IMAP/SMTP Injection in SquirrelMail
IMAP/SMTP command injection vulnerability in SquirrelMail that allows bypassing application restrictions.
Antecedentes
SquirrelMail is a PHP-based webmail package that includes native support for the IMAP and SMTP protocols. It is easy to install and offers the standard features of an email client.
Description
SquirrelMail does not properly validate commands and information sent to mail servers during normal use. An authenticated malicious user can inject arbitrary IMAP/SMTP commands through parameters such as mailbox (IMAP) or subject (SMTP), bypassing application restrictions and exploiting vulnerabilities in the mail servers.
Business impact
The injection allows for email relaying, sending spam, exploiting vulnerabilities in IMAP and SMTP servers, and bypassing application-layer restrictions.
Affected systems
IMAP injection: all versions prior to 1.4.6. SMTP injection: SquirrelMail 1.2.7 and earlier versions.
Solución
Remove the \r and \n characters from $mailbox in the sqimap_mailbox_select function. A patch is available in the manufacturer's notice.
Calendario de divulgación
References
The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.
Company based in Spain and Colombia, specializing in web application auditing, network security, penetration testing, and compliance implementation and assessment. Our clients include some of the largest finance, telecommunications, insurance, and ICT companies. A vendor-independent provider with in-depth experience since 2001. Our R&D efforts include vulnerability research, collaboration on open security projects, whitepapers, and participation in industry events.
Would you like us to review your product?
Contact usDo you need a security audit?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Our offices
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)