[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20200514091149.4e807efa@computer>
Date: Thu, 14 May 2020 09:11:49 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Hypermail XSS via attachment
"Hypermail is a free (GPL) program to convert email from Unix mbox
format to html" [1]
It is commonly used to create mailing list archives.
Hypermail contains no validation or sanitation of mail attachments and
provides them as simple files. This means it's trivially vulnerable to
Cross Site Scripting (XSS).
One can simply attach a file to a mail with either no or an .html
extension and it can contain javascript/XSS payloads (e.g.
"<html><script>alert(document.domain)</script>").
The developer of Hypermail informed me that he is no longer interested
in Hypermail, thus there will probably be no fix.
This means using hypermail for public mailing list archives is
inherently risky if one runs anything else on the same host that may be
prone to XSS attacks (which is usually everything that includes any
form of authentication).
[1] http://www.hypermail-project.org/
--
Hanno Böck
https://hboeck.de/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
