full-disclosure - [ISecAuditors Security Advisories] Reflected XSS in Atmail WebMail <= v7.0.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5152D767.1010309@isecauditors.com>
Date: Wed, 27 Mar 2013 12:26:31 +0100
From: ISecAuditors Security Advisories <advisories@...cauditors.com>
To: bugs@...uritytracker.com, news@...uriteam.com, 
 full-disclosure@...ts.grok.org.uk, vuln@...unia.com, 
 packet@...ketstormsecurity.org, bugtraq@...urityfocus.com
Subject: [ISecAuditors Security Advisories] Reflected XSS
 in Atmail WebMail <= v7.0.2

=============================================
INTERNET SECURITY AUDITORS ALERT 2013-004
- Original release date: March 9th, 2013
- Last revised:  March 25th, 2013
- Discovered by: Vicente Aguilera Diaz
- Severity: 4.3/10 (CVSSv2 Base Scored)
- CVE-ID: CVE-2013-2585
=============================================

I. VULNERABILITY
-------------------------
Reflected XSS in the view attachment message process of the Atmail
WebMail <= v7.0.2

II. BACKGROUND
-------------------------
Atmail allows users to access IMAP Mailboxes of any server of your
choice. The software provides a comprehensive email-suite for
accessing user mailboxes, and provides an inbuilt Calendar and
Addressbook features. The WebMail Client of Atmail supports any
existing IMAP server running under Unix/Linux or Windows systems.

III. DESCRIPTION
-------------------------
Has been detected a reflected XSS vulnerability in the view attachment
message process of the Atmail WebMail, that allows the execution of
arbitrary HTML/script code to be executed in the context of the victim
user's browser.

The code injection is done through the file name parameter, and
requires that the user victim is authenticated in the WebMail.

IV. PROOF OF CONCEPT
-------------------------
When a user opens a file attachment in an email, the link is as follows:

http://<atmail-server>/index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<ID>/filenameOriginal/<file>

where:
- <atmail-server> is the Atmail WebMail server
- <ID> is the unique ID for the message that contains the attachment
- <file> is the attachment file in the message

A malicious user can inject arbitrary HTML/script code in the <file>
parameter. For example:

http://<atmail-server>/index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<ID>/filenameOriginal/test.txt<H1><marquee>This+is+an+XSS+example

V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, this can leverage to steal sensitive information as
user credentials, personal data, etc.

VI. SYSTEMS AFFECTED
-------------------------
Tested in Atmail 7.0.2. Other versions may be affected too.

VII. SOLUTION
-------------------------
Update to version 7.0.3.

VIII. REFERENCES
-------------------------
http://www.atmail.com
http://www.isecauditors.com

IX. CREDITS
-------------------------
This vulnerability has been discovered
by Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).

X. REVISION HISTORY
-------------------------
March    9, 2013: Initial release

XI. DISCLOSURE TIMELINE
-------------------------
March    9, 2013: Vulnerability acquired by
                  Internet Security Auditors (www.isecauditors.com)
March   10, 2013: Contacts to Atmail without response.
March   19, 2013: Second attempt: Twitting. Third: Facebooking.
                  Let's get Social!
March   21, 2013: Response and sent to Security Team.
March   25, 2013: Version 7.0.3 published.
March   27, 2013: Advisory sent to lists.

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
Internet Security Auditors accepts no responsibility for any damage
caused by the use or misuse of this information.

XIII. ABOUT
-------------------------
Internet Security Auditors is a Spain based leader in web application
testing, network security, penetration testing, security compliance
implementation and assessing. Our clients include some of the largest
companies in areas such as finance, telecommunications, insurance,
ITC, etc. We are vendor independent provider with a deep expertise
since 2001. Our efforts in R&D include vulnerability research, open
security project collaboration and white-papers, presentations and
security events participation and promotion. For further information
regarding our security services, contact us.

XIV. FOLLOW US
-------------------------
You can follow Internet Security Auditors, news and security
advisories at:
https://www.facebook.com/ISecAuditors
https://twitter.com/ISecAuditors
http://www.linkedin.com/company/internet-security-auditors
http://www.youtube.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/