Msg.attach(MIMEText(content, 'html', 'utf-8')) Msg = Header('Read the email!', 'utf-8').encode() Return formataddr((Header(name, 'utf-8').encode(), addr)) We can put two payloads together in the email.įunction = # set the browser, chrome has some errors when use svg. # the attacker's email info #Test with MDaemon set the victorm #coding=utf-8įrom email.utils import parseaddr, formataddrįrom import MIMEMultipartįrom import MIMEApplication This is exploit which will send from attackers email a malicious email to the victim with a payload that will send back the attacker the victim’s mails. Once the victim opens the mail with the malicious payload, the code that the attacker injected will run immediately. The XSS filter don’t deal well with the “ The Mdeamon server serves the XSS content with an error method. Attackers can exploit this vulnerability in order to steal any folder/contact of the victim’s email and forward them to himself. The second XSS vulnerability is inside the content itself of the email. It will open the attachment immediately and will run the attackers client side code. When the victim clicks the html file with this content: alert(window.location) Attackers can send malicious html documents, and when the victim will open the attachment, it’ll be opened in the browser and will run the attacker’s client side code. The first vulnerability lies in the html attachment feature of MDaemon. There are no known issues that customers may experience when installing this patch. To address this issue, the development team at MDaemon Technologies has released patches for affected versions of MDaemon.įor specific information, see the Affected Software Section below.įor MDaemon installations, MDaemon Technologies recommends that administrators download and install the appropriate update listed below. These vulnerabilities may impact all browser types. Two cross-site scripting (XSS) vulnerabilities in MDaemon Webmail (WorldClient) were recently reported by SecuritiTeam Secure Disclosure (SSD). MDaemon mail Server versions 14.0.x – 18.5.x
The following advisory describes two XSS vulnerabilities found in MDaemon Mail Server which lets attackers send emails with malicious payloads and run client side code on victim’s browsers just by opening an email.Īn independent security researcher, Zhong Zhaochen, has reported this vulnerability to SSD Secure Disclosure program.
0 kommentar(er)
