Sun Java System Communication Express CSRF via HPP

[edgard.chammas@xxxxxxxxxxxxxxxxxxx]

Hello,

As a continuation of my advisory about "Sun Java System Communications Express 
Multiple HTML Injection Vulnerabilities" that can be found here: 
(http://www.securityfocus.com/bid/34083/info), I would like to introduce 
another potential security threat in the same product and based on my previous 
discussion.

This time an attacker can benefit from the HTML injection flaw found in the 
message subject field to launch a deadly CSRF attack that would delete all the 
victim's inbox messages permanently and forever. The attack is done via HPP 
(HTTP Parameter Pollution) in the main queries used by the system.

The URL below would move all the messages with msgid between 0 and 1000000 to 
the trash:
http[s]://[servername]:[port]/cmd.msc?sid=&mbox=INBOX&cmd=move&argv=0:1000000&argv=Trash&argv=expunge

The URL below would delete all the messages in the trash with msgid between 0 
and 1000000:
http[s]://[servername]:[port]/cmd.msc?sid=&mbox=Trash&cmd=expunge&argv=0:1000000&argv=force

It is easier for an attacker to assemble the above two HTML queries into a 
simple one that would achieve the same goal for him. So why not deleting the 
messages directly from the inbox instead of passing them to the trash and then 
deleting them?!
The following HTTP query would do the job perfectly:
http[s]://[servername]:[port]/cmd.msc?sid=&mbox=INBOX&cmd=expunge&argv=0:1000000&argv=force

So finally, what a hacker would do in a normal attack is to send the victim a 
message with the following subject:
<IMG 
SRC=http[s]://[servername]:[port]/cmd.msc?sid=&mbox=INBOX&cmd=expunge&argv=0:1000000&argv=force></IMG>
The payload was injected as a source for an image file so that it will load 
with the page as soon as the message is opened.

Now by sending the message, that attacker have crafted a malicious CSRF that 
would delete all the victim's inbox messages permanently.
In order for this attack to succeed, the victim must only open the malicious 
message and the exploit will work.

Best regards,
Edgard Chammas [454447415244]