oss-security - squirrelmail XSS issues in bug tracker since 2016

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180627122609.11940d53@computer>
Date: Wed, 27 Jun 2018 12:26:09 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: squirrelmail XSS issues in bug tracker since 2016

Hi,

I found this in the squirrelmail bug tracker:
https://sourceforge.net/p/squirrelmail/bugs/2831/
I'll paste the content below to have it archived in oss-security.

Squirrelmail had reacted slowly to security issues in the past and has
not released a new version for a long time, however security bugs (like
one RCE in 2017 and one directory traversal in 2018) tended to be
fixed within the SVN repo and snapshots, so running a snapshot seemed
like a safe option.

However it seems this bug report got ignored. It lists 4 possible
scenarios / PoCs for XSS. From my quick judgement they are not all
legit:

PoC1: I couldn't reproduce it (either it's fixed or the browser
behavior changed, I haven't verified in-depth).
PoC2: This is "XSS-via-data-uri", a data URI runs in its own origin,
thus I don't see how this is a security risk. It's not really an XSS.
PoC3/PoC4: Works in Firefox, seems legit.

Preventing XSS in webmail is a hard problem, so I wouldn't be surprised
if there's more to be found.

-------------------

There are multiple XSS vulnerabilities in the mail message display
page(functions/mime.php),the function magicHTML can not filter some
special tags.

The steps to reproduce are below:

Compose email content via HTML mode(use any other webmail client).The
HTML content is below: PoC1 (triggered in Chrome,Firefox):

<svg><a xlink:href="javascript:alert(/XSS/)"><rect width="1000"
height="1000" fill="white"/></a></svg>

PoC2 (triggered in Chrome,Firefox,safari):

<form
action='data:text&sol;html,&lt;script&gt;alert(/XSS/)&lt/script&gt'><button></form>

PoC3 (triggered in Firefox):

<math><maction actiontype="" xlink:href="javascript:alert(/XSS/)">
Click here

PoC4 (triggered in Firefox):

<math xlink:href=javascript:alert(/XSS/)> Click here

Choose one of PoCs and send it to squirrelmail webmail system.

Log in to squirrelmail webmail system and view the mail received(HTML
Version is opened)

Click the area in the content.The xss will be triggered

Version:
The testing squirrelmail webmail version is 1.4.23.Link is below:
http://squirrelmail.org/download.php
php:5.3.17
apache:2.2.12

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno@...eck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.