bugtraq - Cross Site Scripting (XSS) Vulnerability in Web Mail service by "Walla! Communications LTD"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <000801c6fd1d$0e064a50$6502a8c0@zionsecutiy>
Date: Tue, 31 Oct 2006 18:38:22 +0200
From: "LegendaryZion" <moskito@...le.net.il>
To: <bugs@...uritytracker.com>,
	"BugTraq" <bugtraq@...urityfocus.com>, <news@...uriteam.com>,
	<full-disclosure@...ts.grok.org.uk>
Subject: Cross Site Scripting (XSS) Vulnerability in Web Mail service by "Walla! Communications LTD"

·= Security Advisory =·

Issue: Cross Site Scripting (XSS) Vulnerability in Web Mail service by 
"Walla! Communications LTD"
Discovered Date: 05/10/2006
Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com]
Product Vendor: http://www.walla.co.il/

Details:

Walla! Communications LTD Web Mail service is prone to a Cross Site 
Scripting Vulnerability.
The vulnerability exists in filter engine, caused by the lack of Input 
Validation/Filtering
of malicious Method "Expression()" of Cascading Style Sheets (CSS).

About Cascading Style Sheets (CSS):

Cascading Style Sheets (CSS) is a stylesheet language used to describe the 
presentation
of a document written in a markup language. Its most common application is 
to style web pages written
in HTML and XHTML.
English:
http://en.wikipedia.org/wiki/Cascading_Style_Sheets

About Expression() Method:

Receive string that specifies any valid script(JScript, JavaScript, 
VBSCript)
statement without quotations or semicolons. This string can include 
references to
other properties on the current page. Array references are not allowed on 
object
properties included in this script.

<ELEMENT STYLE="AttributeName:expression(Script)">

Exploitation Mail:

...
------=_NextPart_000_0006_01C6DD9E.26B2BBD0
Content-Type: text/html;

<IMG width="0" height="0" style="width: expression(alert('expression'));">
...

Successful exploitation may allow execution of script code. This could also 
be exploited
to spoof the entire website's content, stealing cookies, stealing session 
ID,
commit Denial Of Service attacks and more...

Proof Of Concept:

<IMG style="width: expression(alert('expression'));">

Thanks,
Tal Argoni, CEH
www.zion-security.com