============================================================================
\nFoofus.net Security Advisory: foofus-20110610
\n============================================================================
\nTitle:\t\tJavascript Injection in Microsoft Lync
\nVersion:\t4.0.7577.0
\nVendor:\t\tMicrosoft
\nRelease Date:\t2010-06-10
\nIssue Status:\tFix available
\n============================================================================<\/p>\n
1. Summary<\/p>\n
Microsoft Lync version 4.0.7577.0 is vulnerable to a javascript injection
\nvulnerability.<\/p>\n
2. Description<\/p>\n
Javascript commands can be stacked within the url in the “reachLocale”
\nvariable in ReachJoin.aspx. Arbitrary javascript can be inserted, with
\nsome restrictions (notably that characters such as “>” will invoke .NET
\nsecurity protections and cause the page to fail to display)<\/p>\n
3. Proof of Concept<\/p>\n
The following URL will load an image in a new window or tab, as well as
\ndisplay an alert with arbitrary content:<\/p>\n
https:\/\/[target]\/Reach\/Client\/WebPages\/ReachJoin.aspx?xml=&&reachLocale
\n=en-us%22;var%20xxx=%22http:\/\/www.foofus.net\/~bede\/foofuslogo.jpg%22;
\nopen%28xxx%29;alert28%22error,%20please%20enable%20popups%20from
\n%20this%20server%20and%20reload%20from%20the%20link%20you%20were
\n%20given%22%29\/\/<\/p>\n
Pop-ups will need to be enabled in order to load a new tab, but this can be
\ncircumvented by social engineering (i.e. a dialog box) or possibly by more
\nclever javascript insertion.<\/p>\n
4. Impact<\/p>\n
Exploiting this attack allows an adversary to inject most types of
\nJavascript into the page and in order to execute client-side attacks or
\nperform social engineering attacks. These attacks can easily be manipulated
\nto compromise a target workstation.<\/p>\n
5. Affected Products<\/p>\n
Only version 4.0.7577.0 has been tested. This vulnerability may exist in
\nother versions.<\/p>\n
6. Solution<\/p>\n
According to Microsoft, the vulnerability can be resolved by updating with
\nthe “update package for Lync Server 2010, Web Components Server: April 2011”
\nat http:\/\/support.microsoft.com\/kb\/2500441<\/p>\n
7. Timetable<\/p>\n
2011-05-31 Advisory written and submitted to Microsoft
\n2011-05-31 Vendor confirms receipt of advisory
\n2011-06-10 Vendor confirms vulnerability, advises availability of patch
\n2011-06-10 Disclosure<\/p>\n
8. Reference<\/p>\n
http:\/\/www.foofus.net\/?p=363<\/p>\n
9. Credits<\/p>\n
bede@foofus.net (Mark Lachniet)<\/p>\n","protected":false},"excerpt":{"rendered":"
============================================================================ Foofus.net Security Advisory: foofus-20110610 ============================================================================ Title: Javascript Injection in Microsoft Lync Version: 4.0.7577.0 Vendor: Microsoft Release Date: 2010-06-10 Issue Status: Fix available ============================================================================ 1. Summary Microsoft Lync version 4.0.7577.0 is vulnerable to a javascript injection vulnerability. 2. Description Javascript commands can be stacked within the url in the “reachLocale” variable in ReachJoin.aspx. Arbitrary javascript […]<\/p>\n","protected":false},"author":7,"featured_media":0,"parent":273,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-372","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages\/372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=372"}],"version-history":[{"count":0,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages\/372\/revisions"}],"up":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages\/273"}],"wp:attachment":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}