Messages, Address and Manage Beneficiaries

These updates are applicable for releases - 2021.04, 2021.07, 2021.10, 2022.07, 2022.10, 2023.01, 2023.07, 2023.10.

Description

Issue 1:

XSS - Messages, Address- Retail, business, Android, iOS - JIRA PROD (temenos.com)

It was observed that the "Alerts & Messages" menu in the application is vulnerable to cross-site scripting attacks due to improper input and output sanitization.

The application neither performs adequate input validation nor performs appropriate encoding of user-controlled data prior to rendering the same.

Instance 1:

For instance, it was observed that the endpoint is vulnerable to stored cross-site scripting, as it was possible to inject malicious scripts into the “Compose message” parameter, which gets stored under the messages menu and sent to the spotlight application.

Payloads:

<a"/onclick=(alert)(JSON.stringify(localStorage.getItem('Spotlight')))>Get Spotlight Tokens!
<a"/onclick=(alert)(JSON.stringify(localStorage.getItem('ssoAuth')))>Get ssoAuth!
<a"/onclick=(alert)(JSON.stringify(localStorage.getItem('OnlineBanking')))>Get Buisness Tokens!
<img src=x onerror=document.location="https://google.com">

Sample Affected URLs:

https://temenosupgradetwo.temenos-cloud.net/apps/onlinebanking/#/SecureMessageMA/frmNotificationsAndMessages

Affected Menu:

Alerts & Messages -> New Message

Affected Parameter : messagedescription

Instance 2:

For instance, it was observed that the endpoint is vulnerable to blind cross-site scripting, as it was possible to inject malicious scripts into the 'Address Line 1' and 'Address Line 2' fields, which are stored under the "Personal Details" option and sent to the spotlight application.

Payloads:

<!{}<img src="{}><img src=x onerror=alert(1)//">
<img src=x onerror=document.location="https://google.com">

Affected URL:

https://temenosupgradetwo.temenos-cloud.net/apps/onlinebanking/#/ManageProfileMA/frmAddressSettings

Sample Affected Parameters:

addrLine1
addrLine2

Recommendation

Allow only the alphanumeric "," and "-" characters in the input fields.
Enforce proper input and output encoding mechanisms.

Description

The applications are vulnerable to reflected cross site scripting attacks. The applications neither performs adequate input validation nor performs appropriate encoding of user-controlled data prior to rendering the same.
For instance, it was possible for the authenticated user to inject malicious scripts in the beneficiary search and it is reflected in the web.
Sample Payload :

<!{}<img src="{}><img src=x onerror=alert(1)//">

Affected URL :

https://temenosupgradetwo.temenos-cloud.net/apps/onlinebanking/#/TransfersMA/frmManageBeneficiaries

Affected Component : Payment and Transfers -> Manage Beneficieries -> Search

Affected Parameter : frmManageBeneficiaries_txtSearch

Impact :

Successful exploitation of the cross-site scripting attack can allow execution of arbitrary script code in a user’s browser session in the context of the affected site which may allow stealing cookie based authentication credentials.

Recommendation

The application must perform adequate output encoding (for instance, HTML Encoding) of all user-controlled data prior to presenting / rendering them. The application must also enforce an appropriate character set across all the pages.

The application must also perform adequate input validation prior to accepting the data received from any client.

Solution

Path:

Visualizer/TransfersMA/controllers/desktop/ManageActivitiesUIModule/frmManageBeneficiariesController/frmManageBeneficiariesController.js
Visualizer/CommonsMA/modules/require/CommonUtilities.js
Visualizer/ManageProfileMA/controllers/desktop/SettingsNewUIModule/frmAddNewAddressController/frmAddNewAddressController.js
Visualizer/ManageProfileMA/controllers/desktop/SettingsNewUIModule/frmAddressSettingsController/frmAddressSettingsController.js
Visualizer/ManageProfileMA/controllers/desktop/SettingsNewUIModule/frmEditAddressController/frmEditAddressController.js
Visualizer/SecureMessageMA/controllers/desktop/AlertsMsgsUIModule/frmNotificationsAndMessagesController/frmNotificationsAndMessagesController.js
adminConsole/controllers/desktop/CSRModule/frmCSRController/frmCSRController.js
adminConsole/modules/require/AdminConsoleCommonUtilities.js
adminConsole/modules/Constants.js

Method:

frmManageBeneficiariesController.js

init: function (), onTxtSearchKeyUp

In all the snippets, red indicates removed or modified content, while green indicates added or replaced content.