3e60115da8
3 changes to exploits/shellcodes 10-Strike Network Inventory Explorer Pro 9.31 - 'srvInventoryWebServer' Unquoted Service Path Payment Terminal 3.1 - 'Multiple' Cross-Site Scripting (XSS) ImportExportTools NG 10.0.4 - HTML Injection
194 lines
No EOL
6.8 KiB
Text
194 lines
No EOL
6.8 KiB
Text
# Exploit Title: ImportExportTools NG 10.0.4 - HTML Injection
|
|
# Date: 2021-11-05
|
|
# Exploit Author: Vulnerability Lab
|
|
# Vendor Homepage: https://github.com/thundernest/import-export-tools-ng
|
|
# Software Link: https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/
|
|
# Version: 10.0.4
|
|
# Tested on: Windows
|
|
|
|
Document Title:
|
|
===============
|
|
ImportExportTools NG 10.0.4 - HTML Injection Vulnerability
|
|
|
|
|
|
References (Source):
|
|
====================
|
|
https://www.vulnerability-lab.com/get_content.php?id=2308
|
|
|
|
|
|
Release Date:
|
|
=============
|
|
2021-11-05
|
|
|
|
|
|
Vulnerability Laboratory ID (VL-ID):
|
|
====================================
|
|
2308
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
4.2
|
|
|
|
|
|
Vulnerability Class:
|
|
====================
|
|
Script Code Injection
|
|
|
|
|
|
Current Estimated Price:
|
|
========================
|
|
1.000€ - 2.000€
|
|
|
|
|
|
Product & Service Introduction:
|
|
===============================
|
|
Adds tools to import/export messages and folders (NextGen).
|
|
|
|
(Copy of the Homepage:https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/ )
|
|
|
|
|
|
Abstract Advisory Information:
|
|
==============================
|
|
The vulnerability laboratory core research team discovered a persistent validation vulnerability in the official ImportExportTools NG 10.0.4 for mozilla thunderbird.
|
|
|
|
|
|
Affected Product(s):
|
|
====================
|
|
Christopher Leidigh
|
|
Product: ImportExportTools NG v10.0.4 - Addon (Mozilla Thunderbird)
|
|
|
|
|
|
Vulnerability Disclosure Timeline:
|
|
==================================
|
|
2021-10-07: Researcher Notification & Coordination (Security Researcher)
|
|
2021-10-08: Vendor Notification (Security Department)
|
|
2021-**-**: Vendor Response/Feedback (Security Department)
|
|
2021-**-**: Vendor Fix/Patch (Service Developer Team)
|
|
2021-**-**: Security Acknowledgements (Security Department)
|
|
2021-11-05: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Discovery Status:
|
|
=================
|
|
Published
|
|
|
|
|
|
Exploitation Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity Level:
|
|
===============
|
|
Medium
|
|
|
|
|
|
Authentication Type:
|
|
====================
|
|
Pre Auth (No Privileges or Session)
|
|
|
|
|
|
User Interaction:
|
|
=================
|
|
Low User Interaction
|
|
|
|
|
|
Disclosure Type:
|
|
================
|
|
Responsible Disclosure
|
|
|
|
|
|
Technical Details & Description:
|
|
================================
|
|
A html inject web vulnerability has been discovered in the official ImportExportTools NG 10.0.4 for mozilla thunderbird.
|
|
The vulnerability allows a remote attacker to inject html payloads to compromise application data or session credentials.
|
|
|
|
The vulnerability is located in the html export function. Subject content on export is not sanitized like on exports in mozilla itself.
|
|
Thus allows a remote attacker to send malicious emails with malformed a html payloads that executes on preview after a html export by
|
|
the victim user.
|
|
|
|
Vulnerable Module(s):
|
|
[+] Export (HTML)
|
|
|
|
|
|
Proof of Concept (PoC):
|
|
=======================
|
|
The web vulnerability can be exploited by remote attackers without user account and with low or medium user interaction.
|
|
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
|
|
|
|
|
|
Manual steps to reproduce the vulnerability ...
|
|
1. Install mozilla thunderbird
|
|
2. Install ImportExportTools NG v10.0.4
|
|
3. Use another email to write to the target inbox were the export takes place
|
|
Note: Inject into the subject any html test payload
|
|
4. Target user exports his content of the inbox in html were the payload executes
|
|
5. Successful reproduce of the encode validation vulnerability!
|
|
|
|
Note: We reported some years ago the same issue that was also present in keepass and kaspersky password manager on exports via html and has been successfully resolved.
|
|
|
|
|
|
Vulnerable Source: ImportExportTools Exported HTML File
|
|
<html><head>
|
|
<style>
|
|
table { border-collapse: collapse; }
|
|
th { background-color: #e6ffff; }
|
|
th, td { padding: 4px; text-align: left; vertical-align: center; }
|
|
tr:nth-child(even) { background-color: #f0f0f0; }
|
|
tr:nth-child(odd) { background-color: #fff; }
|
|
tr>:nth-child(5) { text-align: center; }
|
|
</style>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
|
|
<title>Posteingang</title>
|
|
</head>
|
|
<body>
|
|
<h2>Posteingang (10/07/2021)</h2><table width="99%" border="1"><tbody><tr><th><b>Betreff</b></th>
|
|
<th><b>Von</b></th><th><b>An</b></th><th><b>Datum</b></th><th><b>Anhang</b></th></tr>
|
|
<tr><td><a href="Nachrichten/20211007-payload%20in%20subject%20___iframe%20src%3Devil.source%20onload%3Dalert(document.domain)_-151.html">
|
|
payload in subject "><iframe src="evil.source" onlo<="" a=""></td>
|
|
<td>test@vulnerability-lab.com" <test@vulnerability-</td>
|
|
<td>user@test-service.de</td>
|
|
<td nowrap>10/07/2021</td>
|
|
<td align="center">* </td></tr>
|
|
|
|
|
|
Reference(s):
|
|
https://addons.thunderbird.net/de/thunderbird/addon/importexporttools-ng/
|
|
|
|
|
|
Solution - Fix & Patch:
|
|
=======================
|
|
The output that is visible in the subject needs to be encoded and secure sanitized to prevent an execute from any listed value.
|
|
Restrict the execution via import/export with special chars to prevent further attacks.
|
|
|
|
|
|
Credits & Authors:
|
|
==================
|
|
Vulnerability-Lab [admin@vulnerability-lab.com] -https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
|
|
|
|
|
|
Disclaimer & Information:
|
|
=========================
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab
|
|
or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits
|
|
or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do
|
|
not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
|
|
We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.
|
|
|
|
Domains: https://www.vulnerability-lab.com ; https://www.vuln-lab.com ;https://www.vulnerability-db.com
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other
|
|
information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or
|
|
edit our material contact (admin@ or research@) to get a ask permission.
|
|
|
|
Copyright © 2021 | Vulnerability Laboratory - [Evolution Security GmbH]™
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY LABORATORY (VULNERABILITY LAB)
|
|
RESEARCH, BUG BOUNTY & RESPONSIBLE DISCLOSURE |