IlohaMail Insecure Configuration Files

[<wang () readyresponse org>]

------------------------------------------------

Advisory Name : IlohaMail Insecure Configuration Files
Release Date : 10 January, 2004
Application : IlohaMail (http://ilohamail.org/)
Vulnerable: IlohaMail-0.8.14-rc1 and lower
Not Vulnerable: IlohaMail-0.8.14-rc2

Author : SRR Project Group of Ready Response (srr.readyresponse.org / www.readyresponse.org)

------------------------------------------------

Description

IlohaMail is a PHP based lightweight full featured multilingual webmail program with IMAP and POP3 support. If an 
administrator follows the "INSTALL" file steps to install IlohaMail they will end up with an insecure setup that could 
allow a remote visitor to the web site to download their configuration files and in some cases obtain username/password 
credentials for SMTP authentication (very useful to spammers).

The problem exists primarily due to the use of the file extension ".inc" on a number of important configuration files, 
such as:
 
conf/conf.inc
conf/custom_auth.inc
conf/login.inc

The problem is made worse because the installation instructions do not correctly inform the end user of how to securely 
setup their IlohaMail. ".inc" is not a secure file extension to use, and therefore if the .inc configuration files are 
within the web root (a result of following the INSTALL file steps) they will be publicly accessible/readable via the 
URL:

http://yourdomain.com/IlohaMail/conf/conf.inc
etc

This is dangerous as it can potentially reveal the following information to any remote visitor:

* File paths to important directories (upload directories for mail attachments, session storage directories etc)

* Authenticated SMTP credentials (highly valuable information to spammers)

* Other useful information for potential attackers

------------------------------------------------
 
Exploit
 
No exploit is required to leverage this issue.
 

------------------------------------------------
 
Solution / Vendor Response

Our suggested fix to the IlohaMail team was to stop using the ".inc" file extension and instead use a more secure file 
extension such as ".inc.php" or ".php" for all include files. 

The IlohaMail team were contacted on 15/12/2004 and promptly replied + investigated this issue. We were informed on 
23/12/2004 that the IlohaMail team would be fixing this issue in 0.9 and would be implementing a workaround for 0.8 
releases.

IlohaMail-0.8.14-rc2 was released on 01/01/2005 and has addressed this issue.

We would like to thank IlohaMail for their fast response and professional attitude to security.


------------------------------------------------
 
Credit
 
Discovery of this issue is credited to the SRR project group of Ready Response - (srr.readyresponse.org / 
www.readyresponse.org)