Hi, Squirrelmail plugin 'Virtual Keyboard' version 0.9.1 and lower is vulnerable to cross site scripting (XSS). The vkeyboard.php script fails to sanitize the value of HTTP GET parameter 'passformname' which the script stores in a variable of the same name and outputs (unmodified) into a HTML document later. As such, it is possible to inject client-evaluated HTML and script code into the output generated by the application. For proof of concept, accessing the following location ([Base_URL] refers to a Squirrelmail installation with a vulnerable version of the 'Virtual Keyboard' plugin) results in a javascript generated alert windows reading 'XSS' popping up: > [Base_URL]/plugins/vkeyboard/vkeyboard.php?passformname=%22%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E%3Cscript%3E/*%20 'Virtual Keyboard' installations can be found using this 'Google dork': > http://google.com/search?hl=en&safe=off&filter=0&q=inurl%3A%22vkeyboard.php%22 This vulnerability was originally reported in early May 2010. A suitable update fixing this issue, Virtual Keyboard v0.9.2 for Squrrelmail 1.4.x, has been provided to the Squirrelmail developers and me by Daniel Kobayashi Imori of Bastion Systems (the original developer of this plugin) in early June 2010 and is attached to this email - thanks Daniel. The Squirrelmail team has not yet made it to update this plugin in their repository: http://squirrelmail.org/plugin_view.php?id=159 So this is the first public release I am aware of. Thanks for reading, Moritz Naumann -- Naumann IT Security Consulting Samariterstr. 16 10247 Berlin Germany
Attachment:
vkeyboard-0.9.2-1.4.0.tar.gz
Description: GNU Zip compressed data
Attachment:
vkeyboard-0.9.2-1.4.0.tar.gz.gpg
Description: Binary data
3b72072e3c25a879c4d192a3c1840da75ff9eca974822b3bf854faf4232d0f4e81ea4199baa69e1e26795f16a49a4ad690f5dfc6c64ff3deab5b7699484faf3c vkeyboard-0.9.2-1.4.0.tar.gz
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/