Advisory: IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader
During a penetration test, RedTeam Pentesting discovered that the
IceWarp WebMail Server is prone to user-assisted Cross Site Scripting
attacks in its RSS feed reader. If attackers control or compromise an
RSS feed users are subscribed to, they can run arbitrary JavaScript code
in the users' browsers by embedding it within the feed.
### Details
- Product: IceWarp eMail Server / WebMail Server
- Affected Versions: 9.4.1
- Fixed Versions: 9.4.2
- Vulnerability Type: Cross Site Scripting
- Security Risk: medium
- Vendor URL: `http://www.icewarp.com/`
- Vendor Status: notified, fixed version released
- Advisory URL: `https://www.redteam-pentesting.de/advisories/rt-sa-2009-002`
- Advisory Status: published
- CVE: CVE-2009-1467
- CVE URL: `https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1467`
### Introduction
"Feature complete yet easy to use, WebMail Server Pro provides feature
rich Web 2.0 web-based access to email, calendars, contacts, files and
shared data from any computer with browser and internet connection,
without the usual configuration hassle. Thanks to advanced technologies
and application-like look and feel, Pro suggests it was born to become
the ultimate replacement of Outlook and similar desktop mail clients."
(from the vendor's homepage)
### More Details
Users of the IceWarp WebMail Server can add RSS feeds as folders to
their folder list. The parsing of such feeds is done in the PHP file
`html/webmail/server/inc/rss/rss.php`
The individual items of an RSS channel are handled in
`html/webmail/server/inc/rss/item.php`
In the function getHTML(), the final HTML page for an item is assembled
and returned. The "title" and "description" keys correspond to the
\
and \ elements in the feed, the "href" key to the
\ element:
```
159 public function getHTML(&$aItem)
160 {
161 $aHTML['title'] = $this->subject;
162 $aHTML['href'] = $this->to;
163 $aHTML['description'] = Tools::cleanHTML($this->body,$base);
164
165 $aURL = parse_url($this->to);
166 $aItem['base'] = $aURL['host'];
167
168 @$sHTML = htmlspecialchars(
template('inc/templates/rss.tpl',$aHTML)
);
169
170 return $sHTML;
171 }
```
Only the description gets sanitised by the cleanHTML() function, "title"
and "href" are embedded unmodified into the final HTML page.
This means that HTML or JavaScript code embedded in an item's \ or
\ element of an RSS feed users are subscribed to will be executed
as soon as they click on the item to display it. HTML and JavaScript
code within the \ element of an item is sanitised, but the
sanitisation can be bypassed in the same way as described in RedTeam
Pentesting's advisory [IceWarp WebMail Server: Cross
Site Scripting in Email View](../rt-sa-2009-001).
Attackers have two options for exploiting this vulnerability: First,
they can embed malicious code in a feed they control and convince users
to subscribe to this feed. Second, they can change RSS feeds the users
are already subscribed to by exploiting vulnerabilities in the systems
providing these feeds.
### Proof of Concept
The following RSS feed contains JavaScript code in the \ and
\ elements that displays a message containing the user's
session ID. This code gets executed when users click on the item to view
it:
```
RedTeam Pentesting
https://www.redteam-pentesting.de
Seeing your network from the attacker's perspectiveMon, 16 Apr 2009 05:23:42 +0000de<script>alert('Title: Your session id is: ' + window.top.sSID);</script>
https://www.redteam-pentesting.de/pentest
Mon, 16 Apr 2009 05:23:42 +0000
<div o<xml>nmouseover="alert('Description: Your session id is: ' + window.top.sSID)">
RedTeam Pentesting XSS
</div>
```
### Workaround
None.
### Fix
Upgrade to version 9.4.2.
### Security Risk
Attackers who can inject JavaScript code into RSS feeds that users are
subscribed to, or who can get users to subscribe to such RSS feeds, can
execute any JavaScript code on the users' behalf. This will let them
control the web application on a victim user's behalf and access any
information accessible to that user, for example emails and files. It
can also be used to to steal the users' sessions and hijack their
accounts. Therefore the risk is estimated as medium.
### History
- 2009-03-23 Vulnerabilities identified during a penetration test
- 2009-04-01 Meeting with customer and vendor
- 2009-04-28 CVE number assigned
- 2009-05-05 Vendor publishes fixed version
- 2009-05-05 Advisory released
### RedTeam Pentesting GmbH
RedTeam Pentesting offers individual penetration tests, short pentests,
performed by a team of specialised IT-security experts. Hereby, security
weaknesses in company networks or products are uncovered and can be
fixed immediately.
As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.
More information about RedTeam Pentesting can be found at
.