Reflected XSS in Rukovoditel CRM Zadarma API Enables Account Hijack

Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) issue in Rukovoditel CRM version 3.6.4 and earlier, specifically in the Zadarma telephony API endpoint (/api/tel/zadarma.php).

The application takes user input from the 'zd_echo' GET parameter and directly outputs it in the HTTP response without sanitizing or encoding it properly.

An attacker can craft a malicious URL containing JavaScript code in this parameter. When a victim clicks the link, the malicious script runs in their browser within the context of the application.

This can lead to harmful actions such as session hijacking, stealing credentials, phishing attacks, or even account takeover.

The issue is fixed in version 3.7 by adding proper input validation and output encoding to prevent script injection.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the application reflects the 'zd_echo' GET parameter directly in the HTTP response without sanitization.

One way to test this is to send a crafted HTTP request to the vulnerable endpoint and observe if the input is reflected in the response.

• Use curl to send a request with a test script payload: curl -i "http://<target>/api/tel/zadarma.php?zd_echo=<script>alert(1)</script>"
• Check the HTTP response for the presence of the injected script tag without encoding or sanitization.

If the script is reflected and executed in a browser, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow attackers to execute malicious scripts in the victim's browser when they visit a crafted URL.

• Session hijacking – attackers can steal session cookies to impersonate users.
• Credential theft – attackers can capture login information.
• Phishing – attackers can trick users into revealing sensitive information.
• Account takeover – attackers can gain unauthorized access to user accounts.

Because the vulnerability requires no authentication to exploit, it poses a significant risk to users of affected versions.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a reflected cross-site scripting (XSS) issue that can lead to session hijacking, credential theft, phishing, or account takeover. Such security weaknesses can compromise the confidentiality and integrity of user data.

While the provided context does not explicitly mention compliance with standards like GDPR or HIPAA, vulnerabilities that allow unauthorized access to personal or sensitive information can negatively impact compliance with these regulations, which require protection of user data and secure handling of personal information.

Therefore, if exploited, this vulnerability could lead to violations of data protection requirements under regulations such as GDPR and HIPAA due to potential unauthorized disclosure or misuse of personal data.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Rukovoditel CRM to version 3.7 or later, where the vulnerability is fixed by proper input validation and output encoding.

If upgrading is not immediately possible, consider implementing web application firewall (WAF) rules to block requests containing suspicious script payloads in the 'zd_echo' parameter.

Additionally, restrict access to the vulnerable endpoint if possible and monitor logs for suspicious requests targeting the 'zd_echo' parameter.

Useful 0 Not Useful 0