Outlook mailto: URL argument injection vulnerability

[Jouko Pynnonen]

OVERVIEW
========

Microsoft Outlook contains a vulnerability which allows execution of
arbitrary code when a victim user views a web page or an e-mail message
created by an attacker.



DETAILS
=======

During Outlook installation, a mailto: URL handler is registered to the
system. When a mailto: URL is opened, the system starts OUTLOOK.EXE
with the following arguments:

OUTLOOK.EXE -c IPM.Note /m "mailto:email@address"

If the URL contains a quote symbol, additional command line arguments
can be injected to OUTLOOK.EXE. The program recognizes several command
line switches. Also a startup URL to be opened by Outlook can be
supplied on command line. This URL can be a javascript: URL, and if the
"Outlook today" page is the current view in Outlook, the JavaScript
code will be executed in the "Local machine" zone. This allows an
attacker to e.g. download and start a desired EXE program.

A web page or e-mail message exploiting this flaw may contain for
instance an IMG tag to refer to a mailto: URL. The victim user need not
click on a link.

If the "Outlook today" view isn't the default view in Outlook, the
attacker can still carry out the attack by using two mailto: URLs; The
information in the mitigating factors section of Microsoft's bulletin
regarding this is inaccurate. The first mailto: URL would start
OUTLOOK.EXE and cause it to show the "Outlook today" view, and the
second one would supply the offending JavaScript code. This scenario
was verified by an exploit.

The issue is not a standard "cross site scripting" vulnerability, but a
different kind of injection attack. The exploit can inject command line
switches and arguments to OUTLOOK.EXE because quote symbols in the URL
aren't escaped or otherwise processed. This can be considered a new
vulnerability category, and further investigation has shown that
similar attacks can be carried out against other software which register
a URL handler.



AFFECTED VERSIONS
=================

According to Microsoft the affected supported versions are Microsoft
Office XP SP2 and Microsoft Outlook 2002 SP 2. Some earlier versions
are vulnerable too, but not supported by the vendor.



SOLUTION
========

Microsoft was informed on July 21st, 2003 and has released an update
to correct the problem. A bulletin describing the update can be seen
at

http://www.microsoft.com/technet/security/Bulletin/MS04-009.mspx



CREDITS
=======

The vulnerability was discovered and researched by Jouko Pynnönen,
Finland.




--
Jouko Pynnönen Web: http://iki.fi/jouko/
jouko@iki.fi GSM: +358 41 5504555

[=?iso-8859-1?q?Shaun=20Colley?=]

Hello Bugtraq,

For those interested in testing the impact of this
vulnerability, I have written a simple, non-malicious
PoC for this issue:

http://www.nettwerked.co.uk/code/outlooksploit.html


If you'd rather not visit an unverified link, here's
the code:


###outlooksploit.html
<!-- Outlook mailto: URL argument injection
proof-of-concept exploit,
by shaun2k2. The exploit can be easily modified
to execute more
malicious things.
-->

<html>
<body>
<!-- This is the exploit string. -->
<img src="mailto:aa&quot; /select
javascript:alert('vulnerable')">
</body>
</html>
###EOF

If you're vulnerable, Outlook will launch and you will
see an alert box saying "vulnerable". Also, depending
on what version you are using, you might get an error
box saying outlook cannot load and that the command
line argument was not valid. Either way, you are
still vulnerable, I believe. I recommend you upgrade
:).

Obviously, the exploit could be easily modified to do
more malicious things, but this at least demonstrates
the issue.



Thank you for your time.
Shaun.





__________________________________________________ _________
Yahoo! Messenger - Communicate instantly..."Ping"
your friends today! Download Messenger Now
http://uk.messenger.yahoo.com/download/index.html