Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
iPlanet Messaging Server HTML Attachment Viewing Permits Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1006859
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: May 28 2003
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Advisory: Infohacking
|
Description: An input validation vulnerability was reported in the iPlanet Messaging Server. A remote user can conduct cross-site scripting attacks against users on the mail server to steal session authentication information.
Infohacking Research reported that iPlanet Messaging Server permits HTML attachments to be viewed while online and in the security
context of the web server.
A remote user can create a specially crafted HTML attachment that, when opened by a target user, will
cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the iPlanet
Messaging Server software and will run in the security context of that site. As a result, the code will be able to access the target
user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target
user via web form to the site, or take actions on the site acting as the target user.
A demonstration exploit attachment is provided:
<html>
<script>alert(document
.URL)</script>
</html>
|
Impact: A remote user can access the target user's cookies (including authentication information), if any, associated with the site running
the mail server software, access data recently submitted by the target user via web form to the site, or take actions on the site
acting as the target user.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.sun.com/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (NT), Windows (2000)
|
Reported By: Hugo "Vazquez" "Carames" <overclocking_a_la_abuela@hotmail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: 27 May 2003 13:54:40 -0000
From: Hugo "V zquez" "Caram s" <overclocking_a_la_abuela@hotmail.com>
Subject: Possible XSS on iPlanet Messaging Server
|
While playing around with the webmail server (Iplanet Messaging) of my old
ISP (Terra Networks) I noticed something really strange that I could not
believe in: it was possible to do a XSS through an html attachment. In
fact, with Iplanet Messaging you can open an html attachments "online", so
the code is executed in the webmail domain context... ooops!
First I tried a script to steal the cookie, and it worked. Then I tried it
on others Iplanet installations and I could not get the cookie... :-(
I don`t exactly know how Iplanet Messaging tracks http sessions, but after
looking some of the http flow, I think it only looks for a session
id "sid" parameter.The "SID" is sent in any request in the URI request, so
it seems there's no need for any cookie... My old ISP (www.terra.es),
seems to be using although cookies, and some kind of javascript filtering
(Maybe Firewall-1 resource), but it's easy to trick the filtering device
(it looks inside "body" tags, but the script doesn't need those tags to be
executed),... but this is another story.
So, for Iplanet Messaging: it seems that you can execute scripts on the
webmail domain context, and an attacker can use it to steal Session ID's.
Our tests have been done on two environments, HTTP and HTTPS, both of them
successfully exploited.
How to reproduce:
All you have to do is send an attachment with the next code:
<html>
<script>alert(document.URL)</script>
</html>
The URL in the alert box has the "sid" we are looking for.
Notice that, it's really easy to exploit this, the attacker do not need to
create a special crafted HTTP request with a stolen cookie header, he only
needs to do a "copy-paste" of the URL...
Can anyone replicate this?
Is this an Iplanet Messaging bug?
Any feedback will be appreciated,
Sincerely,
Hugo Vázquez Caramés & Toni Cortés Martínez
INFOHACKING RESEARCH 2003
http://www.infohacking.com
Barcelona
Spain
|
|
Go to the Top of This SecurityTracker Archive Page
|
