Cyberghostvpn.com offers cheap access to VPN servers around the whole world. The company promises great protection and total anonymity.
The anonymity is as good as your trust in the company is. A lot of VPN service providers claim not to log any IP addresses nor to give away any userdata. We took a look at the website of cyberghost and we’ve discovered some cross site scripting issues there.
Stealing cookies or doing some phishing attacks were possible, that could damage the customers trust in the service. It was more frightening to see that two xsses were located in the login respectivley the password-reset pages. XSS issues occur when the programmer forgets to escape the user-input which is embedded in the websites html code. The last xss was in the public webproxy which is often used to bypass youtube country-limitations.
We’ve sent an email with all details on sunday evening (the 05th of august 2012) to the support. Surprisingly the answer came in on monday morning stating that everything has been fixed and they’re going to do an extensive security audit of their website. Such a fast reaction is very rare and absolute exemplary. It’s clear that cyberghost cares about their users security and we hope that we do not have to send a new email in the near future. It’s nice to have sensibilized a company in security. That is, amongst others, the idea behind the Internetwache-project.
We would like to thank cyberghost for the very fast remediation of the security issues.
The team of internetwache.org
Screenshots
