Rakuten Online Website Open Redirect (URL Redirection) Cyber Security Vulnerabilities
Domain:
rakuten.com
“Rakuten, Inc. (楽天株式会社 Rakuten Kabushiki-gaisha?) is a Japanese electronic commerce and Internet company based in Tokyo, Japan. Its B2B2C e-commerce platform Rakuten Ichiba is the largest e-commerce site in Japan and among the world’s largest by sales. Hiroshi Mikitani founded the company in February 1997 as MDM, Inc., and is still its chief executive. Rakuten Shopping Mall (楽天市場 Rakuten Ichiba?) started operations in May 1997. In June 1999, the company changed its name to Rakuten, Inc. The Japanese word rakuten means optimism. In 2012, the company’s revenues totaled US$4.6 billion with operating profits of about US$244 million. In June 2013, Rakuten, Inc. reported it had a total of 10,351 employees worldwide. In 2005, Rakuten started expanding outside Japan, mainly through acquisitions and joint ventures. Its acquisitions include Buy.com (now Rakuten.com Shopping in the US), Priceminister (France), Ikeda (now Rakuten Brasil), Tradoria (now Rakuten Deutschland), Play.com (UK), Wuaki.tv (Spain), and Kobo Inc. (Canada). The company has investments in Pinterest, Ozon.ru, AHA Life, and Daily Grommet.” (Wikipedia)
The Alexa rank of rakuten.co.jp is 64 on May 29 2015. It is the second toppest Japanese local sevice website.
(1) Vulnerability Description:
Rakuten online website has a computer cyber security bug problem. It can be exploited by Open Redirect (Unvalidated Redirects and Forwards) attacks. Here is the description of Open Redirect: “A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance.” (From CWE)
The program code flaw can be attacked without user login. Tests were performed on Microsoft IE (9 9.0.8112.16421) of Windows 7, Mozilla Firefox (37.0.2) & Google Chromium 42.0.2311 (64-bit) of Ubuntu (14.04.2)，Apple Safari 6.1.6 of Mac OS X v10.9 Mavericks.
Since know only a little Japanese, not sure whether Rakuten pays much attention to Open Redirect Vulnerabilities or not. These bugs were found by using URFDS.
(2) Use one of webpages for the following tests. The webpage address is “http://itinfotech.tumblr.com/
Vulnerable URL 1:
POC Code:
Vulnerable URL 2:
POC Code:
Vulnerable URL 3:
POC Code:
Vulnerability Disclosure:
Those vulnerabilities are not patched now.
Bug Discover:
Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)
http://www.tetraph.com/
More Blog Details:
http://tetraph.com/security/
http://japanbroad.blogspot.jp/
http://diebiyi.com/articles/
https://infoswift.wordpress.
http://www.inzeed.com/
http://itprompt.blogspot.com/
http://whitehatpost.blog.163.
https://hackertopic.wordpress.
============
楽天オンラインサイトオープンリダイレクト（
ドメイン：
rakuten.com
「楽天株式会社は、（楽天株式会社楽天株式会社-gaisha？
rakuten.co.jpのAlexaのランクは、第2 toppest日本の地方流通サービスのウェブサイトである5月
（1）脆弱性の説明：
楽天のオンラインウェブサイトは、
プログラムコードの欠陥は、
楽天リダイレクトの脆弱性かどうかを開くために多くの注意を払っ
（2）以下の試験のためのWebページのいずれかを使用します。
脆弱URL 1：
POCコード：
脆弱URL 2：
POCコード：
脆弱URL 3：
POCコード：
脆弱性の公開：
これらの脆弱性は、現在パッチが適用されていません。
バグを発見：
王ジン (Wang Jing)、数理科学研究部門（MAS）、
http://www.tetraph.com/
詳細:
http://tetraph.com/security/
http://japanbroad.blogspot.jp/
http://diebiyi.com/articles/
https://infoswift.wordpress.
http://www.inzeed.com/
http://itprompt.blogspot.com/
http://whitehatpost.blog.163.
https://hackertopic.wordpress.