ShineShadow has reported some vulnerabilities in IceWarp Web Mail, which can be exploited by malicious users to detect the presence of local files, manipulate certain data and disclose sensitive information.

1) Input passed to the "folder" parameter in "viewaction.html" isn't properly verified. This can be exploited to move the user's home directory to the mail directory.

2) An error in "attachment.html" can be exploited to detect the presence of local files via the "attachmentpage_text_title" and "folder" parameters.

3) An error in "importaction.html" can be exploited to move arbitrary files to a user's home directory via the "importfile" parameter.

This can further be exploited to disclose the content of arbitrary files by importing the file to the address book or in combination with vulnerability 1.

It is also possible to disclose the full path to "calendar_addevent.html", "calendar_event.html" and "calendar_task.html" by accessing them without some required parameters.

The vulnerabilities have been reported in Merak Mail Server 8.0.3 with IceWarp Web Mail 5.4.2. Other versions may also be affected.

Solution
The vulnerabilities have been fixed in Merak Mail Server version 8.2 and IceWarp Web Mail version 5.5.

Provided and/or discovered by
ShineShadow

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers