AOH :: HP Unsorted I :: VA3372.HTM

IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader
IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader
IceWarp WebMail Server: User-assisted Cross Site Scripting in RSS Feed Reader

Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Advisory: IceWarp WebMail Server: User-assisted Cross Site Scripting in
          RSS Feed Reader

During a penetration test, RedTeam Pentesting discovered that the
IceWarp WebMail Server is prone to user-assisted Cross Site Scripting
attacks in its RSS feed reader. If attackers control or compromise an
RSS feed users are subscribed to, they can run arbitrary JavaScript code
in the users' browsers by embedding it within the feed.

Product: IceWarp eMail Server / WebMail Server
Affected Versions: 9.4.1
Fixed Versions: 9.4.2
Vulnerability Type: Cross Site Scripting
Security Risk: medium
Vendor URL: 
Vendor Status: notified, fixed version released
Advisory URL: 
Advisory Status: published
CVE: CVE-2009-1467

"Feature complete yet easy to use, WebMail Server Pro provides feature
rich Web 2.0 web-based access to email, calendars, contacts, files and
shared data from any computer with browser and internet connection,
without the usual configuration hassle. Thanks to advanced technologies
and application-like look and feel, Pro suggests it was born to become
the ultimate replacement of Outlook and similar desktop mail clients."

(from the vendor's homepage)

More Details
Users of the IceWarp WebMail Server can add RSS feeds as folders to
their folder list. The parsing of such feeds is done in the PHP file


The individual items of an RSS channel are handled in


In the function getHTML(), the final HTML page for an item is assembled
and returned. The "title" and "description" keys correspond to the
 and <description> elements in the feed, the "href" key to the
<link> element:

159   public function getHTML(&$aItem)
160   {
161       $aHTML['title'] = $this->subject;
162       $aHTML['href'] = $this->to;
163       $aHTML['description'] = Tools::cleanHTML($this->body,$base);
165       $aURL = parse_url($this->to);
166       $aItem['base'] = $aURL['host'];
168       @$sHTML = htmlspecialchars(
170       return $sHTML;
171   }

Only the description gets sanitised by the cleanHTML() function, "title"
and "href" are embedded unmodified into the final HTML page.

This means that HTML or JavaScript code embedded in an item's <title> or
<link> element of an RSS feed users are subscribed to will be executed
as soon as they click on the item to display it. HTML and JavaScript
code within the <description> element of an item is sanitised, but the
sanitisation can be bypassed in the same way as described in RedTeam
Pentesting's advisory rt-sa-2009-001, "IceWarp WebMail Server: Cross
Site Scripting in Email View".

Attackers have two options for exploiting this vulnerability: First,
they can embed malicious code in a feed they control and convince users
to subscribe to this feed. Second, they can change RSS feeds the users
are already subscribed to by exploiting vulnerabilities in the systems
providing these feeds.

Proof of Concept
The following RSS feed contains JavaScript code in the <title> and
<description> elements that displays a message containing the user's
session ID. This code gets executed when users click on the item to view

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0">
    <title>RedTeam Pentesting
      type="application/rss+xml" /> 
    Seeing your network from the attacker's perspective
    Mon, 16 Apr 2009 05:23:42 +0000
      <script>alert('Title: Your session id is: ' +;</script> 
      Mon, 16 Apr 2009 05:23:42 +0000
        <div o<xml>nmouseover="alert('Description: Your session id is: ' +">
          RedTeam Pentesting XSS



Upgrade to version 9.4.2.

Security Risk
Attackers who can inject JavaScript code into RSS feeds that users are
subscribed to, or who can get users to subscribe to such RSS feeds, can
execute any JavaScript code on the users' behalf. This will let them
control the web application on a victim user's behalf and access any
information accessible to that user, for example emails and files. It
can also be used to to steal the users' sessions and hijack their
accounts. Therefore the risk is estimated as medium.

2009-03-23 Vulnerabilities identified during a penetration test
2009-04-01 Meeting with customer and vendor
2009-04-28 CVE number assigned
2009-05-05 Vendor publishes fixed version
2009-05-05 Advisory released

RedTeam Pentesting GmbH
RedTeam Pentesting is offering individual penetration tests, short
pentests, performed by a team of specialised IT-security experts.
Hereby, security weaknesses in company networks or products are
uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at 

RedTeam Pentesting GmbH                    Tel.: +49 241 963-1300
Dennewartstr. 25-27                        Fax : +49 241 963-1304
52068 Aachen 
Germany                         Registergericht: Aachen HRB 14004
Gesch=E4ftsf=FChrer: Patrick Hof, Jens Liebchen, Claus R. F. Overbeck

Content-Type: application/pgp-signature
Content-Disposition: inline

Version: GnuPG v1.4.9 (GNU/Linux)



The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to