Exploit-DB #34981
Description: Indeed Job Search 2.5 iOS API - Multiple Vulnerabilities
Type: webapps
Platform: ios
Date: 2014-10-15
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
Indeed Job Search 2.5 iOS API - Multiple Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1303


Release Date:
=============
2014-10-13


Vulnerability Laboratory ID (VL-ID):
====================================
1303


Common Vulnerability Scoring System:
====================================
3.6


Product & Service Introduction:
===============================
Find jobs using Indeed, the most comprehensive search engine for jobs. In a single search, Indeed offers free access to millions of jobs from thousands of 
company websites and job boards. From search to apply, Indeed’s Job Search app helps you through the entire process of finding a new job. Since 2004, Indeed 
has given job seekers free access to millions of jobs from thousands of company websites and job boards. As the leading pay-for-performance recruitment 
advertising network, Indeed drives millions of targeted applicants to jobs in every field and is the most cost-effective source of candidates for thousands 
of companies. We take our security very seriously and welcome any responsible disclosure of potential gaps in our systems.

(Copy of the Homepage: https://itunes.apple.com/us/app/job-search/id309735670 )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official Indeed.com `Job Search` v2.5 mobile web-application (api).


Vulnerability Disclosure Timeline:
==================================
2014-10-13: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Indeed.com (Bug Bounty)
Product: Job Search - Mobile Application API 2.5


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
1.1
A persistent input validation web vulnerability has been discovered in the official Indeed.com `Job Search` v2.5 mobile web-application (api).
The persistent vulnerability allows an attacker to inject own script codes on the application-side of the vulnerable online-service module.

The vulnerability is located in the main job search input field of `Was Stichwort, Jobtitel oder Unternehmen` and `Wo Ort, Bundesland oder Postleitzahl`.
A local low privileged user account is able to inject script codes by usage of the regular search `Jobs finden` button. The injection request runs through 
the mobile api and is not parsed or encoded. The attacker injects his code to the input field and can execute the code in the results page through the mobile api.
The first execution occurs on the client-side of the application.

After the first search request, the application remembers the strings and saved the information (application-side). The already injected client-side request with 
the malicious code changes to the application-side attack because of the stored db context in the user profile. During the test we used js, html tags and php code 
to exploit the issue and verify. The input executes frames, images and script code in the results page on the header were the vulnerable `stichwort` and `ort` 
values are located. The input of the search and also the input of the stored information can be reviewed in the backend whichs needs to be verified by an higher 
privileged indeed account.

The security risk of the vulnerabilities are estimated as medium with a cvss (common vulnerability scoring system) count of 3.9. Exploitation of the security issue 
requires low user inter action & a registered low privileged mobile web application user account. Successful exploitation of the security vulnerability results in 
session hijacking (user/manager/admin), persistent phishing, persistent external redirects or persistent manipulation of affected or connected module context.


Vulnerable Application(s):
				[+] Indeed.com - Job Search v2.5 iOS Mobile Application (API)

Request Method(s):
				[+] POST

Vulnerable Module(s):
				[+] Was Stichwort, Jobtitel oder Unternehmen
				[+] Wo Ort, Bundesland oder Postleitzahl

Affected Module(s):
				[+] Job Search Results
				[+] History - Vorherige Job suchen


1.2
A client-side cross site scripting vulnerability has been discovered in the official Indeed.com `Job Search` v2.5 mobile web-application (api).
The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions informaton by client-side cross site scripting requests.

The vulnerability is located in the `Empfänger` input of the `Job Suche > Wähle Job Angebot` module. Local low privileged user accounts are able to inject 
script codes to the empfänger input field of the iOS application. The result is a client-side script code execution in the context of the main job result 
next to the page bottom. The attack vector is non persistent and the method to inject the malicious code is POST.  During the test we used js, html tags 
and php code to exploit the issue and verify. The execution of the injected code occurs directly after the request through the api at the bottom of the job 
article page next to the vulnerable `Empfänger` input.

The security risk of the vulnerability is estimated as medium  with a cvss (common vulnerability scoring system) count of 3.6. Exploitation of the security 
issue requires low user inter action and no privileged mobile web application user account. Successful exploitation of the security vulnerability results in 
session hijacking (user/manager/admin), non-persistent phishing, non-persistent external redirects or client-side manipulation of affected or connected module context.

Vulnerable Application(s):
				[+] Indeed.com - Job Search v2.5 iOS Mobile Application (API)

Request Method(s):
				[+]