<<< Date Index >>>     <<< Thread Index >>>

Multiple vulnerabilities in Icewarp Web Mail 5.3.0: New holes




ShineShadow Security Report  26012005-03

TITLE: Multiple vulnerabilities in Icewarp Web Mail 5.3.0 : New holes.

BACKGROUND

Merak Mail Server, with the revolutionary Merak Mail Server GroupWare Server, 
cutting-edge Merak Mail Server Instant Antispam and much more, is the fastest, 
most stable, secure and 100% virus free mail server on the market today. 
Every day companies choose Merak Mail Server's stability, speed, security, 
functionality, scalability and multi-tiered delegated manageability over 
products costing thousands of dollars more yet lacking the sophistication that 
Merak delivers.
In less than 10 minutes you can have the same professional email server that 
organizations such as NATO, the U.S. Navy, the FBI, Toyota, the U.S. 
Government, and many ISP Providers and Developers depend on every day.

Source: www.MerakMailServer.com

VULNERABLE PRODUCTS

MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0
MERAK Mail Server 7.6.4r with Icewarp Web Mail 5.3.2 (vulnerabilities #2,#3 
only)

DETAILS

1. Multiple cross-site scripting (XSS) vulnerabilities.

Description: 
Remote user, who HAS account on Merak Mail Server, can execute cross-site 
scripting (XSS) attack.

Vulnerable pages:
login.html
accountsettings_add.html
calendar_addnote.html
calendar_addtask.html
calendar_addevent.html

Examples:
http://localhost:32000/mail/login.html?username=[xss_here] 
http://localhost:32000/mail/accountsettings_add.html?id=[]&Save_x=1&account[EMAIL]=hacker&account[HOST]=blackhat.org&account[HOSTUSER]=hacker&account[HOSTPASS]=31337&account[HOSTPASS2]=31337&accountid=[xss_here]
http://localhost:32000/mail/calendar.html -> AddNote -> [Title]= [xss_here]
http://localhost:32000/mail/calendar.html -> AddTask -> [Note]=[xss_here]
http://localhost:32000/mail/calendar.html -> AddEvent -> [Note]=[xss_here]
http://localhost:32000/mail/calendar.html -> AddEvent -> [Title]= [xss_here]
http://localhost:32000/mail/calendar.html -> AddEvent -> [Location]= [xss_here]

2. Full install path disclosure.

Description:    
Remote user, who HAS account on Merak Mail Server, can disclosure full install 
path of the product. It could be used during attack on an affected system.

Vulnerable pages: 
calendar_d.html
calendar_m.html
calendar_w.html
calendar_y.html

Examples: 
http://localhost:32000/mail/calendar_d.html?id=[sessionid]
http://localhost:32000/mail/calendar_m.html?id=[sessionid]
http://localhost:32000/mail/calendar_w.html?id=[sessionid]
http://localhost:32000/mail/calendar_y.html?id=[sessionid]

Note: MERAK Mail Server 7.6.4r with Icewarp Mail Server 5.3.2 also vulnerable 
to it.

3. Simple encryption of users passwords.

Description:    
Very simple encryption of users passwords in users.cfg, settings.cfg (XOR), 
users.dat, user.dat (BASE64). If attacker will get access to this files then he 
could take users and administrators passwords.

Vulnerable files:

[MerakDir] \config\settings.cfg
[MerakDir] \config\ [Domain] \users.cfg
[MerakDir] \webmail\config\users.dat
[MerakDir] \webmail\users\ [Domain] \ [User] \user.dat

Note: MERAK Mail Server 7.6.4r with Icewarp Mail Server 5.3.2 also vulnerable 
to it.

4. File creation with arbitrary content on remote system.

Description:    
Remote user, who HAS account on Merak Mail Server, can create text file on 
remote server with arbitrary content (include special characters). Path to the 
file will be [MerakDir]\webmail\users\[Domain]\[User]\accounts.dat.

Vulnerable page: accountsettings_add.html 

Example:
http://localhost:32000/mail/accountsettings_add.html?id=[sessionid]&Save_x=1&account[EMAIL]=hacker&account[HOST]=blackhat.org&account[HOSTUSER]=hacker&account[HOSTPASS]=31337&account[HOSTPASS2]=31337&accountid=[arbitary
 text]


5. Moving and viewing arbitrary files on remote system.

Description: 
Remote user, who HAS account on Merak Mail Server, can move arbitrary files on 
local file system of the target. The file will be moved to 
[MerakDir]\webmail\users\[Domain]\[User] folder and will be renamed to 
import.tmp. After that attacker can view this file and import/export it to/from 
address book. This vulnerability could be used for causing denial of service 
(DOS) conditions or access to arbitrary files on affected system. From files 
user.dat, users.dat attacker could get users and administrators passwords 
(vulnerability #3) and take complete control of a Merak Mail Server. With 
administrator privileges on Merak Mail Server the attacker using [Executables] 
function of the product could execute arbitrary commands on remote system with 
mailserver privileges. If Merak Mail Server was been running under 
administrator account then attacker could take complete control of an affected 
system. This vulnerability also could be used for verifying existing of the 
arbitrary files on 
 remote system.

Vulnerable page: importaction.html

Example:
http://localhost:32000/importaction.html?id=[sessionid]&importfile=[arbitrary 
path]&action=upload&Import=1&importfile_size=1000000


EXPLOITATION

IceWarp Web Mail (control.exe service) must be running on Merak Mail Server. 
Account on Merak Mail Server is needed.

WORKAROUND

Upgrade to MERAK Mail Server 7.6.4r with Icewarp Web Mail 5.3.2 or disable 
Icewarp Web Mail service (Control.exe).

VENDOR STATUS

Not contacted.

SUMMARY

An attacker who successfully exploited vulnerabilities described in this report 
could take complete control of a Merak Mail Server 7.6.0 or an affected remote 
system. Merak Mail Server 7.6.4r with Icewarp Web Mail 5.3.2 also vulnerable to 
other (undescribed in this report) critical vulnerabilities. An attacker who 
successfully exploited of this undescribed vulnerabilities could take complete 
control of a Merak Mail Server or an affected remote system. I am not advice to 
use this product, you must disable Icewarp Web Mail service. 
        
CREDITS

ShineShadow, undependent IT security expert. 
To get more information, please contact me by e-mail.

26.01.2005
ShineShadow,
ss_contacts@xxxxxxxxxxx