diff --git a/exploits/multiple/webapps/50496.txt b/exploits/multiple/webapps/50496.txt new file mode 100644 index 000000000..6c324b365 --- /dev/null +++ b/exploits/multiple/webapps/50496.txt @@ -0,0 +1,194 @@ +# Exploit Title: ImportExportTools NG 10.0.4 - HTML Injection +# Date: 2021-11-05 +# Exploit Author: Vulnerability Lab +# Vendor Homepage: https://github.com/thundernest/import-export-tools-ng +# Software Link: https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/ +# Version: 10.0.4 +# Tested on: Windows + +Document Title: +=============== +ImportExportTools NG 10.0.4 - HTML Injection Vulnerability + + +References (Source): +==================== +https://www.vulnerability-lab.com/get_content.php?id=2308 + + +Release Date: +============= +2021-11-05 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +2308 + + +Common Vulnerability Scoring System: +==================================== +4.2 + + +Vulnerability Class: +==================== +Script Code Injection + + +Current Estimated Price: +======================== +1.000€ - 2.000€ + + +Product & Service Introduction: +=============================== +Adds tools to import/export messages and folders (NextGen). + +(Copy of the Homepage:https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/ ) + + +Abstract Advisory Information: +============================== +The vulnerability laboratory core research team discovered a persistent validation vulnerability in the official ImportExportTools NG 10.0.4 for mozilla thunderbird. + + +Affected Product(s): +==================== +Christopher Leidigh +Product: ImportExportTools NG v10.0.4 - Addon (Mozilla Thunderbird) + + +Vulnerability Disclosure Timeline: +================================== +2021-10-07: Researcher Notification & Coordination (Security Researcher) +2021-10-08: Vendor Notification (Security Department) +2021-**-**: Vendor Response/Feedback (Security Department) +2021-**-**: Vendor Fix/Patch (Service Developer Team) +2021-**-**: Security Acknowledgements (Security Department) +2021-11-05: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +Medium + + +Authentication Type: +==================== +Pre Auth (No Privileges or Session) + + +User Interaction: +================= +Low User Interaction + + +Disclosure Type: +================ +Responsible Disclosure + + +Technical Details & Description: +================================ +A html inject web vulnerability has been discovered in the official ImportExportTools NG 10.0.4 for mozilla thunderbird. +The vulnerability allows a remote attacker to inject html payloads to compromise application data or session credentials. + +The vulnerability is located in the html export function. Subject content on export is not sanitized like on exports in mozilla itself. +Thus allows a remote attacker to send malicious emails with malformed a html payloads that executes on preview after a html export by +the victim user. + +Vulnerable Module(s): +[+] Export (HTML) + + +Proof of Concept (PoC): +======================= +The web vulnerability can be exploited by remote attackers without user account and with low or medium user interaction. +For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. + + +Manual steps to reproduce the vulnerability ... +1. Install mozilla thunderbird +2. Install ImportExportTools NG v10.0.4 +3. Use another email to write to the target inbox were the export takes place +Note: Inject into the subject any html test payload +4. Target user exports his content of the inbox in html were the payload executes +5. Successful reproduce of the encode validation vulnerability! + +Note: We reported some years ago the same issue that was also present in keepass and kaspersky password manager on exports via html and has been successfully resolved. + + +Vulnerable Source: ImportExportTools Exported HTML File +
+ + +Betreff | +Von | An | Datum | Anhang |
---|---|---|---|---|
+payload in subject "> | +test@vulnerability-lab.com" user@test-service.de |
+10/07/2021 |
+* | |