[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
NGS000268 Technical Advisory: Symantec Messaging Gateway - Out-of-band stored-XSS delivered by email
Name: Symantec Messaging Gateway - Out-of-band stored-XSS delivered by email
Release Date: 30 November 2012
Discoverer: Ben Williams <ben.williams@xxxxxxxxxxxxx>
Systems Affected: Symantec Messaging Gateway 9.5.3-3
Discovered: 17 April 2012
Released: 17 April 2012
Approved: 29 April 2012
Reported: 30 April 2012
Fixed: 27 August 2012
Published: 30 November 2012
Symantec Messaging Gateway 9.5.3-3 - Out-of-band stored-XSS - delivered by email
Symantec Messaging Gateway 9.5.3-3 is the latest version, of their Email Security Appliance
This is a very serious issue, because the attack vector is a spam email, and the admin only has to view the messages in the audit log for the payload to execute. (Payloads could include any management or reconfiguration actions within the UI, or redirecting the user to other malicious content)
Additionally, the spam email containing the script can easily be made invisible within the UI, and/or damage the rendering of the UI to prevent itself from being noticed.
IV. PROOF OF CONCEPT
There are several ways to exploit this issue, here is an example using a script in the subject line, to produce a pop-up:
For example a message can be sent with the following subject line:
Something boring here..."><script>alert('Something nasty')</script>
Which could be sent with an automated script for example:
./sendEmail -s 192.168.1.59:25 -u "Something boring here...\"><script>alert('Something nasty')</script>" -f c@xxxxx -t bob@xxxxxxxxxxxxxxx -o message-file=spam1.txt
(the body can contain any content)
Many thousands of messages can be sent in this way, until one is viewed by an administrator.
The message audit viewer affected is here:
This produces a test example pop-up when the message audit log is viewed
(Obviously, a "pop-up" is not the issue, this is just a proof of concept).
An updated version of the software has been released to address the vulnerability:
NCC Group Research
For more information please visit <a href="http://www.mimecast.com">http://www.mimecast.com<br>
This email message has been delivered safely and archived online by Mimecast.