You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
36914,platforms/php/webapps/36914.txt,"Fork CMS 3.2.x Multiple Cross Site Scripting and HTML Injection Vulnerabilities",2012-03-06,"Gjoko Krstic",php,webapps,0
36917,platforms/php/webapps/36917.txt,"OSClass 2.3.x Directory Traversal and Arbitrary File Upload Vulnerabilities",2012-03-07,"Filippo Cavallarin",php,webapps,0
33296
33301
36909,platforms/windows/local/36909.rb,"RM Downloader 2.7.5.400 - Local Buffer Overflow (MSF)",2015-05-04,"TUNISIAN CYBER",windows,local,0
33297
33302
36910,platforms/php/webapps/36910.txt,"Open Realty 2.5.x 'select_users_template' Parameter Local File Include Vulnerability",2012-03-05,"Aung Khant",php,webapps,0
Grindr, which first launched in 2009, has exploded into the largest and most popular all-male location-based social network out there.
29
+
With more than 5 million guys in 192 countries around the world -- and approximately 10,000 more new users downloading the app
30
+
every day -- you’ll always find a new date, buddy, or friend on Grindr. Grindr is a simple app that uses your mobile device’s
31
+
location-based services to show you the guys closest to you who are also on Grindr. How much of your info they see is
32
+
entirely your call.
33
+
34
+
(Copy of the Vendor Homepage: http://grindr.com/learn-more )
35
+
36
+
37
+
Abstract Advisory Information:
38
+
==============================
39
+
The Vulnerability Laboratory Research Team discovered a local and remote denial of servie vulnerability in the official Grindr v2.1.1 iOS mobile web-application.
2015-04-01: Vendor Fix/Patch (Grindr Developer Team - Reward: x & Manager: x)
48
+
2015-05-04: Public Disclosure (Vulnerability Laboratory)
49
+
50
+
51
+
Discovery Status:
52
+
=================
53
+
Published
54
+
55
+
56
+
Affected Product(s):
57
+
====================
58
+
Grindr LLC
59
+
Product: Grinder - iOS Mobile Web Application (API) 2.2.1
60
+
61
+
62
+
Exploitation Technique:
63
+
=======================
64
+
Remote
65
+
66
+
67
+
Severity Level:
68
+
===============
69
+
Medium
70
+
71
+
72
+
Technical Details & Description:
73
+
================================
74
+
A local and remote Denial of Service vulnerability has been discovered in the official Grindr v2.1.1 iOS mobile web-application.
75
+
76
+
The attacker injects a script code tag or multiple termination strings (%00%20%00%20%00) to the Display Name input field of the Edit Profile module.
77
+
After the inject the service stored the malicious values as DisplayName. After the inject a random user is processing to click in the profile the
78
+
contact information (facebook/twitter). After that the victim wants to copy the link and an internal service corruption occurs thats crashs the mobile app.
79
+
The issue is local and remote exploitable.
80
+
81
+
Vulnerable Module(s):
82
+
[+] Edit Profile
83
+
84
+
Vulnerable Parameter(s): (Input)
85
+
[+] Display Name
86
+
87
+
Affected Module(s):
88
+
[+] Contact > Social Network > Copy Link
89
+
90
+
91
+
92
+
Proof of Concept (PoC):
93
+
=======================
94
+
The denial of service web vulnerability can be exploited by remote attacker and local user accounts with low user interaction (click).
95
+
To demonstrate the vulnerability or to reproduce the issue follow the provided information and steps below to continue.
96
+
97
+
Manual steps to reproduce ...
98
+
1. Open the grindr mobile application
99
+
2. Inject a script code tag as Display Name or use the terminated String with empty values
100
+
3. Save and click in the profile the contact button (exp. facebook)
101
+
4. Click to the send button ahead and push the Copy Link function
102
+
5. The app service is getting terminated with an uncaught exception because of an internal parsing error
103
+
104
+
Note:To exploit the issue remotly the profile needs to be shared with another user and then the user only needs to push the same way the social contact button.
105
+
106
+
PoC Video:
107
+
108
+
109
+
Solution - Fix & Patch:
110
+
=======================
111
+
First step is to prevent the issue by a secure restriction of the input. Attach a own excpetion-handling to prevent next to the insert itself.
112
+
The social network accounts that are linked do not allow special chars in the username. The grindr ios app and the android app allows to register
113
+
an account and to insert own scripts <html5> or null strings that corrupts the process of copy the link by an error. After the restriction has been
114
+
set in the code of both (api) the issue can not anymore execute to shutdown anothers users account. Even if this issue execution is prevented that
115
+
was only a solution to prevent.
116
+
117
+
To fix the bug ...
118
+
Connect for example ios device with the running app to windows. Sync the process and reproduce the remote error and local error. Move to the iOS error
119
+
folder that has been synced. Get the error attach another debugger and so on ...
120
+
121
+
122
+
Security Risk:
123
+
==============
124
+
The secuirty risk of the local and remote denial of service vulnerability in the copy link function that corrupts is estimated as medium.
125
+
126
+
127
+
Credits & Authors:
128
+
==================
129
+
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
130
+
131
+
132
+
Disclaimer & Information:
133
+
=========================
134
+
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
135
+
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
136
+
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
137
+
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
138
+
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
139
+
policies, deface websites, hack into databases or trade with fraud/stolen material.
0 commit comments