XSS vulnerability in tuenti.com

Zaryn Dentzel, founder and CEO of Tuenti, presented last week the details of Tuenti Mobile, a virtual mobile operator.

I saw the new on my twitter timeline, and I felt like testing the site. It happened to me I found a reflected cross site scripting vulnerability that was affecting the domain tuenti.com. I reported it and was fixed very soon. Above I show a screenshot of the affected web page.

The vulnerability was caused by a field of a form that was displayed back to the web interface without escaping the HTML characters. In the following code box I show the affected HTML:

Code


This is not valid.

HELLO WORLD"/>

An attacker could attempt to trick users into visiting a malicious URL such as https://www.tuenti.com/?m=Tusimtogo&func=index&siaccod=%22%3E%3Ch2%3E%3Cstrong%3EHELLO%20WORLD so that the arbitrary HTML code of the siaccod parameter would be executed on victim's web browser.

I reported the vulnerability to security@tuenti.com and in a few hours I got the following reply telling me that the bug had been fixed and thanking me.

The fix was as easy as removing the line that displayed back the content of the siaccod field.