|
Of course... What made me think of a inside-job, is that this page (address) is can not be revealed scanning the site... it is a page should be only know to someone who saw the server...
"The only place where Success comes before Work is in the dictionary." Vidal Sassoon, 1928 - 2012
|
|
|
|
|
It would certainly be interesting to find out what is going on.
I navigated to the /learn/signin-cima page which then loads a blank page.
(CIMA could be the Chartered Institute of Management Accountants)
“That which can be asserted without evidence, can be dismissed without evidence.”
― Christopher Hitchens
|
|
|
|
|
GuyThiebaut wrote: I navigated to the /learn/signin-cima page which then loads a blank page.
I played with the parameters, and found that the value of code is irrelevant (but must be present), while state not only have to be there, but also have to have that exact value to do the actual redirection...
"The only place where Success comes before Work is in the dictionary." Vidal Sassoon, 1928 - 2012
|
|
|
|
|
The state value is 32 bytes long so I am going to take a guess that it is a 32 byte hash.
“That which can be asserted without evidence, can be dismissed without evidence.”
― Christopher Hitchens
|
|
|
|
|
Nope,
It is just a coincidence that the state string length is 32 bytes long. It's simply a UTF-8 base64 encoded URL being passed to a CGI script. With a little investigating I see that you can pass any URL to the script and it will send back a location header redirecting the browser.
This will redirect you back to codeproject.com:
https://www.xfinity.com/learn/signin-cima?code=0.ac.jHKtzD&state=aHR0cHM6Ly93d3cuY29kZXByb2plY3QuY29t
This should be reported to Security Vulnerability Report[^]
Best Wishes,
-David Delaune
|
|
|
|
|
Randor wrote: It's simply a UTF-8 base64 encoded URL being passed to a CGI script
That's explain why randomly changing state, was useless...
"The only place where Success comes before Work is in the dictionary." Vidal Sassoon, 1928 - 2012
|
|
|
|
|
Nice work 
“That which can be asserted without evidence, can be dismissed without evidence.”
― Christopher Hitchens
|
|
|
|
|
Thanks,
I only spent 5-10 minutes of looking into it. What's interesting is that even the domain name of "feellixs" seems to be very well designed. The hamming distance from netflix... it seems to be chosen to pass through a Bayes classifier undetected.
Best Wishes,
-David Delaune
|
|
|
|
|
You're welcome, as someone who works as a 'full stack' developer(I sigh using that term) it's always good to learn from others and discover where security vulnerabilities exist on sites.
Given what you have discovered it sounds like very poor webdesign to redirect to a site not on the hosting domain based on a parameter in the header.
“That which can be asserted without evidence, can be dismissed without evidence.”
― Christopher Hitchens
|
|
|
|
|
Thank you David, I have reported it. 
The difficult we do right away...
...the impossible takes slightly longer.
|
|
|
|
|
You are welcome.
If you get a reward for reporting the vulnerability please consider donating a portion of that to a charity of your choice.
Best Wishes,
-David Delaune
|
|
|
|
|
M.D.V. 
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
Curious to know if they contact you or close the bug
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
My money is on a cease-and-desist letter. The larger the company, the more I'd put on that bet.
|
|
|
|
|
I'll post the resolution once it happens.
The difficult we do right away...
...the impossible takes slightly longer.
|
|
|
|
|
Richard Andrew x64 wrote: aHR0cHM6Ly9mZWVsbGl4cy5jb20vP2Jz
contains information that decodes into https://feellixs.com/?bs
Looks like they are fishing for your Netflix password.
3307501017[^]
3307500963[^]
Domain is 1 day old. Certificates are also 1 day old.
Best Wishes,
-David Delaune
P.S.
It's not an accident that the site went live on a Saturday. They are taking advantage of the fact that the network operations is closed and minimally staffed over the weekend. Unfortunately they will get a full 48 hours of fishing for Netflix password before being shut down on Monday.
modified 30-Aug-20 5:28am.
|
|
|
|
|
Interestingly - and espite it's being a new registration - Chrome and Firefox blocks this page...
It is actually try to mimic Netflix login page (I can see it on Edge)... Which should be more than suspicious, as the original mail is from the ISP, so how it landed you on Netflix...
"The only place where Success comes before Work is in the dictionary." Vidal Sassoon, 1928 - 2012
|
|
|
|
|
Well,
Most e-mail providers filter out SPAM links. I am guessing that https://www.xfinity.com/* is white listed and that's the core value of this vulnerability. Since @Richard-Andrew-x64 is a customer he should report this to the Comcast Security team.
Security Vulnerability Report[^]
Best Wishes,
-David Delaune
|
|
|
|
|
How on Earth did you figure out what that decodes to? ![Java | [Coffee]](https://www.codeproject.com/script/Forums/Images/coffee.gif)
The difficult we do right away...
...the impossible takes slightly longer.
|
|
|
|
|
Good to see that when browsing from my work right now (may not matter that there are filters the average surfer wouldn't have because it seems to be a Chrome thing) I see the following screen with a bright red background from Chrome:
Deceptive site ahead
Attackers on feellixs.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone numbers, or credit cards). Learn more
Help improve security on the web for everyone by sending URLs of some pages you visit, limited system information, and some page content to Google. Privacy policy
Google Safe Browsing recently detected phishing on feellixs.com. Phishing sites pretend to be other websites to trick you.
You can report a detection problem or, if you understand the risks to your security, visit this unsafe site.
|
|
|
|
|
Richard Andrew x64 wrote: OK I figured it out. This is the complete scam link:
...
You might notice that it very well hides the actual target domain name. That is ".ac" for the Ascension Islands.
That's not correct. The link goes to the xfinity domain; there's just an open redirection vulnerability on that page.
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
Sign-on pages typically take as a parameter the URL of the page to return to, after the sign-in is complete. The "learn" is there suggests that it's from the sites help pages. And that section may auto-log you in, based on your cookies (Xfinity's login page does have a "Stay signed in" option).
So, you go to that page, it logins you in, and then "returns" to the page it assumes you were on when you click "Sign in".
Truth,
James
|
|
|
|
|
Thanks for that information. I wasn't sure how it worked.
The difficult we do right away...
...the impossible takes slightly longer.
|
|
|
|
|
I see an enormous number of jobs asking for full stack developers.
Is that their way of saying that the developer will be asked to produce more than one person possibly can?
It seems to me so because I think companies want to save on IT costs.
The difficult we do right away...
...the impossible takes slightly longer.
|
|
|
|
|
A full stack is just one step away from stack overflow, so it's their way of saying that they are looking for cheap developers that can barely ask a question online.
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
