Bug#455840: CVE-2007-6321: Cross-site scripting (XSS) vulnerability

Vincent Bernat Wed, 02 Jan 2008 10:45:48 -0800

OoO En  ce milieu  de nuit  étoilée du mercredi  12 décembre  2007, vers
03:46, Micah Anderson <[EMAIL PROTECTED]> disait:


> CVE-2007-6321 details a XSS vulnerability in Roundcube 0.1rc2 and
> earlier. Its only affects users of IE who are using roundcube, so it may
> seem unimportant, but the sad fact of the matter is many people
> still use that browser and most people who run webmail are likely to be
> visited by IE users.

> Please mention this CVE in any changelogs that address this issue. When
> a fix is available, please upload with urgency=high to speed up
> migration to testing. If you have any questions or need help, visit us
> in channel #debian-security on OFTC.

> URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6321
> Reference: BUGTRAQ:20071209 Unsanitized scripting in RoundCube webmail
> Reference: 
> http://www.securityfocus.com/archive/1/archive/1/484802/100/0/threaded
> Reference: http://openmya.hacker.jp/hasegawa/security/expression.txt
> Reference: XF:roundcube-email-messages-xss(38981)
> Reference: URL:http://xforce.iss.net/xforce/xfdb/38981

There is a proposition from Roundcube dev here:
 http://lists.roundcube.net/mail-archive/dev/2007-12/0000038.html

I  have  tested  it  with  ie4linux  and  it  seems  that  it  is  still
vulnerable. Could someone else check this?

I attach the patch as well.

Index: program/steps/mail/func.inc
===================================================================
--- program/steps/mail/func.inc	(revision 943)
+++ program/steps/mail/func.inc	(working copy)
@@ -477,6 +477,85 @@
   }
 
 
+function rcmail_html_filter($html)
+  {
+  preg_match_all('/<\/?\w+((\s+\w+(\s*=\s*(?:".*?"|\'.*?\'|[^\'">\s]+))?)+\s*|\s*)\/?>/', $html, $tags);
+
+  /* From Squirrelmail: Translate all dangerous Unicode or Shift_JIS characters which are accepted by
+   * IE as regular characters. */
+  $replace = array(array('&#x029F;', '&#0671;' ,/* L UNICODE IPA Extension */
+                         '&#x0280;', '&#0640;' ,/* R UNICODE IPA Extension */
+                         '&#x0274;', '&#0628;' ,/* N UNICODE IPA Extension */
+                         '&#xFF25;', '&#65317;' ,/* Unicode FULLWIDTH LATIN CAPITAL LETTER E */
+                         '&#xFF45;', '&#65349;' ,/* Unicode FULLWIDTH LATIN SMALL LETTER E */
+                         '&#xFF38;', '&#65336;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER X */
+                         '&#xFF58;', '&#65368;',/* Unicode FULLWIDTH LATIN SMALL LETTER X */
+                         '&#xFF30;', '&#65328;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER P */
+                         '&#xFF50;', '&#65360;',/* Unicode FULLWIDTH LATIN SMALL LETTER P */
+                         '&#xFF32;', '&#65330;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER R */
+                         '&#xFF52;', '&#65362;',/* Unicode FULLWIDTH LATIN SMALL LETTER R */
+                         '&#xFF33;', '&#65331;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER S */
+                         '&#xFF53;', '&#65363;',/* Unicode FULLWIDTH LATIN SMALL LETTER S */
+                         '&#xFF29;', '&#65321;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER I */
+                         '&#xFF49;', '&#65353;',/* Unicode FULLWIDTH LATIN SMALL LETTER I */
+                         '&#xFF2F;', '&#65327;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER O */
+                         '&#xFF4F;', '&#65359;',/* Unicode FULLWIDTH LATIN SMALL LETTER O */
+                         '&#xFF2E;', '&#65326;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER N */
+                         '&#xFF4E;', '&#65358;',/* Unicode FULLWIDTH LATIN SMALL LETTER N */
+                         '&#xFF2C;', '&#65324;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER L */
+                         '&#xFF4C;', '&#65356;',/* Unicode FULLWIDTH LATIN SMALL LETTER L */
+                         '&#xFF35;', '&#65333;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER U */
+                         '&#xFF55;', '&#65365;',/* Unicode FULLWIDTH LATIN SMALL LETTER U */
+                         '&#x207F;', '&#8319;' ,/* Unicode SUPERSCRIPT LATIN SMALL LETTER N */
+                         "\xEF\xBC\xA5", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER E */
+                                         /* in unicode this is some Chinese char range */
+                         "\xEF\xBD\x85", /* Shift JIS FULLWIDTH LATIN SMALL LETTER E */
+                         "\xEF\xBC\xB8", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER X */
+                         "\xEF\xBD\x98", /* Shift JIS FULLWIDTH LATIN SMALL LETTER X */
+                         "\xEF\xBC\xB0", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER P */
+                         "\xEF\xBD\x90", /* Shift JIS FULLWIDTH LATIN SMALL LETTER P */
+                         "\xEF\xBC\xB2", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER R */
+                         "\xEF\xBD\x92", /* Shift JIS FULLWIDTH LATIN SMALL LETTER R */
+                         "\xEF\xBC\xB3", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER S */
+                         "\xEF\xBD\x93", /* Shift JIS FULLWIDTH LATIN SMALL LETTER S */
+                         "\xEF\xBC\xA9", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER I */
+                         "\xEF\xBD\x89", /* Shift JIS FULLWIDTH LATIN SMALL LETTER I */
+                         "\xEF\xBC\xAF", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER O */
+                         "\xEF\xBD\x8F", /* Shift JIS FULLWIDTH LATIN SMALL LETTER O */
+                         "\xEF\xBC\xAE", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER N */
+                         "\xEF\xBD\x8E", /* Shift JIS FULLWIDTH LATIN SMALL LETTER N */
+                         "\xEF\xBC\xAC", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER L */
+                         "\xEF\xBD\x8C", /* Shift JIS FULLWIDTH LATIN SMALL LETTER L */
+                         "\xEF\xBC\xB5", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER U */
+                         "\xEF\xBD\x95", /* Shift JIS FULLWIDTH LATIN SMALL LETTER U */
+                         "\xE2\x81\xBF", /* Shift JIS FULLWIDTH SUPERSCRIPT N */
+                         "\xCA\x9F", /* L UNICODE IPA Extension */
+                         "\xCA\x80", /* R UNICODE IPA Extension */
+                         "\xC9\xB4"),  /* N UNICODE IPA Extension */
+                   array('l', 'l', 'r', 'r', 'n', 'n', 'E', 'E', 'e', 'e', 'X', 'X', 'x', 'x',
+                         'P', 'P', 'p', 'p', 'R', 'R', 'r', 'r', 'S', 'S', 's', 's', 'I', 'I',
+                         'i', 'i', 'O', 'O', 'o', 'o', 'N', 'N', 'n', 'n', 'L', 'L', 'l', 'l',
+                         'U', 'U', 'u', 'u', 'n', 'n', 'E', 'e', 'X', 'x', 'P', 'p', 'R', 'r',
+                         'S', 's', 'I', 'i', 'O', 'o', 'N', 'n', 'L', 'l', 'U', 'u', 'n', 'l', 'r', 'n'));
+  if ((count($tags)>3) && (count($tags[3])>0))
+    foreach ($tags[3] as $nr=>$value)
+    {
+    /* Remove comments */
+    $newvalue = preg_replace('/(\/\*.*\*\/)/','$2',$value);
+    /* Translate dangerous characters */
+    $newvalue = str_replace($replace[0], $replace[1], $newvalue);
+    /* Rename dangerous CSS */
+	$newvalue = preg_replace('/expression/i', 'expresion', $newvalue);
+	$newvalue = preg_replace('/url/i', 'urrl', $newvalue);
+	$newattrs = preg_replace('/'.preg_quote($value, '/').'$/', $newvalue, $tags[1][$nr]);
+	$newtag = preg_replace('/'.preg_quote($tags[1][$nr], '/').'/', $newattrs, $tags[0][$nr]);
+    $html = preg_replace('/'.preg_quote($tags[0][$nr], '/').'/', $newtag, $html);
+    }
+
+  return $html;
+  }
+
+
 function rcmail_print_body($part, $safe=FALSE, $plain=FALSE)
   {
   global $IMAP, $REMOTE_OBJECTS;
@@ -528,7 +607,7 @@
       $body = preg_replace($remote_patterns, $remote_replaces, $body);
       }
 
-    return Q($body, 'show', FALSE);
+    return Q(rcmail_html_filter($body), 'show', FALSE);
     }
 
   // text/enriched

-- 
CLASS CLOWN IS NOT A PAID POSITION
CLASS CLOWN IS NOT A PAID POSITION
CLASS CLOWN IS NOT A PAID POSITION
-+- Bart Simpson on chalkboard in episode BABF08

Bug#455840: CVE-2007-6321: Cross-site scripting (XSS) vulnerability

Reply via email to