Two Vulnerabilities in TeamBeam

Security researchers from aramido identified several security-relevant findings in the data exchange platform TeamBeam by Skalio. TeamBeam makes it easy to provide and exchange data securely via a web application. aramido was able to identify a persistent Cross-Site Scripting vulnerability as well as a Reverse Tabnabbing vulnerability. A missing Content-Security-Policy header was also noted. However, since only JavaScript from the own server is reloaded in the TeamBeam application, there is no urgent need for action here. Vulnerabilities such as Cross-Site Scripting occur repeatedly on websites with input fields, although they have long been considered one of the most common security risks for web applications . In accordance with aramido's guidelines for the responsible disclosure of security vulnerabilities , aramido reported the vulnerability to the manufacturer for remediation, which according to Skalio GmbH has since taken place. The security advisory for the Cross-Site Scripting vulnerabilities and the security advisory for Reverse Tabnabbing can also be viewed publicly.

The assignment of names for directories in the Drive function is susceptible to Cross-Site Scripting. If the directory name is chosen as "<svg onload=alert('XSS')>", JavaScript code can be executed when the directory name is displayed. Since people can be added to a directory, it is relatively easy for an attacker to execute the Cross-Site Scripting vulnerability in the context of another user. If an attacker manages an exploit in the context of an administrator, they can extend their own permissions. As a prerequisite, an attacker requires access credentials for the TeamBeam platform. Skalio promptly provided an update for TeamBeam that is intended to fix these problems.

Links to external websites with target="_blank" were set without rel="noopener". Thus, the called-up website can manipulate the URL of the calling page via the windows.opener element. An attacker can thus redirect the original tab to a page controlled by them.

To prevent such vulnerabilities, the following is important:

1. Encode the output of user inputs as HTML entities
2. All links to external websites should be secured by rel="noopener"

Skalio GmbH proceeded very result-oriented in remediating the vulnerabilities, and the vulnerabilities were fixed promptly. The update has already been installed by Skalio for its own cloud platform; on-premises customers should also have received the update. aramido recommends performing these hardening measures to secure your own IT systems against attacks like these.