Document Title:
===============
Marketo Cloud - Persistent Mail Encoding Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1321
Release Date:
=============
2015-01-13
Vulnerability Laboratory ID (VL-ID):
====================================
1321
Common Vulnerability Scoring System:
====================================
3.5
Product & Service Introduction:
===============================
Marketo Inc. makes marketing automation software for companies. In 2012, Marketo was ranked 78th on the Inc. 500, #7 among software
companies, and #1 among marketing software companies.
(Copy of the Homepage: http://en.wikipedia.org/wiki/Marketo )
Norse is the global leader in live attack intelligence. Norse delivers continuously-updated and unique Internet and darknet intel
that helps organizations detect and block attacks that other systems miss. The superior Norse DarkMatter™ platform detects new
threats and tags nascent hazards long before they`re spotted by traditional `threat intelligence` tools. Norse`s globally
distributed `distant early warning` grid of millions of sensors, honeypots, crawlers and agents deliver unique visibility into
the Internet - especially the darknets, where bad actors operate. The Norse DarkMatter™ network processes hundreds of terabytes
daily and computes over 1,500 distinct risk factors, live, for millions of IP addresses every day. Norse products tightly
integrate with popular SIEM, IPS and next-generation Firewall products to dramatically improve the performance, catch-rate
and security return-on-investment of your existing infrastructure.
( Copy of the Vendor Homepage: http://www.norse-corp.com/about.html )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a persistent mail encoding web vulnerability in the official Marketo cloud online-service web-application.
Vulnerability Disclosure Timeline:
==================================
2014-09-09: Researcher Notification & Coordination (Benjamin Kunz Mejri)
2014-09-10: Vendor Notification (Norse-Corp)
2014-09-12: Vendor Response/Feedback (Norse-Corp informs Marketo)
2014-**-**: Vendor Fix/Patch Notification (Barracuda Networks - Developer Team)
2015-01-13: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Norse Corp
Product: Norse Corp - Web Application (Online Service) 2014 Q3
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Low
Technical Details & Description:
================================
A persistent mail encoding web vulnerability has been discovered in the official Marketo cloud online-service web-application.
The vulnerability allows an remote attacker to inject own malicious script codes on the application-side of the vulnerable
web-application online-service.
The vulnerability is located in the web input form of the marketo demo registration (request_demo.html) module. Remote attackers
are able to register a request with persistent script code in the first- & lastname values. The affect becomes visible in the outgoing email
of the customers web-server and could maybe affect other sections in the later registered profile. The attacker injects a payload and streams
the malicious mail with own content to another target user email. The filter of the web-server is not validating the context of the mail on input
through the website. The result is an application-side script code execution in the mail header after the introduction user word. The mail includes
the registered user (db stored) with the payload context and does not encode the input.
The wrong encoded cloud forms are located in a lot of famous websites like norse-corp, samsung, intel, canon, citrix, cropcam, enterasys, f5,
kaspersky, sandisk, sony and panasonic. The fail is not the customer who implements because of the input restrictions are being processed through
the cloud stored form in the marketo service. The encoding of the web-server does not encode the input and returns the data with the wrong conditions.
The security risk of the persistent input validation web vulnerability in the mail encoding of the web-server is estimated as medium with a cvss
(common vulnerability scoring system) count of 3.9. Exploitation of the mail encoding and web-server validation vulnerability requires low or medium
user interaction and no privileged customer application user account. Successful exploitation of the persistent mail encoding web vulnerability results
in session hijacking, persistent phishing attacks, persistent redirects to external malicious source and persistent manipulation of affected or connected
module context.
Request Method(s):
[+] POST
Vulnerable Module(s):
[+] request_demo.html
Vulnerable Parameter(s):
[+] Firstname
[+] Lastname
Affected Module(s):
[+] Marketo Notification Mail Service
Proof of Concept (PoC):
=======================
The persistent mail encoding web vulnerbaility can be exploited by remote attackers without privileged application user account and with low interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
Googel Dork(s): (exp. allinurl:leadCapture/save)
https://encrypted.google.com/#q=allinurl%3AleadCapture%2Fsave&filter=0
Manual steps to reproduce the security vulnerability through norsecorp ...
1. Open your browser and surf to the customer website (http://www.norse-corp.com/)
2. Click the `Request a Demo` button on top of the web-application service
3. Now, include as firstname and lastname a script code with malicious test payload and include a random target user mail (test own!)
4. Save the settings by a click on the send message button in the form
Note: The server saved the POST method request values in the application database with processing to filter
5. The service sends a mail as notification to invite the customer to the demo online-service
Note: The reply goes back to the target mail by the main info@norse-corp.com postbox
6. The execution of the injected script code occurs in the outgoing notification mail next to the introduction context word `Hi`
7. Successful reproduce of the security vulnerability!
PoC: (Example Exploit Code) Norse Corp Service Mail (info@norse-corp.com)
Thank You for Contacting Us!