Multiple vulnerabilities in Zyncro social network

Antecedentes

Zyncro is a document collaboration platform for enterprise-level sending, sharing, and syncing, designed to facilitate synchronization and sharing within a company.

Description

The product has at least the following vulnerabilities: SQL injection, which exploits a flaw in the database layer when user input is not properly filtered; persistent Cross-Site Scripting, in which the attacker's data is stored on the server and displayed to other users without HTML escaping; and credentials transmitted via cookie, as the email and password used by the user to log in to the application can be retrieved.

Business impact

The impact depends on each vulnerability. The worst-case scenario is the exposure of all database data through a blind SQL injection, which can be used to read arbitrary messages, including private ones. Another critical scenario combines persistent XSS with the _auth cookie to send it to a server controlled by the attacker: the credentials are obtained in plain text (by decoding base64 three times), and the application can be accessed as the victim.

Affected systems

All versions of Zyncro: www.zyncro.com (main site) and my.zyncro.com (demo platform).

Solución

Sanitize all user-submitted data before and after decoding it to prevent SQL injection; sanitize data sent to the user to prevent XSS; and redesign authentication so that the email and password are not stored in the cookie.

Calendario de divulgación

References

The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.