|
MailSite Express Attachment Upload and Script Insertion
|
|
Secunia Advisory:
|
SA17240
|
|
|
Release Date:
|
2005-10-18
|
|
Last Update:
|
2006-01-19
|
|
Popularity:
|
6,066 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Cross Site Scripting
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | MailSite 6.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2005-3428
CVE-2005-3429
CVE-2005-3430
CVE-2005-3431
|
|
Description:
Some vulnerabilities have been discovered in MailSite Express, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to conduct script insertion attacks.
1) The problem is that it is possible to upload attachments with an arbitrary file extension to a cache folder with a predictable name inside the web root. This can be exploited to upload and execute malicious script files (e.g. PHP and ASP scripts).
2) Input passed in the mail body of incoming mails isn't properly sanitised before being displayed to the user. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious mail is viewed.
It is reportedly also possible to attach arbitrary files via the "AttachPath" parameter.
The vulnerabilities have been confirmed in version 6.1.20. Other versions may also be affected.
Solution:
Update to version 6.1.22.
http://www.rockliffe.com/userroom/download.asp
Provided and/or discovered by:
1) Independently discovered by:
* Soroush dalili, Grayhatz security group
* Paul Craig
2) Paul Craig
Changelog:
2005-10-24: Updated "Solution" section.
2005-10-28: Added vulnerability provided by Paul Craig.
2006-01-19: Added CVE references.
Original Advisory:
http://www.security-assessment.com/Ad...e_Express_Webmail_Vulnerabilities.pdf
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
