SquirrelMail Cross Scripting Attacks....

[Alvin Alex]

SquirrelMail latest version (although is tested on version 1.4.2) is prone to many cross scripting attacks that can be used to steal user cookies.The Exploit lies in the way squirrel mail represents the folder names and shows them.To make the matters wors
e.No extra unique variable added to the url for each user therefore it is easy for the attacker to just pass the url in mail and steal the session cookie.

Some of the exploit are at :

http://victim.com/mail/src/compose.php?mailbox=INBOX

which can be replaced as follows

http://victim.com/mail/src/compose.php?mailbox="><script>malacious script</script>

Example:

http://victim.com/mail/src/compose.php?mailbox="><script>window.alert(document.cookie)& lt;/script>

-------------------------------------------------------------------------

Squirrel Mail Coders have been informed of this vulnerability but the vulnerability still exists in their latest version.

-------------------------------------------------------------------------

Please Let me know if i am wrong anywhere...

Regards,
Alvin

[Jonathan Angliss]

Hello Alvin,
On Thursday, April 29, 2004, Alvin Alex wrote...

> SquirrelMail latest version (although is tested on version 1.4.2) is
> prone to many cross scripting attacks that can be used to steal user
> cookies.

[..]

> Squirrel Mail Coders have been informed of this vulnerability but
> the vulnerability still exists in their latest version.

PLEASE in future notify us before posting bug reports so we can ensure
a fix is in place... The 1.4.3 release which will be out shortly will
fix this issue, along with a number of other XSS issues. While we had
been notified of the issue, we were holding off on announcing the
issue until a fix was in place.

--
Jonathan Angliss
(jon@squirrelmail.org)