Document Title: =============== PGP Website - Multiple Cross Site Scripting Vulnerabilities Release Date: ============= 2011-07-16 Vulnerability Laboratory ID (VL-ID): ==================================== 95 Product & Service Introduction: =============================== PGP Corporation is a global leader in email and data encryption software for Enterprise Data Protection. Based on a unified key management and policy infrastructure, the PGP® Encryption Platform offers the broadest set of integrated applications for enterprise data security. PGP® platform-enabled applications allow organizations to meet current needs and expand as security requirements change for email, laptops, desktops, instant messaging, smartphones, network storage, file transfers, automated processes, and backups. PGP® encryption solutions have earned a reputation for innovative, standards-based, trusted solutions currently used by more than 110,000 enterprises, businesses, and governments worldwide, including 96 percent of the Fortune® 100, 74 percent of Fortune® Global 100, 80 percent of the German DAX Index and 71 percent of the United Kingdom FTSE 100 Index. Customers depend on PGP solutions as part of a regulatory and audit compliance solution, to protect confidential information, secure customer data, and safeguard companies brands and reputations ... (Copy of the Vendor Homepage: http://pgp.com/) Abstract Advisory Information: ============================== Vulnerability-Lab Team discovered multiple Cross Site Scripting Vulnerabilities on the PGP.Com website. Vulnerability Disclosure Timeline: ================================== 2011-07-15: Public or Non-Public Disclosure Discovery Status: ================= Published Affected Product(s): ==================== Exploitation Technique: ======================= Remote Severity Level: =============== Low Technical Details & Description: ================================ Multiple client-side cross site scripting vulnerabilities are detected on the PGP main website. The type of vulnerability allows an attacker to phish accounts & hijack not expired customer sessions. The vulnerability allows also to force client-side ssl certificate requests as a bypass. Vulnerable Module(s): [+] Search Engine Output [+] adirect - ?cmd= param [+] Exception-handling Pictures: ../pgp.com.png ../pgp.com2.png ../pgp.com3.png ../pgp.com4.png ../pgp.com5.png Proof of Concept (PoC): ======================= The vulnerabilities can be exploited by remote attackers on client-side. The scenario requires high user inter action. For demonstration or reproduce ... Path: https://eu.store.pgp.com/pgp/en/US/adirect/pgp Param: ?cmd= Reference: https://eu.store.pgp.com/pgp/en/US/adirect/pgp?cmd=>"&AddToCartProductID=200010 https://eu.store.pgp.com/pgp/en/US/adirect/pgp?cmd=>"&AddToCartProductID=200010 Path: http://www.pgp.com/search?q= Param: ?q= Reference: http://www.pgp.com/search?q=>"&restrict=newstore&site= pgp&output=xml_no_dtd&client=pgp&lr=&proxystylesheet=pgp&oe= Exception-handling exploitation also possible ...