Horde IMP Email Attachments HTML Injection Vulnerability
BID:15730
CVE-2005-4080 |Info
Horde IMP Email Attachments HTML Injection Vulnerability
| Bugtraq ID: | 15730 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 06 2005 12:00AM |
| Updated: | Dec 06 2005 12:00AM |
| Credit: | The vendor credits SEC Consult with the discovery of this vulnerability. |
| Vulnerable: |
Horde Project IMP 4.0.4 Horde Project IMP 4.0.3 Horde Project IMP 4.0.2 Horde Project IMP 4.0.1 Horde Project IMP 4.0 Horde Project IMP 3.2.5 Horde Project IMP 3.2.4 Horde Project IMP 3.2.3 Horde Project IMP 3.2.2 Horde Project IMP 3.2.1 Horde Project IMP 3.2 Horde Project IMP 3.1.2 Horde Project IMP 3.1 Horde Project IMP 3.0 Horde Project IMP 2.3 Horde Project IMP 2.2.8 Horde Project IMP 2.2.7 Horde Project IMP 2.2.6 Horde Project IMP 2.2.5 Horde Project IMP 2.2.4 Horde Project IMP 2.2.3 Horde Project IMP 2.2.2 Horde Project IMP 2.2.1 Horde Project IMP 2.2 Horde Project IMP 2.0 |
| Not Vulnerable: | |
Discussion
Horde IMP Email Attachments HTML Injection Vulnerability
Horde IMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
Reports indicate this issue is only present when viewing IMP content with the Microsoft Internet Explorer Web browser.
Horde IMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
Reports indicate this issue is only present when viewing IMP content with the Microsoft Internet Explorer Web browser.
Exploit / POC
Horde IMP Email Attachments HTML Injection Vulnerability
No exploit is required.
The following proof of concept demonstrates one possible way to bypass the HTML stripping functions of the application:
<s0x00hcript>alert('HORDE')</s0x00hcript>
0x00h is an ASCII 00
The following proof of concept exploit by Igor <[email protected]> is available:
No exploit is required.
The following proof of concept demonstrates one possible way to bypass the HTML stripping functions of the application:
<s0x00hcript>alert('HORDE')</s0x00hcript>
0x00h is an ASCII 00
The following proof of concept exploit by Igor <[email protected]> is available:
Solution / Fix
Horde IMP Email Attachments HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Horde IMP Email Attachments HTML Injection Vulnerability
References:
References:
- IMP Homepage (Horde Project)
- Pandora Homepage (Pandora FMS Team)
- Horde IMP Webmail Client XSS all versions (Igor