz Mejri -
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without
any warranty. Vulnerability Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability
and capability for a particular purpose. Vulnerability-Lab
or its suppliers are not liable in any case of damage, including direct,
indirect, incidental, consequential loss of business profits
or special damages, even if Vulnerability-Lab or its suppliers have been
advised of the possibility of such damages. Some states do
not allow the exclusion or limitation of liability for consequential or
incidental damages so the foregoing limitation may not apply.
We do not approve or encourage anybody to break any licenses, policies,
deface websites, hack into databases or trade with stolen data.

Domains: www.vulnerability-lab.com www.vuln-lab.com
www.vulnerability-db.com
Services: magazine.vulnerability-lab.com
paste.vulnerability-db.com infosec.vulnerability-db.com
Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab
youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php
vulnerability-lab.com/rss/rss_upcoming.php
vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php
vulnerability-lab.com/register.php
vulnerability-lab.com/list-of-bug-bounty-programs.php

Any modified copy or reproduction, including partially usages, of this
file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified
form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers.
All pictures, texts, advisories, source code, videos and other
information on this website is trademark of vulnerability-lab team & the
specific authors or managers. To record, list, modify, use or
edit our material contact (admin@ or research@) to get a ask permission.

Copyright © 2020 | Vulnerability Laboratory - [Evolution
Security GmbH]™




--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    18 Files
  • 6
    Oct 6th
    16 Files
  • 7
    Oct 7th
    12 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close