Document Title: =============== ClusterMaps - Cross Site Scripting Vulnerability Release Date: ============= 2011-07-25 Vulnerability Laboratory ID (VL-ID): ==================================== 135 Product & Service Introduction: =============================== Do you know your audience? You will with ClustrMaps! Visitors don t need to click on anything: just viewing your page is sufficient. We provide (free) the HTML that gives you a tiny map, like the one on the left. When it loads, it increments a counter and shows the locations of all visitors to your page, cumulatively (even for huge numbers). Clicking on it zooms in to a big world map, and (optionally) lets you zoom in to the continents, as in the example above. For light users (under 2500 visitors daily) the service is free, forever, and stores cumulative totals up to millions of visitors. Paying users get extra features. * Know your visitors * Target your content * Show off your community * Automatic: clicks optional * Speedy, scalable * Giant map, optional zooms * No spyware, no cookies * Learn more... (Copy of the Vendor Homepage: http://www.clustrmaps.com/) Abstract Advisory Information: ============================== Vulnerability Lab Team discovered a Cross Site Scripting Vulnerability on ClusterMaps Locator Exchange Banner. Vulnerability Disclosure Timeline: ================================== 2011-07-26: Public or Non-Public Disclosure Discovery Status: ================= Published Affected Product(s): ==================== Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A Cross Site Scripting Vulnerability is detected on the Clustermaps Exchange Banner. A remote attacker is able to execute own javascripts and implement malicious codes on exchange websites (customers) to steal sessions via user interaction. The vulnerability is located in the ?url= parameter which is included on the own website by customers. Attackers can steal sessions through the implemented banner on the customer website. Vulnerable Module(s): [+] Maps / URL Code Review: ClusterMaps Banner Locations http://www3.xxx.com/counter/maps.php?url=[ScriptCode] <==== http://www3.xxx.com/counter/index2.php?url=[ScriptCode] <==== Pictures: ../1.png ../2.png Proof of Concept (PoC): ======================= The vulnerability can be exploited by remote attackers via user interaction. For demonstration ... ClustrMaps - map of visitor locations - zoom map >" is not a ClustrMaps (reg or +) user --- ClustrMaps - map of visitor locations - zoom map >" References: ../PoC/maps.php.htm ../PoC/maps.php2.htm Security Risk: ============== The security risk of the cross site vulnerability is estimated as medium because all customer websites are also vulnerable after include. Credits & Authors: ================== Vulnerability Research Laboratory Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright © 2012 | Vulnerability Laboratory