Title : Cross-Site-Scripting Vulnerability in Horde IMP.
Date : November 17, 2005
Product : Horde MIME Viewer <3.0.7 vulnerability
Discovered by : Daniel Schreckling
Overview
======================================================================
The Horde [http://www.horde.org] Project comprises a set of Web-based
productivity, messaging, and project-management applications, each of which is
described below. The Horde Framework is a common code-base used by Horde
applications, including libraries and a common user interface.
IMP [http://www.horde.org/imp/] is the Internet Messaging Program (formerly,
among other things, the IMAP webMail Program), a webmail system and a component
of the Horde project. IMP is the most widely-deployed component of Horde.
IMP offers most of the features users have come to expect from their
conventional mail programs, including attachments, spell-check, address books,
multiple folders, and multiple-language support.
Among other features the Internet Messaging Program offers the possibility to
display inline attachments using so called MIME viewers. Due to a mishandling
of these attachments in some viewers a possible attacker can infiltrate
arbitrary JavaScript code, delete messages, steal authentication or session
cookies etc.
Details
======================================================================
Due to security concerns Horde IMP and its internal MIME viewers respectively
prevent to display inline messages by default. As an example, HTML pages, that
may contain malicious code are not displayed. It goes one step further and
filters these HTML pages when the display of these attachment is enforced by
the user, this is, possibly harmful client side code as <script> tags are
deleted.
The same behavior is expected with files which were packed using gzip. However,
The Horde Mime Viewer erroneously handles gzip inline attachments differently.
It simply unpacks (if supported by the server) these files and displays them as
inline code within IMP. Thus, if the compressed file contains malicious code
such as JavaScript a possible attacker is able to execute arbitrary code to
manipulate the web interface, delete messages or steal cookies.
Example:
- Copy <script>alert("Test");</script> into a file.
* Compress this file using gzip
* Send the file as an inline attachment to your email account
* Open the mail you received with your Horde application and
the message will popup.
The same effect can be observed when using other applications that produce
intermediate formats.
Example:
- Before compressing the file in the last example, simply tar it and
proceed as you did before.
* Same effect.
Impact
======================================================================
Possible disclosure of user/session information and possible harm to the user
due to deleted/manipulated messages/address books.
This vulnerability is only exploitable if the vulnerable version of the Horde
MIME viewer is used together with a remotely accessible interface like Horde
IMP.
Solution/workaround
======================================================================
As long as this glitch is unremedied the display of any inline message should
be prevented (see config/mime_drivers.php).
As an alternative the css and tgz MIME drivers can be disabled by removing them
from the $mime_drivers_map['horde']['registered'] list in
horde/config/mime_drivers.php
Horde also provides two patches to remove this vulnerability. For more details
please see the Horde 3.0.7 security release.
References
======================================================================
Horde
http://www.horde.org
Horde IMP
http://www.horde.org/imp/
Horde 3.0.7 security release
http://lists.horde.org/archives/announce/2005/000232.html
About Daniel Schreckling
======================================================================
Since 2004, Daniel Schreckling
(http://www.informatik.uni-hamburg.de/SVS/personnel/daniel/) is a member of the
Research Unit "Security in Distributed Systems"
(http://www.informatik.uni-hamburg.de/SVS/) at the University of Hamburg.
