SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Server)  >   Magic WinMail Server Vendors:   AMAX Information Technologies Inc.
WinMail Server Input Validation Flaw in 'badlogin.php' in the 'lid' Parameter Lets Remote Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1033434
SecurityTracker URL:  http://securitytracker.com/id/1033434
CVE Reference:   CVE-2014-9468   (Links to External Site)
Date:  Aug 31 2015
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Exploit Included:  Yes  
Version(s): 4.1, 4.2
Description:   A vulnerability was reported in WinMail Server. A remote user can conduct cross-site scripting attacks.

The 'badlogin.php' script does not properly filter HTML code from user-supplied input before displaying the input. A remote user can cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Magic WinMail Server software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

The 'lid' parameter is affected.

Wang Jing of the School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore reported this vulnerability.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Magic WinMail Server software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.magicwinmail.net/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [oss-security] Winmail Server 4.2 Reflected XSS (Cross-site Scripting) Web Application 0-Day Security Bug

--089e0122f724742a3a051e8790c1
Content-Type: text/plain; charset=UTF-8

*Winmail Server 4.2 Reflected XSS (Cross-site Scripting) Web Application
0-Day Security Bug*



Exploit Title: Winmail Server badlogin.php &lid parameter Reflected XSS Web
Security Vulnerability
Product: Winmail Server
Vendor: Winmail Server
Vulnerable Versions: 4.2   4.1
Tested Version: 4.2   4.1
Advisory Publication: August 24, 2015
Latest Update: August 30, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference:
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with
attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Reporter: Wang Jing [School of Physical and Mathematical
Sciences (SPMS), Nanyang Technological University (NTU), Singapore]
(@justqdjing)









*Suggestion Details:*


*(1) Vendor & Product Description:*


*Vendor:*
Winmail Server



*Product & Vulnerable Versions:*
Winmail Server
4.2   4.1



*Vendor URL & Download:*
Product can be obtained from here,
http://www.magicwinmail.net/download.asp




*Product Introduction Overview:*
"Winmail Server is an enterprise class mail server software system offering
a robust feature set, including extensive security measures. Winmail Server
supports SMTP, POP3, IMAP, Webmail, LDAP, multiple domains, SMTP
authentication, spam protection, anti-virus protection, SSL security,
Network Storage, remote access, Web-based administration, and a wide array
of standard email options such as filtering, signatures, real-time
monitoring, archiving, and public email folders. Winmail Server can be
configured as a mail server or gateway for ISDN, ADSL, FTTB and cable modem
networks, beyond standard LAN and Internet mail server configurations."








*(2) Vulnerability Details:*
Winmail Server web application has a computer security problem. Hackers can
exploit it by reflected XSS cyber attacks. This may allow a remote attacker
to create a specially crafted request that would execute arbitrary script
code in a user's browser session within the trust relationship between
their browser and the server.

Several other similar products 0-day vulnerabilities have been found by
some other bug hunter researchers before. Winmail Server has patched some
of them. "scip AG was founded in 2002. We are driven by innovation,
sustainability, transparency, and enjoyment of our work. We are completely
self-funded and are thus in the comfortable position to provide completely
independent and neutral services. Our staff consists of highly specialized
experts who focus on the topic information security and continuously
further their expertise through advanced training". Scip has recorded
similar XSS bugs, such as scipID 26980.



*(2.1) *The code flaw occurs at "&lid" parameter in "badlogin.php" page. In
fact, CVE-2005-3692 mentions that "&retid" parameter in "badlogin.php" page
is vulnerable to XSS attacks. But it does not mention "&lid" parameter".
The scipID of the bug is 26980. Bugtraq (SecurityFocus) ID is 15493. OSVDB
ID is 20926.







*References:*
http://tetraph.com/security/xss-vulnerability/winmail-server-4-2-reflected-xss/
http://securityrelated.blogspot.com/2015/08/winmail-server-42-reflected-xss.html
http://seclists.org/fulldisclosure/2015/May/103
http://marc.info/?l=full-disclosure&m=143110916812709&w=4
http://permalink.gmane.org/gmane.comp.security.fulldisclosure/2028
http://webtech.lofter.com/post/1cd3e0d3_6eef8c8
http://whitehatpost.blog.163.com/blog/static/242232054201573091630996/
https://hackertopic.wordpress.com/2015/08/25/winmail-server-4-2-reflected-xss/
http://whitehatview.tumblr.com/post/118853357881/tetraph-cve-2014-9468-instantasp
http://marc.info/?l=full-disclosure&m=142649827629327&w=4
https://packetstormsecurity.com/files/132029/SITEFACT-CMS-2.01-Cross-Site-Scripting.html






--
Jing Wang,
Division of Mathematical Sciences (MAS),
School of Physical and Mathematical Sciences (SPMS),
Nanyang Technological University (NTU), Singapore.
http://www.tetraph.com/wangjing/
https://twitter.com/justqdjing

--089e0122f724742a3a051e8790c1--
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC