Document Title: =============== Skype Manager - (Email Change) Filter Bypass Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1672 MSRC Case 32353 TRK:0001002845 Release Date: ============= 2016-05-09 Vulnerability Laboratory ID (VL-ID): ==================================== 1672 Common Vulnerability Scoring System: ==================================== 5.2 Product & Service Introduction: =============================== Skype is a proprietary voice-over-Internet Protocol service and software application originally created in 2003 by Swedish entrepreneur Niklas Zennström and his Danish partner Janus Friis. It has been owned by Microsoft since 2011. The service allows users to communicate with peers by voice, video, and instant messaging over the Internet. Phone calls may be placed to recipients on the traditional telephone networks. Calls to other users within the Skype service are free of charge, while calls to landline telephones and mobile phones are charged via a debit-based user account system. Skype has also become popular for its additional features, including file transfer, and videoconferencing. Competitors include SIP and H.323-based services, such as Linphone, as well as the Google Talk service, Mumble and Hall.com. Skype has 663 million registered users as of September 2011. The network is operated by Microsoft, which has its Skype division headquarters in Luxembourg. Most of the development team and 44% of the overall employees of the division are situated in Tallinn and Tartu, Estonia. Unlike most other VoIP services, Skype is a hybrid peer-to-peer and client–server system. It makes use of background processing on computers running Skype software. Skype`s original proposed name (Sky Peer-to-Peer) reflects this fact. Some network administrators have banned Skype on corporate, government, home, and education networks, citing reasons such as inappropriate usage of resources, excessive bandwidth usage, and security concerns. (Copy of the Vendor Homepage: http://en.wikipedia.org/wiki/Skype) Abstract Advisory Information: ============================== An independent vulnerability laboratory researcher discovered a hidden function to change unauthorized email accounts of the official Skype Manager web-application. Vulnerability Disclosure Timeline: ================================== 2016-01-19: Researcher Notification & Coordination (Karim Rahal) 2016-01-20: Vendor Notification (MSRC - Skype Security Team) 2016-01-28: Vendor Response/Feedback (MSRC - Skype Security Team) 2016-05-05: Vendor Fix/Patch #(Microsoft Skype Developer Team) 2016-05-09: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Microsoft Corporation Product: Skype Manager - Online Service (Web-Application) 2016 Q1 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A filter bypass vulnerability has been discovered in the official Microsoft Skype Manager online service web-application. The vulnerability allows to bypass a secure set filter restriction of the web-application to deny unauthorized interaction by criminals on account take-over attacks. Filter bypass is a vulnerability which performs evasion on a certain filter and bypasses it, in this case it was able to bypass the filter which didn`t allow a user/attacker to change his email without entering his password etc.. but with this filter bypass you can just change ur email simply through being inside the account, you don`t even have to know the account`s password. This filter bypass is done because there isn`t enough validation/checking inside the API which didn`t check if its his actual email or if he can actually change it, in addition, this vulnerability easily allowed Full account Takeover once exploited, simply a hacker would hack into an account throgh session but he wouldn`t have full access because he doesn`t have the password, but this filter bypass allowed him to change password then send a change password link to the changed email which is his hacking email, and then he resets the password and tadaa! he now has full access to the account. The security risk of the filter bypass vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 5.2. Exploitation of the filter and validation web vulnerability requires a low privileged skype user account with restricted access and low user interaction. Successful exploitation of the vulnerability results in an account take-over one malicious interaction. Proof of Concept (PoC): ======================= The vulnerability can be exploited by remote attackers with low privileged skype web-application user account and low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Go to manager.skype.com 2. Register for a manager company if you haven't already 3. Go to your user/member's settings of your own account 4. Go down to Contact details 5. Right click on your email address >> inspect element 6. Find the link with <input type="hidden" id="personalEmailHidden" name="personal_email" value=""........ 7. Edit value="" to your new email you want to change to (example: value="karim@xxxxxxxxxxxxxx") 8. Click out of the box and make sure the value was set inside the page via inspect element 9. Click Save Changes 10. BamBam! The email has been changed! NOTE: An alternative to the inspect element method is tampering the request once clicking save changes and editing the "personal_email" post value inside the post request to the email you want to change to. PoC Video: How Filter Bypass Changed Email https://www.youtube.com/watch?v=mDvMCOY4wMc How This Filter Bypass Lead to full account takeover: https://www.youtube.com/watch?v=fiJpqOoYDjs Solution - Fix & Patch: ======================= The bug can be fixed by disallowing the use the hidden function to reset an account without usage of the skype password to confirm. Security Risk: ============== The security risk of the unauthorized email change in the skype manager application is estimated as medium. (CVSS 5.2) Changing a Skype users email is leading to a full account takeover finally as far as the conditions do match with the case scenario. Credits & Authors: ================== Karim Rahal [Karim@xxxxxxxxxxxxxx / KarimMTV@xxxxxxxxxxxx] - @KarimMTV Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Contact: admin@xxxxxxxxxxxxxxxxxxxxx - research@xxxxxxxxxxxxxxxxxxxxx - admin@xxxxxxxxxxxxxxxxx Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@xxxxxxxxxxxxxxxxxxxxx or research@xxxxxxxxxxxxxxxxxxxxx) to get a permission. Copyright © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]™ -- VULNERABILITY LABORATORY - RESEARCH TEAM SERVICE: www.vulnerability-lab.com CONTACT: research@xxxxxxxxxxxxxxxxxxxxx
