[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <fi2QtF5hKhscE3ZHFcRYNKXtLYQ@4aHDgZMJRtcLnIeEgVOjcu6DpEM>
Date: Mon, 27 Aug 2012 00:54:36 +0400
From: Eygene Ryabinkin <rea-sec@...elabs.ru>
To: oss-security@...ts.openwall.com
Cc: Henri Salo <henri@...v.fi>, Moritz Muehlenhoff <jmm@...ian.org>
Subject: Re: CVE-request: Roundcube XSS issues
Fri, Aug 24, 2012 at 10:29:42PM -0400, Steven M. Christey wrote:
>
> On Mon, 20 Aug 2012, Kurt Seifried wrote:
>
> >> 2, Issue 2a: Description: Stored XSS in e-mail body. Ticket:
> >> http://trac.roundcube.net/ticket/1488613 Upstream patch:
> >>
> >> [snip]
> >>
> >> Issue 2b: Self XSS in e-mail body (Signature). Ticket:
> >> http://trac.roundcube.net/ticket/1488613 Upstream patch:
> >[snip]
> >
> > Please use CVE-2012-3508 for these two issues (same version, same type
> > of vuln so cve merge).
>
> Further investigation into ticket 1488613 shows that the developer thinks
> that issue 2b doesn't need a backport to 0.7. This would suggest a SPLIT
> based on different affected versions.
Why? 2a doesn't affect 0.7.x, because wash_attribs in these versions
has the following code
{{{
if (isset($this->_html_attribs[$key]) ||
($key == 'href' && preg_match('/^(http:|https:|ftp:|mailto:|#).+/i', $value)))
$t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
}}}
while 0.8.x used to have
{{{
if (isset($this->_html_attribs[$key]) ||
($key == 'href' && preg_match('!^([a-z][a-z0-9.+-]+:|//|#).+!i', $value)))
$t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
}}}
As one can see, version from 0.7.x won't allow "javascript:" as
0.8.x's version will, so 0.7.x is clean from this bug (checked sources
for 0.7.1, 0.7.2 and 0.7.3).
> Plus it's not immediately clear whether this "self XSS" is really an XSS
> or not - if I can modify my own signature, then I already have the
> "privileges" on my browser to run script. But, if this "self XSS" is
> really just reflected XSS, then that's a security issue to worry about.
> This requires expertise in the Roundcube codebase to answer for sure,
> though.
Basing on the fix,
https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32
I believe that the "self XSS" is only triggered when user composes
e-mail in HTML mode and one of his text signatures contains some HTML
code. The issue shows up only when a message is composed (so, it
doesn't matter for the signatures of received mails) and XSS is
triggered by the contents of the signature that the user has for his
identity. So, only the entity that can edit user's signatures will
provoke this XSS, thus this vulnerability can be used only with some
other one that will allow to modify user's signatures.
--
Eygene
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
