exploit the possibilities

IceWarp WebMail 11.4.4.1 Cross Site Scripting

IceWarp WebMail 11.4.4.1 Cross Site Scripting
Posted Jan 27, 2020
Authored by Lutfu Mert Ceylan

IceWarp WebMail versions 11.4.4.1 and below suffer from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2020-8512
MD5 | d91c809ee4cd7fbde653e90bfaf0c0ee

IceWarp WebMail 11.4.4.1 Cross Site Scripting

Change Mirror Download
[+] Title: IceWarp WebMail Cross-Site Scripting Vulnerability
[+] Date: 2020/01/27
[+] Author: Lutfu Mert Ceylan
[+] Vendor Homepage: www.icewarp.com
[+] Tested on: Windows 10
[+] Versions: 11.4.4.1 and before
[+] Vulnerable Parameter: "color" (Get Method)
[+] Vulnerable File: /webmail/
[+} Dork : inurl:/webmail/ intext:Powered by IceWarp Server

# Notes:

An attacker can use XSS (in color parameter IceWarp WebMail 11.4.4.1 and before)to send a malicious script to an unsuspecting Admins or users. The end admins or useras browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page. Even an attacker can easily place users in social engineering through this vulnerability and create a fake field.

# PoC:

[+] Go to Sign-in page through this path: http://localhost/webmail/
or
http://localhost:32000/webmail/

[+] Add the "color" parameter to the URL and write malicious code, Example: http://localhost/webmail/?color="><svg/onload=alert(1)>

[+] When the user goes to the URL, the malicious code is executed

Example Vulnerable URL: http://localhost/webmail/?color="><svg/onload=alert(1)> (Payload: "><svg/onload=alert(1)>)

# Demo Pictures:

[+] https://i.hizliresim.com/yGY6Zj.png

Comments (1)

RSS Feed Subscribe to this comment feed
mertc

CVE is assigned. CVE-2020-8512

Comment by mertc
2020-02-05 16:52:14 UTC | Permalink | Reply
Login or Register to post a comment

File Archive:

March 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    2 Files
  • 2
    Mar 2nd
    18 Files
  • 3
    Mar 3rd
    15 Files
  • 4
    Mar 4th
    12 Files
  • 5
    Mar 5th
    19 Files
  • 6
    Mar 6th
    8 Files
  • 7
    Mar 7th
    1 Files
  • 8
    Mar 8th
    1 Files
  • 9
    Mar 9th
    11 Files
  • 10
    Mar 10th
    15 Files
  • 11
    Mar 11th
    9 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    13 Files
  • 14
    Mar 14th
    10 Files
  • 15
    Mar 15th
    13 Files
  • 16
    Mar 16th
    27 Files
  • 17
    Mar 17th
    15 Files
  • 18
    Mar 18th
    23 Files
  • 19
    Mar 19th
    25 Files
  • 20
    Mar 20th
    10 Files
  • 21
    Mar 21st
    6 Files
  • 22
    Mar 22nd
    1 Files
  • 23
    Mar 23rd
    22 Files
  • 24
    Mar 24th
    15 Files
  • 25
    Mar 25th
    22 Files
  • 26
    Mar 26th
    20 Files
  • 27
    Mar 27th
    15 Files
  • 28
    Mar 28th
    10 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close