Document Title: =============== Microsoft Office 365 Outlook - Persistent Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=857 Microsoft Security Response Center (MSRC) ID: 14093 Microsoft Security Response Center (MSRC) MANAGER: JT Release Date: ============= 2014-04-09 Vulnerability Laboratory ID (VL-ID): ==================================== 857 Common Vulnerability Scoring System: ==================================== 3.3 Product & Service Introduction: =============================== Microsoft Online Services is Microsoft`s hosted-software offering and a component of their software plus services strategy. Microsoft Online Services are hosted by Microsoft and sold `with` Microsoft partners. The suite includes Exchange Online, SharePoint Online, Office Communications Online, Microsoft Forefront, and Microsoft Office Live Meeting. For businesses, the Software-plus-Services approach enables organizations to access the capabilities of enterprise software through on-premises servers, as online services, or a combination of both, depending on specific business requirements. Services also provide the option to add complementary capabilities that enhance on-premises server software and simplify system management and maintenance. (Copy of the Vendor Homepage: https://microsoftonline.com ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered a persistent POST Inject vulnerability in the official Microsoft (cloud-based) Office 365 Application. Vulnerability Disclosure Timeline: ================================== 2013-02-03: Researcher Notification & Coordination (Benjamin Kunz Mejri) 2013-02-06: Vendor Notification (Microsoft Security Response Center Team) 2013-02-07: Vendor Response/Feedback (Microsoft Security Response Center Team) 2014-04-11: Vendor Fix/Patch (Status: by Check) 2014-04-11: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Microsoft Corp. Product: Office 365 (cloud-based) Exploitation Technique: ======================= Remote Severity Level: =============== Low Technical Details & Description: ================================ A persistent POST Inject (input validation) web vulnerability has been discovered in the official Microsoft (cloud-based) Office 365 web-application. The vulnerability allows remote attackers to inject via POST method request own malicious script codes on application-side (persistent) of the affected service. The vulnerability is located in the `Rollen & Überwachung - Administrator Rollen` (AdminRoleGroups.svc) function when processing to request via POST method the `Name - Gruppen/Rollen` module the connected vulnerable `name` list item context. The persistent injected script code occurs in the name profile listing context. The first post method request validates the context of the input and the website process to load the next GET method request for the required context. At least the remote attacker is able to change the vulnerable `name` value in the post method request to manipulate the context and bypass the first validation. The security risk of the vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.3(+)|(-)3.4. Exploitation of the remote web validation vulnerability requires a low privileged application user account and low or medium user interaction. Successful exploitation of the vulnerability result in persistent session hijacking, persistent phishing, external redirect, external malware loads and persistent vulnerable module context manipulation. Vulnerable Section(s): [+] Microsoft - Office 365 (cloud-based) Vulnerable Module(s): [+] Rollen & Überwachung - Administrator Rollen (EditAdminRoleGroup.aspx & NewAdminRoleGroup.aspx) Vulnerable Parameter(s): [+] Name - Gruppen/Rollen Affected Module(s): [+] Rollen Gruppe Name - Listing (default.aspx) Proof of Concept (PoC): ======================= The persistent POST Inject web vulnerability can be exploited by remote attackers with low privileged application user account and low or medium user interaction. For security demonstration or to reproduce the persistent validation web vulnerability follow the provided information and steps below to continue. Parsed/encoded via Get after the first POST Injection when processing to load standard iframes and script codes {"properties":{"Name":"