środa, 7 stycznia 2015

yammer.com - Same Origin Method Execution

SOME ;-) time ago@BenHayak talked about Same-Origin Method Execution on BlackHat EU. At the time of posting this article, there's no public whitepaper yet (only leaked slides) - that's why I'd love to share one of first posts that show this attack in action.

Yammer.com is part of Microsoft Bug Bounty for Online Services. During some research in used Flash files I found this one: video-js.swf (source).

Take a look to this piece of code:

As far as you probably know - the ExternalInterface is ActionScript class that allows (for example) to communicate Flash object with browser’s Javascript. First parameter is function name, that we want to call. As you can see - it’s readyFunction parameter (from GET), but it’s also sanitized with cleanEIString which looks like this:

So - only chars we are able to use is alphanumeric, underscore and a dot - to prevent Cross-Site Scripting. For example - if we’ll provide readyFunction=alert - our flash file will execute alert function, but we have no control over arguments (because we can't use brackets), so it’s useless for XSS purposes.

...and here is the place where we can start talking about Same-Origin Method Execution :-) Let take evil.com, that have hyperlink to vulnerable videoplayer. After clicking to this link, it opens the flash file in new tab, and next - redirect evil.com to yammer.com (in the same tab). From now on - newly opened tab have access to previous tab by window.opener (because they are both in Same Origin - yammer.com), and it’s also able to access DOM and execute functions in context of opened yammer.com page. 

The goal is to authorize user to some malicious application without his knowledge. Attack scenario will look this way:

1. User is visiting evil PoC site
2. He/she clicks on link which -in the end - redirect user to video player with readyFunction param described later
3. We’re redirecting Poc site to our yammer.com application - all we need to know is client_id - link example here: 

4. We need to wait few seconds to be 100% sure that redirect from point 3 happend (that's why I used proxy.php that sleeps and then returns 30x).
5. Flash Video Player will execute this readyFunction:


...which is simply the “Allow” button + click() function :->

As you can imagine - this will cause clicking on the button and authorizing application to victim’s account, which is dangerous. :)

Proof of Concept goes here: http://ropchain.org/poc/yammer-some.html

...and demo:

96 komentarzy:

  1. Nice! Just saw the BlackHat talk. A minor correction, readyFunction=alert isn't completely useless. @garethheyes have some interesting payloads that work without paranetsis, document.domain=name might pass forexample.

  2. GBWhatsApp - It will help you to get rid of most of those restrictions that the official version imposes on you. In simple words, the gbwa is a modded application which has some extra features that you won’t be able to find in the stock version. Some of the most noteworthy and popular features of the gbwa mod are hiding blue tick, online status, last seen, theme customizations and the brand new auto-reply.

    Lucky Patcher app is an android tool to change permission on android apps, block ads, get free in app purchases from android apps and games. Lucky patcher can be used on android and also on PC or windows with the help of bluestacks.

  3. Enjoyed reading the article above , really explains everything in detail,the article is very interesting and effective.Thank you and good luck for the upcoming articles.Data science training in Pune| Data science courses in pune

  4. hello ,
    such a great article thanks for sharing , really you writte well article as always , thanks again for this amazing article


  5. A befuddling web diary I visit this blog, it's incredibly grand. Strangely, in this present blog's substance made motivation behind fact and sensible. The substance of information is instructive
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

  6. Nice Article…..
    Really appreciate your efforts
    Romantic Shayari

  7. Use dual account with Gb whatsapp Apk Latest Application With free of cost.

  8. Thanks For This Information please visit our website ApkGlo To Download fresh android apps.

  9. GBWhatsapp It will help you to get rid of most of those restrictions that the official version imposes on you. In simple words, the gbwa is a modded application which has some extra features that you won’t be able to find in the stock version. Some of the most noteworthy and popular features of the gbwa mod are hiding blue tick, online status, last seen, theme customizations and the brand new auto-reply.

  10. Lucky Patcher gives you unlimited in-game resources & removes ads from any type of android application.

    GBWhatsApp Apk:

    GBWhatsApp is the best version of Official WhatsApp.

  11. Nice post. I learn something totally new and challenging on websites I stumbleupon every day. It's always useful to read through articles from other authors and practice something from other sites.
    Thanks for sharing this information with us. Download Free Xmod and information.

  12. Great information for new guy like me. This shows not only particular heck but also give idea about. Thanks for sharing this information. How to download instagram videos free

  13. What a great article! Awesome tropic and Excellent Content. Thanks for Providing that very important information.
    PSC Result 2019
    PSC exam Result 2019
    JSC Result 2019
    JSC Result DPE

  14. This game has more space so your gadget ought to contain more than 2GB RAM. More space guarantees that your game will run smooth and without hanging issue. Numerous different advances and high designs games like Dragon Ball Z, Call of Duty, NBA, Fifa, FarCry, and GTA additionally perfect with Happychick Emulator. You need to adhere to guidelines for establishment.
    happy chick
    happy chick apk
    happy chick download

  15. Want to buy water purifier click here to get best deals bestpurifierguide.com

  16. Such A nice post... thanks For Sharing !!Great information for new guy like Happy New year 2020

  17. Download redbox tv apk for free and watch latest shows.


  18. The Tutu App is the one of the best ios,android

    App store to get the tons of free app and game. Here the latest version of gta vice city apk of free.


  19. the WhatsApp Plus APK is one of the best mod app for official WhatsApp Plus Download for free, get unlimited features of whatsapp plus for free. Here Click to download the latest version whatsapp plus apk.


  20. The Tutu App download is the best app to download latest

    app and Apk for free so use now to TutuApp ios

    free App.


  21. the panda helper apk is the best app to download latest app for free so download now panda app to unlock a many feature now download now.

  22. very nice <a href=" http://motivation456.com/happy-new-year/happy-new-year.html>happy-new-year</a>

  23. I really thank you for the valuable info on this great subject and look forward to more great posts.Nice Article ,keep it up ,It is very helpful.Instagram Usernames|WhatsApp Dares|Leadership Team Names|Golden Hour Captions

  24. it looks very nice and fantastic. thank you very much for sharing this info with us.
    Vavoo Apk Latest Version 2020
    Watching movies and series on TV is a good way of spending free time. This helps people get rid of anxiety, depression, and tiredness. You feel fresh, relax and mentally alert if you watch drama and movies and other programs on TV. But this is not possible to keep TV everywhere along with you. Vavoo is the application that lets you watch your TV shows on your phone. You can easily search the movies, TV shows, and other programs in the app by using the search bar. Watch your favorite shows online or download them so that you can watch them later.
    visit and check
    famedram apk


  26. This is one of the finest post i have ever seen. The information is genuine and relatable . We are really grateful for your blog post.
    iso certification in saudi arabia | iso 9001 certification in saudi arabia

  27. This is one of the best post i have read in months, its really great and inspiring, i will really like to read more form you and will like to share with others as well, keep writing more
    Buy Weed Seeds Online
    Buy A-796,260 Online
    Buy Phenethylamine Psychedelics online
    Subutex 8mg Online
    Order Quaaludes Mandrax 300mg online
    Buy DMT Dimethyltryptamine Online
    Valium Diazepam For Sale Online
    Buy Harvoni ledipasvir sofosbuvir online
    Cannabis Oil For Sale
    Buy enzodiazepines online you can as well Whatsapp/Text +1(646)883-3072 , Telegram: primenature or email:primepharma0@gmail.com for more details.

  28. The above article is very interesting Click here to get more queries.

  29. SSC Exam Result is a trending now in Bangladesh. SSC Examination was completed. All students are waiting to get their SSC Exam Result 2020. This year SSC Result 2020 will publish on 1st week in May. On the result day, after 12PM all students will get their SSC Exam Result 2020 from Bangladesh Education Board official website. Also Dakhil Result 2020 and SSC Vocational Result 2020 will publish on 6 May 2020

  30. Very nice post. Thanks for sharing. Keep it up. Check out the FMWhatsApp and make group and add me Thanks