[UNIX] Horde Framework and Horde IMP /index.php Cross Site Referencing
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 21 Aug 2006 09:44:09 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Horde Framework and Horde IMP /index.php Cross Site Referencing
------------------------------------------------------------------------
SUMMARY
<http://www.horde.org/> Horde is "an open-source web application
framework based on PHP. It offers popular applications, such as the Horde
IMP mail client, a groupware and wiki solution". Marc Ruef found several
web-based vulnerabilities that were identified in Horde 3.0.4 and verified
for all versions prior to 3.1.2 and IMP prior to 4.1.3.
DETAILS
Horde is using a frameset to present the output to the user. The top frame
has the name horde_menu and the bottom frame has the name horde_main. The
main file index.php allows the definition of a source by using the PHP
variable $_GET['url']. An attacker might be able to do a cross referencing
and inserting malicious web site resources.
This is very useful within technical supported phishing attacks. The
legitimate user might not be able to determine the real source of the
presentation. And therefore the attacker might be able to intercept the
communication and fetch some sensitive data.
Exploitation:
Classic script injection techniques within a browser session can be used
to exploit this vulnerabilities. [1, 2]
A plugin for our open-source exploiting framework "Attack Tool Kit" (ATK)
will be published in the near future. [3]
Impact:
Because non-authenticated parts of the software are affected too, this
vulnerabilities are serious for every secure environment.
Non-authenticated users might be able to exploit this flaw to gain
elevated privileges (e.g. extracting sensitive cookie information or
launch a buffer overflow attack against another web browser).
The other parts are affecting authenticated parts. This requires a
legitimate user to exploit the vulnerabilities. However, because cross
site scripting attacks could be launched from external attackers, these
vulnerabilities still become a high risk rating.
Detection:
Detection of web based attacks requires a specialized web proxy and/or
intrusion detection system. Patterns for such a detection are available
and easy to implement.
Solution:
The cross site scripting vulnerability (4) has been fixed in CVS HEAD
(Juli 2006) and FRAMEWORK_3. The other vulnerabilities were addressed in
the current release 3.1.2 and IMP 4.1.3.
Vendor response:
The Horde team has been informed at 07/04/2006 via email to
security-at-horde.org. A first response came back on the same day. Several
email messages were exchanged to discuss the vulnerabilities and to
co-ordinate the disclosure of this advisory.
Disclosure timeline:
05/15/06 Identification of the vulnerabilities
07/04/06 Informing the Horde team
07/04/06 First reply of the Horde team
08/16/06 Public advisory
References:
[1] <http://www.computec.ch/download.php?view.812>
http://www.computec.ch/download.php?view.812
[2] <http://www.computec.ch/download.php?view.808>
http://www.computec.ch/download.php?view.808
[3] <http://www.computec.ch/projekte/atk/>
http://www.computec.ch/projekte/atk/
ADDITIONAL INFORMATION
The information has been provided by <mailto:maru@xxxxxxx> Marc Ruef.
The original article can be found at:
<http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2456>
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2456
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NT] Breaking EnCase - Hiding Deleted Files From EnCase
- Next by Date: [UNIX] PHP File-Upload $GLOBALS Overwrite Vulnerability
- Previous by thread: [NT] Breaking EnCase - Hiding Deleted Files From EnCase
- Next by thread: [UNIX] PHP File-Upload $GLOBALS Overwrite Vulnerability
- Index(es):
Relevant Pages
|
