IlohaMail Insecure Configuration Files
------------------------------------------------
Advisory Name : IlohaMail Insecure Configuration Files
Release Date : 10 January, 2004
Application : IlohaMail (http://ilohamail.org/)
Vulnerable: IlohaMail-0.8.14-rc1 and lower
Not Vulnerable: IlohaMail-0.8.14-rc2
Author : SRR Project Group of Ready Response (srr.readyresponse.org /
www.readyresponse.org)
------------------------------------------------
Description
IlohaMail is a PHP based lightweight full featured multilingual webmail program
with IMAP and POP3 support. If an administrator follows the "INSTALL" file
steps to install IlohaMail they will end up with an insecure setup that could
allow a remote visitor to the web site to download their configuration files
and in some cases obtain username/password credentials for SMTP authentication
(very useful to spammers).
The problem exists primarily due to the use of the file extension ".inc" on a
number of important configuration files, such as:
conf/conf.inc
conf/custom_auth.inc
conf/login.inc
The problem is made worse because the installation instructions do not
correctly inform the end user of how to securely setup their IlohaMail. ".inc"
is not a secure file extension to use, and therefore if the .inc configuration
files are within the web root (a result of following the INSTALL file steps)
they will be publicly accessible/readable via the URL:
http://yourdomain.com/IlohaMail/conf/conf.inc
etc
This is dangerous as it can potentially reveal the following information to any
remote visitor:
* File paths to important directories (upload directories for mail attachments,
session storage directories etc)
* Authenticated SMTP credentials (highly valuable information to spammers)
* Other useful information for potential attackers
------------------------------------------------
Exploit
No exploit is required to leverage this issue.
------------------------------------------------
Solution / Vendor Response
Our suggested fix to the IlohaMail team was to stop using the ".inc" file
extension and instead use a more secure file extension such as ".inc.php" or
".php" for all include files.
The IlohaMail team were contacted on 15/12/2004 and promptly replied +
investigated this issue. We were informed on 23/12/2004 that the IlohaMail team
would be fixing this issue in 0.9 and would be implementing a workaround for
0.8 releases.
IlohaMail-0.8.14-rc2 was released on 01/01/2005 and has addressed this issue.
We would like to thank IlohaMail for their fast response and professional
attitude to security.
------------------------------------------------
Credit
Discovery of this issue is credited to the SRR project group of Ready Response
- (srr.readyresponse.org / www.readyresponse.org)