Отправить #1028582: Convene (https://azeusconvene.com) Azeus Convene Board Management Portal v7.0.2.7_3 (p72) Full Account Takeover

This finding combines two vulnerabilities to achieve a full account takeover with a single click:

Vulnerability 1 — Reflected XSS in REDIRECT_URL (I was able to find 2 Reflected XSS and another DOM XSS , this is only one of them, all can be esclated to ATO):
Azeus Convene v7.0.2.7_3 (p72) reflects the REDIRECT_URL query parameter unsanitized into an inline JavaScript variable on multiple pre-authentication pages. The value is inserted directly into a var redirectUrl = "<VALUE>"; assignment with no output encoding, no scheme validation, and no origin check. Two additional cross-site scripting vulnerabilities were identified in the same product and will be reported separately. An attacker injects a javascript: URI using eval(String.fromCharCode(...)) to bypass server-side keyword filters that block characters such as single quotes, double quotes, backticks, backslashes, curly braces, .then(, =>, return, and new. The Content Security Policy includes unsafe-eval and unsafe-inline, providing no mitigation against the injected script.

Vulnerability 2 — Old Password Validation Bypass via AUTO_CREATED Parameter:
The password change endpoint (/jsp/ad/ad0205.jsp) accepts a client-controllable parameter AUTO_CREATED=Y. When this parameter is set, the server completely skips old password validation, allowing a new password to be set without knowing or providing the current password. Under normal operation the page sets var reqOldPw = true; and the server enforces old password verification. However, when AUTO_CREATED=Y is passed as a query parameter, this check is bypassed server-side. This is a separate security flaw (CWE-620) that the XSS exploits to escalate from script execution to permanent account takeover.

Combined Impact — Full Account Takeover:
The XSS payload extracts the victim's USER_ID via a same-origin fetch() to /jsp/ad/ad0501.jsp, then opens the password change form at /jsp/ad/ad0205.jsp?AUTO_CREATED=Y to exploit the old password bypass. The payload builds a JWE-encrypted password change request using the application's own RSA-OAEP-SHA1 + A256GCM crypto library exposed via the setJWE() function, and submits it. The victim's password is permanently changed without the attacker ever knowing the original password. The victim is then redirected to the meetings page with no visual indication of compromise.

• Пользователь: OmarXtream (UID 102120)
• Представление: 13.10.2026 20:07 (26 дни назад)
• Модерация: 08.11.2026 08:59 (26 days later)
• Статус: принято
• Запись VulDB: 432803 [Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72 dummy_launcher.jsp REDIRECT_URL межсайтовый скриптинг]
• Баллы: 20