SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Server)  >   Mirapoint Message Server Vendors:   Mirapoint
Mirapoint Message Server Input Validation Hole Permits Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1017146
SecurityTracker URL:  http://securitytracker.com/id/1017146
CVE Reference:   CVE-2006-5712   (Links to External Site)
Updated:  Jun 3 2008
Original Entry Date:  Nov 1 2006
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information


Description:   Tal Argoni (LegendaryZion) reported a vulnerability in Mirapoint Message Server. A remote user can conduct cross-site scripting attacks.

The webmail interface does not properly filter HTML code from user-supplied e-mail messages before displaying the e-mail. A remote user can send an HTML e-mail containing a specially crafted Cascading Style Sheets expression() method that, when viewed by the target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Mirapoint Message Server software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A demonstration exploit tag is provided:

<IMG style="width: expression(alert('expression'));">

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Mirapoint Message Server software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.mirapoint.com/ (Links to External Site)
Cause:   Input validation error

Message History:   None.


 Source Message Contents

Subject:  Cross Site Scripting (XSS) Vulnerability in Web Mail platform by


Issue: Cross Site Scripting (XSS) Vulnerability in Web Mail platform by "Mirapoint"
Discovered Date: 19/09/2006
Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com]
Product Vendor: http://www.mirapoint.com/

Details:

Mirapoint Web Mail platform is prone to a Cross Site Scripting Vulnerability.
The vulnerability exists in filter engine, caused by the lack of Input Validation/Filtering
of malicious Method "Expression()" of Cascading Style Sheets (CSS).

About Cascading Style Sheets (CSS):

Cascading Style Sheets (CSS) is a stylesheet language used to describe the presentation
of a document written in a markup language. Its most common application is to style web pages written
in HTML and XHTML.
English:
http://en.wikipedia.org/wiki/Cascading_Style_Sheets


About Expression() Method:

Receive string that specifies any valid script(JScript, JavaScript, VBSCript)
statement without quotations or semicolons. This string can include references to
other properties on the current page. Array references are not allowed on object
properties included in this script.

<ELEMENT STYLE="AttributeName:expression(Script)">

Exploitation Mail:

...
------=_NextPart_000_0006_01C6DD9E.26B2BBD0
Content-Type: text/html;

<IMG width="0" height="0" style="width: expression(alert('expression'));">
...


Successful exploitation may allow execution of script code. This could also be exploited
to spoof the entire website's content, stealing cookies, stealing session ID,
commit Denial Of Service attacks and more...

Proof Of Concept:

<IMG style="width: expression(alert('expression'));">

google it
http://www.google.com/search?num=100&&q=intitle%3A%22Webmail+Direct%22

Israels ISP using the web mail:
015 Internet Zahav -    http://smile.msn.co.il/
014 Bezeqint -  http://www.bezeqint.net/

Around the globe:
Sigecom -   http://www.sigecom.net
BBC Worldwide -   http://www.beeb.net/
Oakland -   http://www.oakgov.com/
Bank of Shanghai -  http://www.bankofshanghai.com/
University of Delaware - http://www.udel.edu/

Thanks,
Tal Argoni, CEH
www.zion-security.com
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC