oss-sec mailing list archives
Hypermail XSS via attachment
From: Hanno Böck <hanno () hboeck de>
Date: Thu, 14 May 2020 09:11:49 +0200
"Hypermail is a free (GPL) program to convert email from Unix mbox format to html" [1] It is commonly used to create mailing list archives. Hypermail contains no validation or sanitation of mail attachments and provides them as simple files. This means it's trivially vulnerable to Cross Site Scripting (XSS). One can simply attach a file to a mail with either no or an .html extension and it can contain javascript/XSS payloads (e.g. "<html><script>alert(document.domain)</script>"). The developer of Hypermail informed me that he is no longer interested in Hypermail, thus there will probably be no fix. This means using hypermail for public mailing list archives is inherently risky if one runs anything else on the same host that may be prone to XSS attacks (which is usually everything that includes any form of authentication). [1] http://www.hypermail-project.org/ -- Hanno Böck https://hboeck.de/
Current thread:
- Hypermail XSS via attachment Hanno Böck (May 14)