Posted on

5 Popular Web Hosting Services Found Vulnerable to Multiple Flaws

best web hosting security

A security researcher has discovered multiple one-click client-side vulnerabilities in the some of the world’s most popular and widely-used web hosting companies that could have put millions of their customers as well as billions of their sites’ visitors at risk of hacking.

Independent researcher and bug-hunter Paulos Yibelo, who shared his new research with The Hacker News, discovered roughly a dozen serious security vulnerabilities in Bluehost, Dreamhost, HostGator, OVH, and iPage, which amounts to roughly seven million domains.

Some of the vulnerabilities are so simple to execute as they require attackers to trick victims into clicking on a simple link or visiting a malicious website to easily take over the accounts of anyone using the affected web hosting providers.

Critical Flaws Reported in Popular Web Hosting Services

Yibelo tested all the below-listed vulnerabilities on all five web hosting platforms and found several account takeover, cross-scripting, and information disclosure vulnerabilities, which he

documented

on the Website Planet blog.

1. Bluehost—the company owned by Endurance which also owns Hostgator and iPage, and in total, the three hosting providers powers more than 2 million sites around the world. Bluehost was found vulnerable to:

  • Information leakage through cross-origin-resource-sharing (CORS) misconfigurations
  • Account takeover due to improper JSON request validation CSRF
  • A Man-in-the-middle attack can be performed due to improper validation of CORS scheme
  • Cross-site scripting flaw on my.bluehost.com allows account takeover (demonstrated in a proof-of-concept, below)

2. Dreamhost

—the hosting provider that powers one million domains was found vulnerable to:

  • Account takeover using cross-site scripting (XSS) flaw

3. HostGator

  • Site-wide CSRF protection bypass allows complete control
  • Multiple CORS misconfigurations leading to information leak and CRLF

4. OVH Hosting

—the company that alone powers four million domains around the world was found vulnerable to:

  • CSRF protection bypass
  • API misconfigurations

5. iPage Hosting

  • Account takeover flaw
  • Multiple Content Security Policy (CSP) bypasses

Video Demonstrations

Talking to The Hacker News, Yibelo said he took about an hour on each of the five web hosting platforms on an average to find at least one account takeover-related client-side vulnerability, mostly using the Burp Suite, a web application security testing tool, and Firefox browser plugins.

“They mostly focus on protecting the wrong assets, but most of them have medium security standards for their user profile portals and data exfiltration vulnerability classes. Most of their protections are easily bypassable using lesser-known tricks,” Yibelo told The Hacker News.

Among the affected hosting companies, Yibelo found Bluehost, HostGator and iPage to be the easiest ones to hack into, though he told The Hacker News that HostGator included “multiple layers of security checks (that can be bypassed, but they are there, unlike the other sites).”

Yibelo reported his findings to the affected web hosting providers, all except OVH patched their services before the information went public yesterday. OVH has yet to confirm and response on the researcher’s findings.

Read the Full Article here: >The Hacker News [ THN ]

Posted on

Flight Booking System Flaw Affected Customers of 141 Airlines Worldwide

Almost half of the fight travelers around the world were found exposed to a critical security vulnerability discovered in online flight ticket booking system that allowed remote hackers to access and modify their travel details and even claim their frequent flyer miles.

Israeli network security researcher Noam Rotem discovered the vulnerability when he booked a flight on the Israeli airline ELAL, successful exploitation of which just required victim’s PNR (Passenger Name Record) number.

The vulnerability resided in the widely used online flight booking system developed by Amadeus, which is currently being used by nearly 141 international airlines, including United Airlines, Lufthansa and Air Canada.

After booking a flight with ELAL, the traveler receives a PNR number and a unique link that allows customers to check their booking status and related information associated with that PNR.

Rotem found that merely by changing the value of the “RULE_SOURCE_1_ID” parameter on that link to someone else’s PNR number would display personal and booking-related information from the account associated with that customer.

Using disclosed information, i.e. booking ID and last name of the customer, an attacker can simply access the victim’s account on

ELAL’s customer portal

and “make changes, claim frequent flyer miles to a personal account, assign seats and meals, and update the customer’s email and phone number, which could then be used to cancel/change flight reservation via customer service.”

“Though the security breach requires knowledge of the PNR code, ELAL sends these codes via unencrypted email, and many people even share them on Facebook or Instagram. But that’s just the tip of the iceberg,” the researcher said in his blog post.

Don’t have PNR numbers of your victims? Don’t worry.

Rotem also figured out that the Amadeus portal was not using any brute-force protection that eventually allowed attackers to attempt every alphanumeric uppercase complications using a script, as shown, to find all active PNR numbers of customers of any Amadeus-linked airline website.

“After running a small and non-threatening script to check for any brute-force protections, none of which were found, we were able to find PNRs of random customers, which included all of their personal information,” Rotem added.

You can see the video demonstration provided by the researcher to know how a simple script devised by him guessed the PNR numbers and was able to find active numbers in Amadeus.

Since the Amadeus booking system is being used by at least 141 airlines, the vulnerability could have affected hundreds of millions of travelers.

After discovering the vulnerability, Rotem immediately contacted ELAL to point out the threat and suggested the airline to introduce captchas, passwords and a bot protection mechanism in order to prevent brute-force attempts.

Amadeus has now fixed the issue, and the Rotem’s script can no longer identify active PNRs as demonstrated in the above video.

Upon contacting Amadeus, the company replied, “At Amadeus, we give security the highest priority and are constantly monitoring and updating our systems. Our technical teams took immediate action, and we can now confirm that the issue is solved.”

Amadeus also added that the company has also added a Recovery PTR to strengthen security further and “prevent a malicious user from accessing travelers’ personal information.”

Read the Full Article here: >The Hacker News [ THN ]