Vulnerability Note VU#361600

Web-based email services filtering systems vulnerable to malicous script execution

Sites that provide email service with web interfaces have guarded against a vulnerability where one client embeds malicious HTML tags in a message intended for another client with in the body of a message. For example, an attacker might send an email message like

From: attacker@example.com
To: victim@example.com
Subject: Hello

Hello Victim,

This is a message.
<SCRIPT>malicious code</SCRIPT>
This is the end of my message.

When a victim with scripts enabled in their browser reads this message, the malicious code may be executed unexpectedly. Scripting tags that can be embedded in this way include <SCRIPT>, <OBJECT>, <APPLET>, and <EMBED>.

With client-to-client sites, developers explicitly recognize that data input is untrustworthy when it is presented to other users. Most email services either will not accept such input or will encode/filter it before sending anything to other readers.

It has recently been discovered that some sites that provide email services with web interfaces are failing to check fields outside of the message body. Hotmail, Hushmail, and MyOwnEmail are all services that have been reported vulnerable to this attack. There may be other sites that provide email service with web interfaces vulnerable to this attack. The following message would be an example of this:

From: a background=javascript:alert('test') @example.com
To: victim@example.com
Subject: Hello

Hello Victim,

This is a message.
This is the end of my message.

This vulnerability is closely related to Cross-Site Scripting. For more information on Cross-Site Scripting, see http://www.cert.org/advisories/CA-2000-02.html. Hotmail, Hushmail, and MyOwnEmail are all services that have been reported vulnerable to this attack.

II. Impact

Disable scripting in your browser.

Systems Affected

CA-2000-02

Credit

Hushmail has credited 1; (one-semicolon) with the discovery of this vulnerability.

This document was written by Jason Rafail.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.