Hello, Just in case anybody is interested in the vulnerability details of the recently discovered Cross Site Scripting flaw in Outlook Web Access, we have now put the according advisory with these details on our web page: http://www.sec-consult.com/270.html Regards, Daniel -- __________________________________________ SEC Consult Unternehmensberatung GmbH www.sec-consult.com A-1080 Vienna, Blindengasse 3 phone +43 1 8903043 fax +43 1 8903043 15 Advisor for your information security. __________________________________________ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ SEC-CONSULT Security Advisory < 20060613-0 v2> =========================================== title: HTML Code Injection in Outlook Web Access program: Outlook Web Access vulnerable version: Exchange 2000 (SP3), 2003 (SP1), 2003 (SP2) impact: severe homepage: www.microsoft.com/exchange/default.mspx found: 2005-10-25 by: D. Fabian / SEC-CONSULT / www.sec-consult.com T. Kerbl / SEC-CONSULT / www.sec-consult.com =========================================== Text version of this advisory 2nd version notes: --------------- The described vulnerability has been found by SEC Consult. SEC Consult worked together with Microsoft on fixing the issue and a patch has been released by Microsoft on June 13th 2006. The vendor advisory with links to the patches is available from www.microsoft.com/technet/security/Bulletin/MS06-029.mspx. As promised to Microsoft, we held back vulnerability details for two weeks. This second version of our advisory contains details about the vulnerability and its consequences for users. vendor description: --------------- Microsoft Office Outlook Web Access is an integrated component of Exchange Server 2000/2003. By using only a Web browser and an Internet or intranet connection, Outlook Web Access enables users to read their corporate e-mail messages, schedules, and other information that is stored on a server running Exchange. [Source: www.microsoft.com/exchange/evaluation/features/owa2k3_55.mspx] vulnerability overview: --------------- Microsoft Outlook Web Access is vulnerable to an HTML code injection/cross site scripting attack. A malicous user could craft a mail containing HTML and Javascript code. Such code could be used to steal session information from the victims cookies, and thus enable the attacker to get access to the victim's emails. In alternative Browsers like Mozilla Firefox or Opera the mere opening of an crafted email is enough for Javascript code to execute. As soon as the victim clicks on the malicious email, the Javascript code can read session information and send this to the attacker, who can then perform session hijacking and read the victims emails. As Internet Explorer uses proprietary security mechanisms (mails are displayed as pages in restricted security zone) it is not possible to inject Javascript code directly into email bodies. However our research showed, that using HTML attachments (which are also subject to input sanitation in OWA), the Javascript code can be successfully executed. Furthermore HTML code injection is still possible directly in the email body. This can be used e.g. by malicious attackers to include images which are displayed without further user interaction and thus verify whether the user read the email or not. Also links can be directly included, circumventing OWA's redirection feature. The vendor advisory is available from www.microsoft.com/technet/security/Bulletin/MS06-029.mspx vulnerability details: --------------- The flaw is caused by erratic NULL-byte handling. Outlook Web Access closes a tag by inserting a ">"-character as soon as it encounters a NULL byte, regardless of the position in the tag. This behaviour can be exploited by specifying a NULL byte within an argument. As the argument is enclosed by quotes, the browser does not interpret the closing ">"-character and accepts further arguments by the user. The same mechanism can be used to finally close the tag. As the concequences of the vulnerability differ from the browser in which OWA is opened, we split the discussion into two parts: First the consequences in Internet Explorer, and second the consequences in alternative browsers. Just to be clear, the flaw has nothing to do with browser security. It is one and the same vulnerability in OWA, it is just that the impact differs from the browser used. -- Internet Explorer Because OWA uses the (IE proprietary) attribute "security='restricted'" in the IFrame that shows the message, we have not found a way to execute Javascript directly in the email body. By attaching an HTML file to an email, it is still possible to inject Javascript, just the way it works with alternative browsers. Also there are other security features in OWA that can be circumvented by exploiting the vulnerability directly in the email body. OWA seems to have an internal list of tags and tag parameters that are allowed. If it encounters a tag or parameter that is not allowed, it is simply discarded. Certain parameters like href in -tags or src in have special treatment. If OWA encounters an image, it simply replaces the src parameter's content with "/exchweb/img/clear1x1.gif". If a user wants to see the image, he needs to accept the warning "To help protect your privacy, links to images, sounds, or other external content in this message have been blocked. Click here to unblock content.". hrefs from links are wraped by the redirect script /exchweb/bin/redir.asp. Using the perl script attached to this advisory, it is possible to circumvent all of these security features. It is possible to specify arbitrary parameters to tags. This can be used to directly display images (which can in turn be used to verify if a user reads the email), specify arbitrary link hrefs, specify the action attribute in the
-tag so that user information can be collected with forms. -- Alternative Browsers In alternativ browsers, the impact is critical. Additionally to the possiblities in IE, the 'security="restricted"' parameter does not exist in those browsers, thus arbitrary Javascript can be sent in a mail to unsuspecting users. It is still the task of OWA to get rid of Javascript in HTML mails (apart from the flaw described in our advisory, it actually does a decent job in doing so). One possibility to automatically execute Javascript is by using the onError parameter in img tags with a broken image. proof of concept: --------------- The following perl script can be used to craft emails containing malicous Javascript code which is executed in alternative browsers: --- code --- #!/usr/bin/perl use Net::SMTP; my $to = "recipient\@domain.tld"; my $sub = "Watch out - Cross Site Scripting Attack"; my $from = "originator\@domain2.tld"; my $smtp = "mail.somesmtpserver.tld"; my $cont = "hugo\0abcnew($smtp); $smtp->mail("$from") || die("error 1"); $smtp->to("$to") || die("error 2"); $smtp->data() ; $smtp->datasend("To: $to\n") ; $smtp->datasend("From: $from\n") ; $smtp->datasend("Subject: $sub\n"); $smtp->datasend("Content-Type: text/html\n\n"); $smtp->datasend("$cont") ; $smtp->datasend("\n\n") ; $smtp->dataend() ; $smtp->quit() ; print "$cont\n\ndone\n"; --- /code --- vulnerable versions: --------------- The following versions of Microsoft Exchange Server are vulnerable to the described security flaw: - Microsoft Exchange 2000 Server Pack 3 with the August 2004 Exchange 2000 Server Post-Service Pack 3 Update Rollup - Microsoft Exchange Server 2003 Service Pack 1 - Microsoft Exchange Server 2003 Service Pack 2 vendor status: --------------- vendor notified: 2005-10-27 vendor response: 2005-10-27 patch available: 2006-06-13 details available: 2006-06-28 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Unternehmensberatung GmbH Office Vienna Blindengasse 3 A-1080 Wien Austria Tel.: +43 / 1 / 890 30 43 - 0 Fax.: +43 / 1 / 890 30 43 - 15 Mail: office at sec-consult dot com www.sec-consult.com EOF Daniel Fabian / @2006 research at sec-consult dot com