Document Title: =============== KeeWeb v1.14.0 - (Notes) Html Inject Web Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2237 Release Date: ============= 2020-05-06 Vulnerability Laboratory ID (VL-ID): ==================================== 2237 Common Vulnerability Scoring System: ==================================== 4.2 Vulnerability Class: ==================== Script Code Injection Current Estimated Price: ======================== 1.000€ - 2.000€ Product & Service Introduction: =============================== Free cross-platform password manager compatible with KeePass. Web version has almost all features available in desktop apps. It doesn't require any installation and works in all modern browsers. Desktop apps look beautiful on each platform: macOS, Windows and Linux. You can open local files in Desktop apps. (Copy of the Homepage: https://keeweb.info/ & https://app.keeweb.info/) Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered a html injection web vulnerability in the KeeWeb v1.14.0 online service web-application. Affected Product(s): ==================== KeeWeb Product: KeeWeb v1.14.0 - Online Service (Web-Application) Product: KeeWeb v1.14.0 x64 - Windows Desktop Client (Software) Vulnerability Disclosure Timeline: ================================== 2020-05-06: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Exploitation Technique: ======================= Remote Severity Level: =============== Medium Authentication Type: ==================== Restricted authentication (user/moderator) - User privileges User Interaction: ================= Medium User Interaction Disclosure Type: ================ Independent Security Research Technical Details & Description: ================================ A html injection web vulnerability has been discovered in the official KeeWeb v1.14.0 online service web-application. The vulnerability allows remote attackers to inject own malicious html codes with persistent attack vector to compromise browser to web-application requests from the application-side. The html inject web vulnerability is located in the notes input field of the new entry add module. Local privileged accounts are able to compromise the stored database entries by inject of simple html code. After the inject the execution points of the issue are located in the New Entry or on export as HTML5 file. The execute occurs in both cases on review in the vulnerable marked fields of the input. The request method to inject is POST and the attack vector is located on the application-side. The issue is a classic html injection. There is already a poc exploit in the wild available with the expected client database format to import after the export. Successful exploitation of the web vulnerability results in persistent phishing attacks, persistent external redirects to malicious source and persistent manipulation of affected application modules. Request Method(s): [+] POST Vulnerable Module(s): [+] New Vulnerable Parameter(s): [+] Notes Affected Module(s): [+] New entries on preview [+] Export as HTML5 file Proof of Concept (PoC): ======================= The html inject web vulnerability can be exploited by remote attackers with privileged user account or via medium user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Open the KeeWeb application 2. Add a new Database 3. Include a new entry 4. Inject to the Notes input field your html payload with external request 5. Save the entry and export the kdbx or as html5 Note: The execution of the html code occurs on preview of the entry or open of the html file 6. Successful reproduce of the vulnerability! PoC: Payload PoC: Vulnerable Source (Export HTML5)