868267 - (CVE-2013-6674) HTML mail compose self-XSS due to signature text

Status: RESOLVED FIXED

(MailNews Core :: Security, defect)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

From:<[e-mail]>
To: "[e-mail]" <[e-mail]>
Subject: SeaMonkey Mail 2.17.1 - Cross-site Scripting Stored.
Date: Thu, 2 May 2013 13:08:24 -0300
-----//-----
Hello Mozilla Security Team,
Today i found a Cross-site Scripting in Sea Monkey Mail.
Details:
Software: Sea Monkey

Version: 2.17.1

Tested on: Windows 7

Vulnerability: Cross-site Scripting Stored

Steps to reproduce:
                         1 )  First install SeaMonkey, then open Mail and go to the Accounts option
                         2 ) Click in "View setting for this account"
                         3 ) Now select the text box of "signature" left labeled "Use HTML" and insert the following payload: 
                         3.p)   "><iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4">
                         4) We save the settings click in OK, and we will compose a new mail.Cross-site Scripting successfully!

Proof of Concept: Screenshots.


Best Regards,
Fabián Cuchietti.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Attachment: POC Screenshot 1

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Attachment: POC Screenshot 2

Comment 3

[Fabian Cuchietti]

This too found in Thunderbird.

Comment 4

[Al Billings [:abillings - ex-MoCo]]

Yes, Dveditz confirmed it works on Thunderbird yesterday.

Comment 5

[Fabian Cuchietti]

When this update will come?

Comment 6

[David Bolter [:davidb] (NeedInfo me for attention)]

Marking sec-high, csec-sop based on provided description.

Comment 7

[David Bolter [:davidb] (NeedInfo me for attention)]

Oh this requires user trickery so removing sec-high. We're thinking sec-moderate at most, but needinfo Dan since he has looked at this.

Comment 8

[Fabian Cuchietti]

Of course, but this is a XSS Stored (CRITICAL)

Comment 9

[Fabian Cuchietti]

Nor is it necessary to trick the user, this is stored.

Comment 10

[Al Billings [:abillings - ex-MoCo]]

It isn't critical if you need to convince the user to store it for you.

Comment 11

[Fabian Cuchietti]

ok, I thought it would be stored critical for this application.

Comment 12

[Fabian Cuchietti]

I just checked, it works well if the victim answers the mail.

Comment 13

[Fabian Cuchietti]

They could check?

Comment 14

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

duplicate reported, added [e-mail] as cc

Comment 15

[Mark Banner (:standard8)]

I've just done a bit of testing. This seems to affect Thunderbird 22 and older. 23 and 24 are unaffected. At the moment, I suspect there's probably been some core change, but I'll need to dig into it.

With a bit more testing, this doesn't affect reading email, but there is an attack vector if the sender can get the receiver to respond or forward the email. I think sec-moderate is about right here.

Comment 17

[Daniel Veditz [:dveditz]]

The original symptoms aren't quite up to security bug bounty level, but it did prompt us to investigate and discover the somewhat worse symptoms Mark described in comment 15. Awarding a split bounty for this one.

Comment 18

[Mark Banner (:standard8)]

As I've just commented on bug 875818 comment 24:

Now Thunderbird 17.0.x series is obsolete and updates have been offered to TB 17esr users, I have re-tested Thunderbird 24.0.x and it is still unaffected by this issue. Therefore resolving this as WFM.

Comment 19

[chris hofmann]

Marking fixed so it gets on the radar for a vuln note.   See https://bugzilla.mozilla.org/show_bug.cgi?id=875818#c27 for more.

Comment 20

[Al Billings [:abillings - ex-MoCo]]

Opening up this bug since it has been fixed for some time and is being discussed publicly.

Comment 21

[Fabian Cuchietti]

All credits to Ateeq ur Rehman Khan ? I was the first who reported this.

Comment 22

[Al Billings [:abillings - ex-MoCo]]

(In reply to Fabian Cuchietti from comment #21)
> All credits to Ateeq ur Rehman Khan ? I was the first who reported this.

Credits where? Are you seeing us crediting them somewhere?