Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 27 Aug 2012 00:54:36 +0400
From: Eygene Ryabinkin <>
Cc: Henri Salo <>, Moritz Muehlenhoff <>
Subject: Re: CVE-request: Roundcube XSS issues

Fri, Aug 24, 2012 at 10:29:42PM -0400, Steven M. Christey wrote:
> On Mon, 20 Aug 2012, Kurt Seifried wrote:
> >> 2, Issue 2a: Description: Stored XSS in e-mail body. Ticket:
> >> Upstream patch:
> >>
> >> [snip]
> >>
> >> Issue 2b: Self XSS in e-mail body (Signature). Ticket:
> >> Upstream patch:
> >[snip]
> >
> > Please use CVE-2012-3508 for these two issues (same version, same type
> > of vuln so cve merge).
> Further investigation into ticket 1488613 shows that the developer thinks 
> that issue 2b doesn't need a backport to 0.7.  This would suggest a SPLIT 
> based on different affected versions.

Why?  2a doesn't affect 0.7.x, because wash_attribs in these versions
has the following code
      if (isset($this->_html_attribs[$key]) ||
         ($key == 'href' && preg_match('/^(http:|https:|ftp:|mailto:|#).+/i', $value)))
        $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
while 0.8.x used to have
      if (isset($this->_html_attribs[$key]) ||
         ($key == 'href' && preg_match('!^([a-z][a-z0-9.+-]+:|//|#).+!i', $value)))
        $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';

As one can see, version from 0.7.x won't allow "javascript:" as
0.8.x's version will, so 0.7.x is clean from this bug (checked sources
for 0.7.1, 0.7.2 and 0.7.3).

> Plus it's not immediately clear whether this "self XSS" is really an XSS 
> or not - if I can modify my own signature, then I already have the 
> "privileges" on my browser to run script.  But, if this "self XSS" is 
> really just reflected XSS, then that's a security issue to worry about. 
> This requires expertise in the Roundcube codebase to answer for sure, 
> though.

Basing on the fix,
I believe that the "self XSS" is only triggered when user composes
e-mail in HTML mode and one of his text signatures contains some HTML
code.  The issue shows up only when a message is composed (so, it
doesn't matter for the signatures of received mails) and XSS is
triggered by the contents of the signature that the user has for his
identity.  So, only the entity that can edit user's signatures will
provoke this XSS, thus this vulnerability can be used only with some
other one that will allow to modify user's signatures.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.