[Full-disclosure] XSS at Citibank.co.uk

From: Andrew Smtih (andrew.rse_at_gmail.com)
Date: 08/13/05

  • Next message: Matija Vidmar: "Re: [Full-disclosure] bash vulnerability?" 
    Date: Sat, 13 Aug 2005 15:38:40 +0100
To: full-disclosure@lists.grok.org.uk

    Hi Full-Disclosure,
    I'm here to report an XSS vulnerability in one of Citibank's websites.
    I actually found this at a log in screen, but it's on an obscure sub domain
    so I don't beleive that much cookie stealing can be done from it.
    Phishing, however, oh good lord yes. The phishing possbilities for this XSS
    vulnerability are immense (did I mention the site was SSL'd?).

    Anyway, I informed citibank through e-mail (no response), posted it on my
    blog (no response, no fix..) and now I'll post it here.
    I've had luck on FD in contacting BankOfAmerica employees in the past, so
    maybe there are a few Citibank admins listening? Let's hope so.

    Here's the URL:

    https://cukehb4.cd.citibank.co.uk/CappWebApp/capp/action/lang.do?languagecode=1&countrycode=
    GOES HERE>&servicecode=signon&TS=1119807930296

    And here's an outline (+screenshot) for if/when they fix it:

    http://wheresthebeef.co.uk/show.php/xss/citibank.co.uk.html

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Matija Vidmar: "Re: [Full-disclosure] bash vulnerability?"

    Relevant Pages

    • Re: embedded .wmv in IE6 wmp10 problem
      ... Yes your diagnosis is spot on but i still get the error, saved a screenshot ... This posting is provided "AS IS" with no warranties, ... In order to fix this, run the following commands from either the "Run" ...
      (microsoft.public.multimedia.windows.mediaplayer)
    • RE: Remote DNS Issue
      ... Thank you for your response. ... I sent you an email with a screenshot ... is FQDN,A FQDN is a complete DNS name,Fully qualified domain name. ... from your newsreader: microsoft.private.directaccess.partnerfeedback. ...
      (microsoft.public.windows.server.sbs)
    • Re: Screen capture to a PDF?
      ... [in response to stating in regards to changing the file kind resulting ... and several others that let you change the screenshot image ... format in Mac OS X. ... Use a real news client if you want me to see your posts. ...
      (comp.sys.mac.apps)
    • Re: [.30-rc2 regression] garbled screen on video
      ... The only way to fix it is to ... you could revert the patch you ... and enable UXA, ... combined with a screenshot of mesa's readpix ...
      (Linux-Kernel)
    • Re: Will Apple EVER fix Window resizing?????
      ... It is not a "fix", ... same since at least Mac System 7... ... that is *not* a screenshot of System 7. ... mistake. ...
      (comp.sys.mac.advocacy)