Print Page - Bittrex vuln in IP whitelist - ticket open since 3 months

Vulnerability description :

When you are logging from a new IP, Bittrex send you an email asking you to confirme the new IP.
If you are not using 2FA, someone knowing your password can bypass this IP whitelist and thus connect to your account.

Technical informations :

IP is not correctly sanitized in the email sent by Bittrex.
When connecting to bittrex, the X-Forwarded-For header is not sanitized.

To replicate the issue, here is a POC. Set the following rule in Fiddler :

Code:

if(oSession.HostnameIs("bittrex.com")){
	oSession.oRequest["X-Forwarded-For"] = "<style>a{visibility: hidden;}</style>";
}

Then, in the Bittrex mail, it will display the following instead of the IP: "<style>a{visibility: hidden;}</style>", x.x.x.x allowing you to change the style in the mail.
With css3 and selectors, it is then possible to extract the secret token to a domain you control when the user is viewing the mail, allowing you to validate the new IP. (See how to with Stealing the Pie Without Touching the Sill (https://www.nds.rub.de/media/emma/veroeffentlichungen/2012/08/16/scriptlessAttacks-ccs2012.pdf))

Timeline :

During all the process, I have also been raising the ticket through the customer support channel on slack multiple time.

August 17 : vulnerability identified
August 18 : vulnerability reported in ticket #167335
August 27 : ticket reminder
September 1 : aknowledgement from Bittrex
September 2 : Ticket assigned to Bill
September 8 : Asking for status - no answer
October 8 : Asking for status - no answer
November 6 : Patched in dev
November 8 : Fix pushed in production

Vuln has been patched.

Edited timeline to match the following :

November 6 :

Quote

Thank you for reporting this issue to us.
Our security team has been able to reproduce your issue and a fix has been checked in.
You will see the fix in the next deployment to our production environment

November 8 :

Quote

Fix has been pushed to production. If you find anything else, feel free to message me on Slack.

Bitcoin Forum

Alternate cryptocurrencies => Service Discussion (Altcoins) => Topic started by: Xavier59 on November 05, 2017, 01:04:57 PM