Title : Cross-Site-Scripting Vulnerability in Horde IMP. Date : November 17, 2005 Product : Horde MIME Viewer <3.0.7 vulnerability Discovered by : Daniel Schreckling Overview ====================================================================== The Horde [http://www.horde.org] Project comprises a set of Web-based productivity, messaging, and project-management applications, each of which is described below. The Horde Framework is a common code-base used by Horde applications, including libraries and a common user interface. IMP [http://www.horde.org/imp/] is the Internet Messaging Program (formerly, among other things, the IMAP webMail Program), a webmail system and a component of the Horde project. IMP is the most widely-deployed component of Horde. IMP offers most of the features users have come to expect from their conventional mail programs, including attachments, spell-check, address books, multiple folders, and multiple-language support. Among other features the Internet Messaging Program offers the possibility to display inline attachments using so called MIME viewers. Due to a mishandling of these attachments in some viewers a possible attacker can infiltrate arbitrary JavaScript code, delete messages, steal authentication or session cookies etc. Details ====================================================================== Due to security concerns Horde IMP and its internal MIME viewers respectively prevent to display inline messages by default. As an example, HTML pages, that may contain malicious code are not displayed. It goes one step further and filters these HTML pages when the display of these attachment is enforced by the user, this is, possibly harmful client side code as <script> tags are deleted. The same behavior is expected with files which were packed using gzip. However, The Horde Mime Viewer erroneously handles gzip inline attachments differently. It simply unpacks (if supported by the server) these files and displays them as inline code within IMP. Thus, if the compressed file contains malicious code such as JavaScript a possible attacker is able to execute arbitrary code to manipulate the web interface, delete messages or steal cookies. Example: - Copy <script>alert("Test");</script> into a file. * Compress this file using gzip * Send the file as an inline attachment to your email account * Open the mail you received with your Horde application and the message will popup. The same effect can be observed when using other applications that produce intermediate formats. Example: - Before compressing the file in the last example, simply tar it and proceed as you did before. * Same effect. Impact ====================================================================== Possible disclosure of user/session information and possible harm to the user due to deleted/manipulated messages/address books. This vulnerability is only exploitable if the vulnerable version of the Horde MIME viewer is used together with a remotely accessible interface like Horde IMP. Solution/workaround ====================================================================== As long as this glitch is unremedied the display of any inline message should be prevented (see config/mime_drivers.php). As an alternative the css and tgz MIME drivers can be disabled by removing them from the $mime_drivers_map['horde']['registered'] list in horde/config/mime_drivers.php Horde also provides two patches to remove this vulnerability. For more details please see the Horde 3.0.7 security release. References ====================================================================== Horde http://www.horde.org Horde IMP http://www.horde.org/imp/ Horde 3.0.7 security release http://lists.horde.org/archives/announce/2005/000232.html About Daniel Schreckling ====================================================================== Since 2004, Daniel Schreckling (http://www.informatik.uni-hamburg.de/SVS/personnel/daniel/) is a member of the Research Unit "Security in Distributed Systems" (http://www.informatik.uni-hamburg.de/SVS/) at the University of Hamburg.
