seeing is believing

Atmail WebMail 7.0.2 Cross Site Scripting

Atmail WebMail 7.0.2 Cross Site Scripting
Posted Mar 27, 2013
Authored by Vicente Aguilera Diaz

Atmail WebMail versions 7.0.2 and below suffer from a reflective cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2013-2585
MD5 | d6636d238d75eee9ed6adbfb98cac7b6

Atmail WebMail 7.0.2 Cross Site Scripting

Change Mirror Download
=============================================
INTERNET SECURITY AUDITORS ALERT 2013-004
- Original release date: March 9th, 2013
- Last revised: March 25th, 2013
- Discovered by: Vicente Aguilera Diaz
- Severity: 4.3/10 (CVSSv2 Base Scored)
- CVE-ID: CVE-2013-2585
=============================================

I. VULNERABILITY
-------------------------
Reflected XSS in the view attachment message process of the Atmail
WebMail <= v7.0.2

II. BACKGROUND
-------------------------
Atmail allows users to access IMAP Mailboxes of any server of your
choice. The software provides a comprehensive email-suite for
accessing user mailboxes, and provides an inbuilt Calendar and
Addressbook features. The WebMail Client of Atmail supports any
existing IMAP server running under Unix/Linux or Windows systems.

III. DESCRIPTION
-------------------------
Has been detected a reflected XSS vulnerability in the view attachment
message process of the Atmail WebMail, that allows the execution of
arbitrary HTML/script code to be executed in the context of the victim
user's browser.

The code injection is done through the file name parameter, and
requires that the user victim is authenticated in the WebMail.

IV. PROOF OF CONCEPT
-------------------------
When a user opens a file attachment in an email, the link is as follows:

http://<atmail-server>/index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<ID>/filenameOriginal/<file>

where:
- <atmail-server> is the Atmail WebMail server
- <ID> is the unique ID for the message that contains the attachment
- <file> is the attachment file in the message

A malicious user can inject arbitrary HTML/script code in the <file>
parameter. For example:

http://<atmail-server>/index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<ID>/filenameOriginal/test.txt<H1><marquee>This+is+an+XSS+example

V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, this can leverage to steal sensitive information as
user credentials, personal data, etc.

VI. SYSTEMS AFFECTED
-------------------------
Tested in Atmail 7.0.2. Other versions may be affected too.

VII. SOLUTION
-------------------------
Update to version 7.0.3.

VIII. REFERENCES
-------------------------
http://www.atmail.com
http://www.isecauditors.com

IX. CREDITS
-------------------------
This vulnerability has been discovered
by Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).

X. REVISION HISTORY
-------------------------
March 9, 2013: Initial release

XI. DISCLOSURE TIMELINE
-------------------------
March 9, 2013: Vulnerability acquired by
Internet Security Auditors (www.isecauditors.com)
March 10, 2013: Contacts to Atmail without response.
March 19, 2013: Second attempt: Twitting. Third: Facebooking.
Let's get Social!
March 21, 2013: Response and sent to Security Team.
March 25, 2013: Version 7.0.3 published.
March 27, 2013: Advisory sent to lists.

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
Internet Security Auditors accepts no responsibility for any damage
caused by the use or misuse of this information.

XIII. ABOUT
-------------------------
Internet Security Auditors is a Spain based leader in web application
testing, network security, penetration testing, security compliance
implementation and assessing. Our clients include some of the largest
companies in areas such as finance, telecommunications, insurance,
ITC, etc. We are vendor independent provider with a deep expertise
since 2001. Our efforts in R&D include vulnerability research, open
security project collaboration and white-papers, presentations and
security events participation and promotion. For further information
regarding our security services, contact us.

XIV. FOLLOW US
-------------------------
You can follow Internet Security Auditors, news and security
advisories at:
https://www.facebook.com/ISecAuditors
https://twitter.com/ISecAuditors
http://www.linkedin.com/company/internet-security-auditors
http://www.youtube.com/

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close