'[oss-security] Hypermail XSS via attachment'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Hypermail XSS via attachment
From:       Hanno =?iso-8859-1?q?B=F6ck?= <hanno () hboeck ! de>
Date:       2020-05-14 7:11:49
Message-ID: 20200514091149.4e807efa () computer
[Download RAW message or body]

"Hypermail is a free (GPL) program to convert email from Unix mbox
format to html" [1]
It is commonly used to create mailing list archives.

Hypermail contains no validation or sanitation of mail attachments and
provides them as simple files. This means it's trivially vulnerable to
Cross Site Scripting (XSS).

One can simply attach a file to a mail with either no or an .html
extension and it can contain javascript/XSS payloads (e.g.
"<html><script>alert(document.domain)</script>").

The developer of Hypermail informed me that he is no longer interested
in Hypermail, thus there will probably be no fix.

This means using hypermail for public mailing list archives is
inherently risky if one runs anything else on the same host that may be
prone to XSS attacks (which is usually everything that includes any
form of authentication).


[1] http://www.hypermail-project.org/

-- 
Hanno Böck
https://hboeck.de/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure | About | News | Add a list | Sponsored by KoreLogic