[UNIX] SquirrelMail Address Add Plugin XSS

From: SecuriTeam (support_at_securiteam.com)
Date: 09/29/05

  • Next message: SecuriTeam: "[UNIX] Serendipity Account Hijacking and CSRF Vulnerability" 
    To: list@securiteam.com
Date: 29 Sep 2005 16:53:04 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      SquirrelMail Address Add Plugin XSS
    ------------------------------------------------------------------------

    SUMMARY

    A XSS vulnerability has been detected in the Address Add Plugin for
    Squirrelmail. The problem is caused by insufficient input sanitation.

    DETAILS

    Vulnerable Systems:
     * Squirrelmail version 1.4.0 or newer with Address Add Plugin version 1.9
    or 2.0

    Immune Systems:
     * Squirrelmail version 1.4.0 or newer with Address Add Plugin version 2.1
    or newer

    Sending a HTML email containing an IMG tag which provides a SRC attribute
    pointing at the vulnerable plugin may allow an attacker to retrieve the
    victims' cookie and session information without the victim being aware.
    The exploit may be triggered when the victim clicks on a specially crafted
    URL contained in the email and hovers the address book form field.

    The following partial URL demonstrates the issue:

    /squirrelmail_root_dir/plugins/address_add/add.php?
    first=HOVER%20ME!%22%20onMouseOver=%22alert('foo');

    Move your mouse pointer over the input field which says so.

    Other variables on this script can be misused in the same way.

    Disclosure Timeline:
    Sep 24, 2005: Maintainer informed
    Sep 25, 2005: First maintainer reply
    Sep 25, 2005: Maintainer provides fix
    Sep 29, 2005: Public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:info@moritz-naumann.com>
    Moritz Naumann.
    The original article can be found at:
    <http://moritz-naumann.com/adv/0002/sqmadd/0002.txt>
    http://moritz-naumann.com/adv/0002/sqmadd/0002.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Serendipity Account Hijacking and CSRF Vulnerability"

    Relevant Pages