Gallup has fixed two cross-site scripting (XSS) errors on its website that could have enabled data theft and account takeover, according to a report published by Checkmarx on Tuesday.
The two flaws were due to lack of proper sanitization or encoding of certain query string parameters at certain Gallup endpoints, which an attacker could have exploited by appending their own values to the ends of otherwise-legitimate Gallup domain URLs and convincing victims to click the manipulated links.
In proof-of-concept (PoC) videos, the researchers showed how one of the vulnerabilities could extract information from an unauthenticated victim during the checkout process on the Gallup online store, and how another could be used to perform actions on behalf of a logged-in victim, ultimately resulting in a takeover of their Gallup account.
“With XSS seemingly everywhere it is more important than ever to teach the secure coding basics of always encoding output in a web application. XSS is easy to learn to prevent, easy to scan code for, and easy to fix but you need awareness to get started on the journey of squashing this bug class for all of your web apps,” Chris Wysopal, chief technology officer and founder of Veracode, told SC Media.
Both XSS errors were reported to Gallup’s incident response team by Checkmarx on June 23 and confirmed to be fully fixed by July 11. There is no indication that these flaws were ever exploited in the wild.
Gallup’s credibility can be leveraged for social engineering
Gallup is a well-known for its public opinion polls, including polls involving U.S. politics and elections. An attacker could have leveraged the XSS flaws involving Gallup’s gx.gallup.com and my.gallup.com domains to convince victims to click links that came from the legitimate gallup.com website but ultimately led to data extraction or session hijacking by an attacker.
The first flaw, which Checkmarx gave a CVSS score of 6.5, is an example of reflected cross scripting, in which data from an HTTP request is unsafely included directly in its response.
Due to failure of the /kiosk.gx endpoint to sanitize or encode the query string of the ALIAS parameter before including it on the webpage, an attacker could craft a parameter value that leads to arbitrary code execution in the context of the victim’s navigation session if the victim clicks the link, the Checkmarx researchers wrote.
The PoC exploit demonstrated by the researchers involves the attacker asking the victim to participate in a survey by clicking the link, which has a gx.gallup.com domain, a domain commonly used to access surveys on the Gallup website. The victim does not need to be logged in for this attack to be successful.
When the victim clicks the link, due to the crafted query string appended to it, the victim’s browser loads a JavaScript file from an attacker-controlled domain, which then leverages a JSONP endpoint on the Gallup website to exfiltrate Digital River API access tokens from the victim’s session. Digital River is the e-commerce service used by Gallup to process information from purchases made from its online shop.
Information submitted by the user in the process of making a purchase, such as their name, address and payment information, could be accessed using the extracted tokens – the attacker could also leverage these tokens to add new products to the victim’s Gallup shopping cart.
The second flaw involves Document Object Model (DOM)-based XSS, in which data from untrusted sources is unsafely processed by the client-side JavaScript, which writes this untrusted data back to the DOM, according to Checkmarx.
This flaw, given a CVSS score of 5.4, could lead to account takeover due to failure of the /_Portal/ApplicationAsync endpoint to sanitize or encode the query string searchTerm parameter value prior to including it on the webpage, the researchers wrote. Like the previous flaw, if an attacker crafts their own malicious query string and sends it in a phishing link to the victim, a Javascript file is retrieved from an attacker-controlled domain and executed in the context of the victim’s navigation session.
In this case, the phishing link comes from the my.gallup.com domain and the malicious JavaScript automatically changes the victim’s account email address to the attacker’s own email, allowing them to take over the account using the reset password function. The victim must be logged into their account when they click the link for this attack to work.
The importance of combatting XSS vulnerabilities
The ability for an attacker to leverage legitimate Gallup domains and take over Gallup user accounts, in addition to data and privacy concerns, can also raise concerns regarding disinformation, especially in the lead up to the 2024 presidential election, according to Checkmarx and Veracode.
Given these concerns, resilience against XSS vulnerabilities is crucial for sites like Gallup and other web applications involved in collecting or reporting information about politics, social issues and the election. However, Wysopal told SC Media that XSS flaws are found in about half of all applications scanned by Veracode.
“When we find them in an application, we often find upwards of 100 instances of XSS,” Wysopal said.
Checkmarx says applications should properly encode data prior to including it in response markups or DOMs, in order to prevent XSS attacks similar to those demonstrated in its PoCs. Content Security Policies (CSPs), which restrict the locations from which browsers can retrieve and execute scripts, can also help combat XSS, Checkmarx noted.
“Thankfully in 2024 we also have GenAI powered auto-remediation,” Wysopal added.
