Starbucks · Report #244504
Possible SOP bypass in www.starbucks.com due to insecure crossdomain.xml
Summary
Ah, my early reports. I've come quite a ways from reporting things before I understood exactly what they were. Nonetheless I got pretty creative here and recognized that a problem existed in this configuration, one that turned out to be a high impact problem. For web developers: always keep your crossdomain.xml allowed domains up to date if you have something other than wildcard allowed! Thank you to the Starbucks team for an efficient and helpful response.
How it was found
Hello. I was penetration testing your website, and noticed that your crossdomain.xml file allowed many sites access. I went through and, for all the sites that had *.website.com with them, I scanned them for subdomains.
I found that a subdomain for ███████.com (a site in your crossdomain.xml as *███████), m███████, was vulnerable to takeover.
I'm not going to take it over since they do not have a white hat hacker program, but if someone were to take it over, they could make flash files on it to retrieve sensitive information from starbucks.com, and do it with no issue. Another factor that makes it even worse is that it's possible to use any headers also (<allow-http-request-headers-from domain="*" headers="*"/>).
It's similar to if your site had this line in the crossdomain.xml: <allow-access-from domain="*" />
SCENARIO: This is a scenario of how it would most likely be exploited
- A black hat is trying to hack into Starbucks
- He goes to the crossdomain.xml file looking for <allow-access-from domain="*" />, but he notices lots of different websites are allowed access
- He decides to check the domains with *. before them for vulnerable subdomains
- He finds m██████, and notices *███████ has access
- He takes over m██████ and uploads a malicious flash file to send HTTP requests and see their responses.
HOW TO FIX THIS Pretty simple, obvious fix, but you have two routes you can take for it. First option: You can just remove <allow-access-from domain="*████████" /> from your crossdomain.xml file. (I didn't find any other subdomains vulnerable to takeover that were in there)
Second option: You can talk to ███████, the company that owns █████.com, and tell them to disconnect the DNS records linking m████████ and m██████.███
MORE INFORMATION Here is more information on how it could be exploited: http://resources.infosecinstitute.com/bypassing-csrf-protections-fun-profit/ (read between Abusing CORS via Flash Files down to Bypassing XMLHttpRequest Header Validation)
Thanks, Jack