[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] CVE-request: Roundcube XSS issues
From:       Eygene Ryabinkin <rea-sec () codelabs ! ru>
Date:       2012-08-26 20:54:36
Message-ID: fi2QtF5hKhscE3ZHFcRYNKXtLYQ () 4aHDgZMJRtcLnIeEgVOjcu6DpEM
[Download RAW message or body]

Fri, Aug 24, 2012 at 10:29:42PM -0400, Steven M. Christey wrote:
> 
> On Mon, 20 Aug 2012, Kurt Seifried wrote:
> 
> >> 2, Issue 2a: Description: Stored XSS in e-mail body. Ticket:
> >> http://trac.roundcube.net/ticket/1488613 Upstream patch:
> >>
> >> [snip]
> >>
> >> Issue 2b: Self XSS in e-mail body (Signature). Ticket:
> >> http://trac.roundcube.net/ticket/1488613 Upstream patch:
> >[snip]
> >
> > Please use CVE-2012-3508 for these two issues (same version, same type
> > of vuln so cve merge).
> 
> Further investigation into ticket 1488613 shows that the developer thinks 
> that issue 2b doesn't need a backport to 0.7.  This would suggest a SPLIT 
> based on different affected versions.

Why?  2a doesn't affect 0.7.x, because wash_attribs in these versions
has the following code
{{{
      if (isset($this->_html_attribs[$key]) ||
         ($key == 'href' && preg_match('/^(http:|https:|ftp:|mailto:|#).+/i', $value)))
        $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
}}}
while 0.8.x used to have
{{{
      if (isset($this->_html_attribs[$key]) ||
         ($key == 'href' && preg_match('!^([a-z][a-z0-9.+-]+:|//|#).+!i', $value)))
        $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
}}}

As one can see, version from 0.7.x won't allow "javascript:" as
0.8.x's version will, so 0.7.x is clean from this bug (checked sources
for 0.7.1, 0.7.2 and 0.7.3).

> Plus it's not immediately clear whether this "self XSS" is really an XSS 
> or not - if I can modify my own signature, then I already have the 
> "privileges" on my browser to run script.  But, if this "self XSS" is 
> really just reflected XSS, then that's a security issue to worry about. 
> This requires expertise in the Roundcube codebase to answer for sure, 
> though.

Basing on the fix,
  https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32
I believe that the "self XSS" is only triggered when user composes
e-mail in HTML mode and one of his text signatures contains some HTML
code.  The issue shows up only when a message is composed (so, it
doesn't matter for the signatures of received mails) and XSS is
triggered by the contents of the signature that the user has for his
identity.  So, only the entity that can edit user's signatures will
provoke this XSS, thus this vulnerability can be used only with some
other one that will allow to modify user's signatures.
-- 
Eygene
[prev in list] [next in list] [prev in thread] [next in thread]