2013-004: Reflected XSS in the view attachment message process of the Atmail WebMail <= v7.0.2

Original release date: March 9th, 2013
Last revised: March 25th, 2013
Discovered by: Vicente Aguilera Díaz
Severity: 4.3/10 (CVSSv2 Base Scored)
CVE-ID: CVE-2013-2585

BACKGROUND

Atmail allows users to access IMAP Mailboxes of any server of your choice. The software provides a comprehensive email-suite for accessing user mailboxes, and provides an inbuilt Calendar and Addressbook features. The WebMail Client of Atmail supports any existing IMAP server running under Unix/Linux or Windows systems.

DESCRIPTION

Has been detected a reflected XSS vulnerability in the view attachment message process of the Atmail WebMail, that allows the execution of arbitrary HTML/script code to be executed in the context of the victim user's browser.

The code injection is done through the file name parameter, and requires that the user victim is authenticated in the WebMail.

PROOF OF CONCEPT 

When a user opens a file attachment in an email, the link is as follows:

http://<atmail-server>/index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<ID>/filenameOriginal/<file>

where:
- is the Atmail WebMail server
- is the unique ID for the message that contains the attachment
- is the attachment file in the message
A malicious user can inject arbitrary HTML/script code in the parameter. For example:

http://<atmail-server>/index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<ID>/filenameOriginal/test.txt<H1><marquee>This+is+an+XSS+example

BUSINESS IMPACT

An attacker can execute arbitrary HTML or script code in a targeted user's browser, this can leverage to steal sensitive information as user credentials, personal data, etc.

SYSTEMS AFFECTED

Tested in Atmail 7.0.2. Other versions may be affected too.

SOLUTION

Update to version 7.0.3.

REVISION HISTORY

March 9, 2013: Initial release

DISCLOSURE TIMELINE

  • March 9, 2013: Vulnerability acquired by Internet Security Auditors (www.isecauditors.com).
  • March 10, 2013: Contacts to Atmail without response.
  • March 19, 2013: Second attempt: Twitting. Third: Facebooking. Let's get Social!
  • March 21, 2013: Response and sent to Security Team.
  • March 25, 2013: Version 7.0.3 published.

REFERENCES

LEGAL NOTICES

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.

ABOUT

Internet Security Auditors is a Spain and Colombia based company leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us.