Document Title: =============== Microsoft PhotoStory - CS Cross Site Scripting Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1012 Microsoft Security Response Center (MSRC) ID: 15155 Release Date: ============= 2013-12-12 Vulnerability Laboratory ID (VL-ID): ==================================== 1012 Common Vulnerability Scoring System: ==================================== 2.1 Product & Service Introduction: =============================== Microsoft Online Services is Microsoft`s hosted-software offering and a component of their software plus services strategy. Microsoft Online Services are hosted by Microsoft and sold ``with`` Microsoft partners. The suite includes Exchange Online, SharePoint Online, Office Communications Online, Microsoft Forefront, and Microsoft Office Live Meeting. For businesses, the Software-plus-Services approach enables organizations to access the capabilities of enterprise software through on-premises servers, as online services, or a combination of both, depending on specific business requirements. Services also provide the option to add complementary capabilities that enhance on-premises server software and simplify system management and maintenance. (Copy of the vendor Homepage: https://microsoftonline.com ) Abstract Advisory Information: ============================== An independent Vulnerability Laboratory Research Team discovered a client-side cross site scripting in flash component of Microsofts Website Application. Vulnerability Disclosure Timeline: ================================== 2013-07-14: Researcher Notification & Coordination (Muhammad A.S.) 2013-07-15: Vendor Notification (Microsoft Security Response Center - Security Program) 2013-12-11: Vendor Response/Feedback (Microsoft Security Response Center - Security Program) 2013-12-11: Vendor Fix/Patch (Microsoft Developer Team) 2012-12-12: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Microsoft Corporation Product: Photo Story - Flash 2013 Q2 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ An independent vulnerability laboratory researcher discovered a client side input cross site in flash component of Microsofts Website Application. The vulnerability allows remote attacker to execute malicious non-persistent script on client side. The vulnerability is located in the flash photo-story module when processing the load 2 different manipulated xmlloc parameter via GET method. The client-side script code will be executed in the flash web application layout as frame. During investigation it has been revealed that a remote attacker can manipulate both entry points to inject his own html and java-script. Exploitation of the vulnerability requires no privilege application user account but low or medium user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent malware injects, persistent external redirects and manipulation of affected module- or application context. Vulnerable Module(s): [+] photo-story Vulnerable File(s): [+] photostory3.swf Vulnerable Parameter(s): [+] xmlloc Proof of Concept (PoC): ======================= The client side cross site scripting vulnerability can be exploited by remote attacker with low privilege application user account and low or medium required user interaction. For demonstration or reproduce ... PoC: Generated Source Code } // End of the function $VERSION = "XXX_21118_0000"; var CONTROL_FILENAME = _root.controlloc; <<