In light of COVID-19 precaution measures, we remind that all ImmuniWeb products can be easily configured and safely paid online without any human contact or paperwork.

Total Tests:
Stay in Touch

Weekly newsletter on AI, Application Security & Cybercrime

Your data will stay confidential Private and Confidential

Self-XSS in Microsoft Dynamics CRM 2013 SP1

Advisory ID:HTB23245
Product:Microsoft Dynamics CRM 2013 SP1
Vendor:Microsoft Corporation
Vulnerable Versions:( (DB and probably prior
Tested Version:( (DB
Advisory Publication:December 29, 2014 [without technical details]
Vendor Notification:December 29, 2014
Public Disclosure:January 7, 2015
Latest Update:January 6, 2015
Vulnerability Type:Cross-Site Scripting [CWE-79]
CVE Reference:Pending
Risk Level:Low
CVSSv2 Base Score:2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
Discovered and Provided:High-Tech Bridge Security Research Lab

Advisory Details:

High-Tech Bridge Security Research Lab discovered a DOM-based self-XSS vulnerability in Microsoft Dynamics CRM 2013 SP1, which can be exploited to perform Cross-Site Scripting attacks against authenticated users.

The vulnerability exists due to insufficient filtration of user-supplied input passed to the "/Biz/Users/AddUsers/SelectUsersPage.aspx" script after an unsuccessful attempt to send XML SOAP request. A remote attacker can trick a logged-in user to insert malicious HTML and script code into the "newUsers_ledit" input field and execute it in user’s browser in context of vulnerable web application.

To successfully exploit this vulnerability (as any other XSS vulnerability, besides stored ones) an attacker should use a social engineering technique to trick the user to insert malicious code into the above-mentioned field on the vulnerable page. Being a self-XSS, the vulnerability still remains quite useful to perform attacks against users of Microsoft Dynamics CRM that is quite secure. Below you can find the exploitation scenario applicable to any web application running Microsoft Dynamics CRM.

Using pretty simple social engineering technique attacker can trick a user to copy some "legitimate" text from a specially prepared malicious page to user's clipboard using "Ctrl+C" or mouse, and then paste it into the vulnerable web page.

Simple exploit code bellow will display a legitimate text to the user, and then replace the text in user's clipboard with our exploit code:

// simple exploit to poison clipboard
function replaceBuffer() {
var selection = window.getSelection(),
eviltext = '1&lt;img src=x onerror=alert("ImmuniWeb") /&gt;',
copytext = eviltext,
newdiv = document.createElement('div'); = 'absolute'; = '-99999px';
newdiv.innerHTML = copytext;
window.setTimeout(function () {
}, 100);
document.addEventListener('copy', replaceBuffer);
<div>In order to find hidden users just copy this string into the search window:<br>

The victim will see the following text in the browser:

However, will copy and paste the following malicious payload:
1<img src=x onerror=alert("ImmuniWeb")>

Attacker then can trick then the user to paste copied buffer into the "newUsers_ledit" field on the "https://[victim_host]/[site]/Biz/Users/AddUsers/SelectUsersPage.aspx" page and the JS code will be executed in context of the vulnerable website.

Below you can see the image with user cookies displayed in JS pop-up:

Quick video of exploitation:

How to Detect Cross-Site Scripting Vulnerabilities
Free Website Security Test
  • Non-intrusive GDPR Test
  • Non-intrusive PCI DSS Test
Try Free Test
ImmuniWeb® On-Demand
  • Complete GDPR Audit
  • Complete PCI DSS Audit
  • Remediation Guidelines
  • DevSecOps Integration
Learn More

On the 31st of December 2014, Microsoft replied the following:

"MSRC does not consider self-XSS issues to be security vulnerabilities. For a discussion of how we define security vulnerabilities, see "

Taking into consideration the rise of successful self-XSS attacks campaigns in 2014 we do consider this issue to be a security vulnerability. As vendor refused to provide an official fix for the vulnerability, we suggest to block access to the vulnerable script using WAF or web server configuration as a temporary solution.

[1] High-Tech Bridge Advisory HTB23245 - - Self-XSS in Microsoft Dynamics CRM 2013 SP1.
[2] Microsoft Dynamics CRM 2013 - - Microsoft Dynamics CRM is our customer relationship management (CRM) business solution that drives sales productivity and marketing effectiveness through social insights, business intelligence, and campaign management in the cloud, on-premises, or with a hybrid combination.
[3] Common Weakness Enumeration (CWE) - - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] ImmuniWeb® - Leveraging the power of machine-learning and genius of human brain to deliver the most advanced web application security and penetration testing.
[5] ImmuniWeb® SSLScan - Test your servers for security and compliance with PCI DSS, HIPAA and NIST.
User Comments
Add Comment

Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
View Products Ask a Question