Imp Webmail session hijacking vulnerability
Joao Pedro Goncalves
megas at phibernet.org
Fri Nov 9 13:46:44 PST 2001
- It's possible to hijack an imp/horde session using a cross-site script
attack, quite similar to the one explored by Marc Slemko in his
"Microsoft Passport to Trouble" paper.
- After hijacking the cookies, the attacker can use the session and read
the victim's mail.
- Imp webmail is part of the Horde Application Framework, at
http://www.horde.org , which allows web access to an email account,
through pop3 or imap.
- Imp is included in the Linux Madrake, Conectiva Distributions.
It's also available in the Redhat PowerTools.
- It's used in several webmail sites, some of which
with hundreds of thousand of users, and all of the ones tested were
vulnerable. Some of the administrators were warned before this advisory
being public. Some have already been patched.
- All stable imp webmail versions, up to 2.2.6 including are vulnerable, the
devel version, 2.3 and 3.0 Release Candidate 1 are not affected by this
- The horde team was warned about this and have commited a fix,
a new version should be uploaded soon.
- To apply the patch use
or just escape the $message variable
$message = htmlspecialchars($message);
if your imp installation is already heavily customized.
- To exploit this vulnerability using a text message, the attacker sends an
email with a url, where if the user clicks, is redirected to
which in return redirects the user's browser to the attacker's server where
he hijacks the cookies that the browser used in the context of the webmail
site, and the session therefore.
This attack is just one more example on how trusting user input is a Bad
Thing(tm), as well as the risks inherent to cross-site script attacks.
Please, pretty please, this was discovered while playing around with
cookie-based session sites, after reading about the MS Wallet attack and saw
how almost 2 years after the CERT advisory on these techniques, lots of
applications are still vulnerable. There are probably lots of kids around
exploiting similar vulnerabilities. So check your web applications for
similar vulnerabilities and ask yourself how many times have you pasted
directly into the html some variable passed by the url or cookie.
- For more info on cross-site scripting, read CERT advisory and
Marc Slemko's paper.
Imp Project homepage:
Marc Slemko's "Microsoft Passport to Trouble":
CERT advisory on cross-site scripting
João Pedro Gonçalves
megas at phibernet.org
Phibernet Information Network
More information about the horde