<<< Date Index >>>     <<< Thread Index >>>

IlohaMail Insecure Configuration Files





------------------------------------------------

Advisory Name : IlohaMail Insecure Configuration Files
Release Date : 10 January, 2004
Application : IlohaMail (http://ilohamail.org/)
Vulnerable: IlohaMail-0.8.14-rc1 and lower
Not Vulnerable: IlohaMail-0.8.14-rc2

Author : SRR Project Group of Ready Response (srr.readyresponse.org / 
www.readyresponse.org)

------------------------------------------------

Description

IlohaMail is a PHP based lightweight full featured multilingual webmail program 
with IMAP and POP3 support. If an administrator follows the "INSTALL" file 
steps to install IlohaMail they will end up with an insecure setup that could 
allow a remote visitor to the web site to download their configuration files 
and in some cases obtain username/password credentials for SMTP authentication 
(very useful to spammers).

The problem exists primarily due to the use of the file extension ".inc" on a 
number of important configuration files, such as:
 
conf/conf.inc
conf/custom_auth.inc
conf/login.inc

The problem is made worse because the installation instructions do not 
correctly inform the end user of how to securely setup their IlohaMail. ".inc" 
is not a secure file extension to use, and therefore if the .inc configuration 
files are within the web root (a result of following the INSTALL file steps) 
they will be publicly accessible/readable via the URL:

http://yourdomain.com/IlohaMail/conf/conf.inc
etc

This is dangerous as it can potentially reveal the following information to any 
remote visitor:

* File paths to important directories (upload directories for mail attachments, 
session storage directories etc)

* Authenticated SMTP credentials (highly valuable information to spammers)

* Other useful information for potential attackers

------------------------------------------------
 
Exploit
 
No exploit is required to leverage this issue.
 

------------------------------------------------
 
Solution / Vendor Response

Our suggested fix to the IlohaMail team was to stop using the ".inc" file 
extension and instead use a more secure file extension such as ".inc.php" or 
".php" for all include files. 

The IlohaMail team were contacted on 15/12/2004 and promptly replied + 
investigated this issue. We were informed on 23/12/2004 that the IlohaMail team 
would be fixing this issue in 0.9 and would be implementing a workaround for 
0.8 releases.

IlohaMail-0.8.14-rc2 was released on 01/01/2005 and has addressed this issue.

We would like to thank IlohaMail for their fast response and professional 
attitude to security.


------------------------------------------------
 
Credit
 
Discovery of this issue is credited to the SRR project group of Ready Response 
- (srr.readyresponse.org / www.readyresponse.org)