BugTraq
SEC Consult SA-20141031-0 :: XML External Entity Injection (XXE) and Reflected XSS in Scalix Web Access Oct 31 2014 08:49AM
SEC Consult Vulnerability Lab (research sec-consult com)
SEC Consult Vulnerability Lab Security Advisory < 20141031-0 >
=======================================================================
title: XML External Entity Injection (XXE) and Reflected XSS
product: Scalix Web Access
vulnerable version: 11.4.6.12377 and 12.2.0.14697
fixed version: -
impact: Critical
homepage: http://www.scalix.com/
found: 2014-08-27
by: R. Giruckas, A. Kolmann
SEC Consult Vulnerability Lab
https://www.sec-consult.com
=======================================================================

Vendor description:
-------------------
"Employees need to access their email from wherever they happen to be Â? on the
road, at customer sites, remote offices, and at home. Users who need remote
access to their email often include customer-facing sales and support
personnel, who need to stay connected and informed to be responsive to
customers. The problem is, most web clients have slow performance and limited
functionality. Scalix Web Access is different. It is an AJAX-based web client
that delivers the look and feel, usability and performance of a desktop
application."

Source: http://www.scalix.com/communityedition-scalixwebaccess

Business recommendation:
------------------------
By exploiting the XXE vulnerability, an unauthenticated attacker can get
read access to the filesystem of the Scalix Mail Server host and thus obtain
sensitive information such as the configuration files, etc.
It is also possible to scan ports of the internal hosts and cause DoS on
the affected host.

Vulnerability overview/description:
-----------------------------------
1) XML External Entity Injection
The used XML parser is resolving external XML entities which allows attackers
to read files and send requests to systems on the internal network (e.g port
scanning). The risk of this vulnerability is highly increased by the fact
that it can be exploited by anonymous users without existing user accounts.

2) Reflected XSS
The Scalix mail administration login panel is prone to the reflected cross site
scripting attacks. The vulnerability can be used to include HTML or JavaScript
code to the affected web page. The code is executed in the browser of users
if they visit the manipulated URL.

Proof of concept:
-----------------
The proof of concept information has been removed from this advisory as the
vendor failed to respond within 50 days and no patch is available.

1) XML External Entity Injection
The unauthenticated XML External Entity Injection vulnerability can be
exploited by issuing a specially crafted HTTP POST request to the [removed]
handler.

2) Reflected XSS
The supplied parameter value in the [removed] script is reflected without
proper validation and executed in the context of the web browser.

Vulnerable / tested versions:
-----------------------------
The XXE vulnerability has been verified to exist in the Scalix Web Access
version 11.4.6.12377 and 12.2.0.14697.

The reflected XSS vulnerability has been verified to exist in the Scalix Web Access
version 11.4.6.12377. Version 12 has not been tested against XSS.

Vendor contact timeline:
------------------------
2014-09-11: Contacting vendor through info (at) scalix (dot) com [email concealed], requesting encryption
keys and attaching responsible disclosure policy
2014-10-13: No response so far, hence trying again by contacting vendor
through info (at) scalix (dot) com [email concealed]
2014-10-28: No response so far, hence trying again by contacting vendor
through info (at) scalix (dot) com [email concealed]
2014-10-31: SEC Consult releases security advisory

Solution:
---------
None available.

Workaround:
-----------
There is no workaround known other than to disable Scalix Web Access until a
thorough security review has been performed and patches are available.

Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab

SEC Consult
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius - Zurich

Headquarter:
Mooslackengasse 17, 1190 Vienna, Austria
Phone: +43 1 8903043 0
Fax: +43 1 8903043 15

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

Interested to work with the experts of SEC Consult?
Write to career (at) sec-consult (dot) com [email concealed]

EOF A. Kolmann / @2014

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBAgAGBQJUU00nAAoJEC0t17XG7og/8JYQAK/IxqSkBS95MI4qHLI37xlF
Ac3bjCNj73mJyLUGKsjoFe6pViu7gsqdeIMyFVw1Y5O31xez4aY+OI9/1abMujNf
F0cYM4GOY3tiZjPbVVT9TP98eaYA0LY7UveDvFZ4amL08c78UOegCfRVr1Bwnx7P
sntel9eOr9AlmfYchFRCF+H6DrYJG0f3GLFmZIeTN1xrv4vRvM/2v4ekBNo8S6KD
06ZcvP4cVjk+pSFXOMFrk3Ly7ald/QY+7/fOPshvjyMqbn7iVS5eVKaLR8a0Rjsi
4Gwo5k0tyouKSqi8SPvBOE3cHx0CGX5PhBocBUb4H1YEIAAyjPoftB7ltUTx9bTB
ockU5Ttozlg+IWM5v8MGtgwe9jmkzw/wpOWoFuhHLTKIwmLApEsYesmoWrVjIHg4
zJVoeOHJYzBvZwNASSsOqwziMCdays6UAsc5YmaPpuAJ6ByskQKaFr+ElP1srpFT
IcvJ5sXrUHhBDnmleIxso06nnijqkj8+O2xjLlBettcAT5M7uOAXnXcpibIXKtLd
z/Jg/ygOkScNiQZ+epxNViZ+AY92f4QO6vqabeNTm+E8dP0E6KOEaU/BQin3DoCb
1fRaqgEDI3uWC697Ji9aBlpzufwmlPLZB1QRsUh2Sdodw7QWY/CjSDgwJUnfjGmJ
WI6sV00IUnFCbBt70/VB
=Rf9x
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus