Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Cross Site Scripting (XSS) Vulnerability in Web Mail platform by "Mirapoint"
From: "LegendaryZion" <moskito () smile net il>
Date: Tue, 31 Oct 2006 18:34:45 +0200

·= Security Advisory =·

Issue: Cross Site Scripting (XSS) Vulnerability in Web Mail platform by 
Discovered Date: 19/09/2006
Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com]
Product Vendor: http://www.mirapoint.com/


Mirapoint Web Mail platform is prone to a Cross Site Scripting 
The vulnerability exists in filter engine, caused by the lack of Input 
of malicious Method "Expression()" of Cascading Style Sheets (CSS).

About Cascading Style Sheets (CSS):

Cascading Style Sheets (CSS) is a stylesheet language used to describe the 
of a document written in a markup language. Its most common application is 
to style web pages written
in HTML and XHTML.

About Expression() Method:

Receive string that specifies any valid script(JScript, JavaScript, 
statement without quotations or semicolons. This string can include 
references to
other properties on the current page. Array references are not allowed on 
properties included in this script.

<ELEMENT STYLE="AttributeName:expression(Script)">

Exploitation Mail:

Content-Type: text/html;

<IMG width="0" height="0" style="width: expression(alert('expression'));">

Successful exploitation may allow execution of script code. This could also 
be exploited
to spoof the entire website's content, stealing cookies, stealing session 
commit Denial Of Service attacks and more...

Proof Of Concept:

<IMG style="width: expression(alert('expression'));">

google it

Israels ISP using the web mail:
015 Internet Zahav -    http://smile.msn.co.il/
014 Bezeqint -  http://www.bezeqint.net/

Around the globe:
Sigecom -   http://www.sigecom.net
BBC Worldwide -   http://www.beeb.net/
Oakland -   http://www.oakgov.com/
Bank of Shanghai -  http://www.bankofshanghai.com/
University of Delaware - http://www.udel.edu/

Tal Argoni, CEH

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Cross Site Scripting (XSS) Vulnerability in Web Mail platform by "Mirapoint" LegendaryZion (Oct 31)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]