Vulnerability Note VU#361600

Web-based email services filtering systems vulnerable to malicous script execution

Original Release date: 26 Sep 2001 | Last revised: 31 Jul 2002

Overview

An attacker can send a specially crafted email message to a victim containing malicious scripting (JavaScript, VBScript, JScript, etc.), or potentially HTML. When a victim views the message with scripting enabled, the victim's browser will then interpret this javascript which can lead to several impacts.

Description

Malicious code provided by one client for another client

Sites that provide email service with web interfaces have guarded against a vulnerability where one client embeds malicious HTML tags in a message intended for another client with in the body of a message. For example, an attacker might send an email message like

From: attacker@example.com
To: victim@example.com
Subject: Hello

Hello Victim,

This is a message.
<SCRIPT>malicious code</SCRIPT>
This is the end of my message.

When a victim with scripts enabled in their browser reads this message, the malicious code may be executed unexpectedly. Scripting tags that can be embedded in this way include <SCRIPT>, <OBJECT>, <APPLET>, and <EMBED>.

With client-to-client sites, developers explicitly recognize that data input is untrustworthy when it is presented to other users. Most email services either will not accept such input or will encode/filter it before sending anything to other readers.

It has recently been discovered that some sites that provide email services with web interfaces are failing to check fields outside of the message body. Hotmail, Hushmail, and MyOwnEmail are all services that have been reported vulnerable to this attack. There may be other sites that provide email service with web interfaces vulnerable to this attack. The following message would be an example of this:

From: a background=javascript:alert('test') @example.com
To: victim@example.com
Subject: Hello

Hello Victim,

This is a message.
This is the end of my message.

This vulnerability is closely related to Cross-Site Scripting. For more information on Cross-Site Scripting, see http://www.cert.org/advisories/CA-2000-02.html. Hotmail, Hushmail, and MyOwnEmail are all services that have been reported vulnerable to this attack.

Impact

This attack could be used to gain sensitive data such as passwords, credit card numbers, and any arbitrary information the user inputs. This may also lead to the theft of credentials.

Solution

The CERT/CC is currently unaware of a practical solution to this problem.

Disable scripting in your browser.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Hushmail.comAffected-13 Sep 2001
Microsoft CorporationAffected-13 Sep 2001
MyOwnEmail.comAffected-13 Sep 2001
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Hushmail has credited 1; (one-semicolon) with the discovery of this vulnerability.

This document was written by Jason Rafail.

Other Information

  • CVE IDs: Unknown
  • Date Public: 17 Jan 2002
  • Date First Published: 26 Sep 2001
  • Date Last Updated: 31 Jul 2002
  • Severity Metric: 15.75
  • Document Revision: 17

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.