oss-sec mailing list archives

Hypermail XSS via attachment

From: Hanno Böck <hanno () hboeck de>
Date: Thu, 14 May 2020 09:11:49 +0200

"Hypermail is a free (GPL) program to convert email from Unix mbox
format to html" [1]
It is commonly used to create mailing list archives.

Hypermail contains no validation or sanitation of mail attachments and
provides them as simple files. This means it's trivially vulnerable to
Cross Site Scripting (XSS).

One can simply attach a file to a mail with either no or an .html
extension and it can contain javascript/XSS payloads (e.g.
"<html><script>alert(document.domain)</script>").

The developer of Hypermail informed me that he is no longer interested
in Hypermail, thus there will probably be no fix.

This means using hypermail for public mailing list archives is
inherently risky if one runs anything else on the same host that may be
prone to XSS attacks (which is usually everything that includes any
form of authentication).


[1] http://www.hypermail-project.org/

-- 
Hanno Böck
https://hboeck.de/

Current thread:

Hypermail XSS via attachment Hanno Böck (May 14)