NOCC: XSS


PROGRAM: NOCC
VENDOR: Olivier Cahagne et al.
HOMEPAGE: http://nocc.sourceforge.net/
VULNERABLE VERSIONS: 0.9.5, possibly others
IMMUNE VERSIONS: 0.9.5 with my patch applied
SEVERITY: high
LOGIN REQUIRED: no


DESCRIPTION:

"NOCC is a simple and fast Web-based e-mail reader which can handle
POP3, SMTP, and IMAP servers. It is written with PHP4, and uses
sessions, has low requirements (no database, frames), and is easy
to install. It also features multi-language support, MIME attachment
decoding/encoding, and the ability to display HTML messages."

(direct quote from the program's project page at Freshmeat)

NOCC is published under the terms of the GNU General Public
License. It is one of the packages in Debian GNU/Linux and one of
FreeBSD's ports.


SUMMARY:

NOCC has got several cross-site scripting holes when displaying
e-mail messages. They allow an attacker to take over a victim's
e-mail account and/or perform actions against the victim's will,
by simply sending a malicious e-mail message to the victim.


TECHNICAL DETAILS:

1) If the e-mail message's MIME type is text/plain, the program
doesn't remove any HTML code from the mail body. It is shown "live".

2) When the victim selects "View header", no HTML codes are removed
from mail headers like Subject and Date (yes, you can write whatever
you like in the Date header).


COMMUNICATION WITH VENDOR:

The vendor was contacted on the 9th and the 10th of July. They
haven't released any official fixed version yet.


MY PATCH:

I wrote a patch for these security holes, and it is included in
this mail as an attachment. I have patched against version 0.9.5.


// Ulf Harnhammar
   VSU Security
   ulfh@update.uu.se


"I saw the worst minds of my generation / getting their political
 information from tabloids / listening to Savage Garden's greatest
 hits / getting married and having kids at 25 just 'cause the
 neighbours did / and building the worst administrative web-based
 members interface ever known to man" (To B.)


---293465837-47254757-1035134538=:28852
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="nocc.patch"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.LNX.4.21.0210201922180.28852@Tempo.Update.UU.SE>
Content-Description: 
Content-Disposition: attachment; filename="nocc.patch"

LS0tIG5vY2MtMC45LjUvZnVuY3Rpb25zLnBocC5vbGQJU3VuIE9jdCAyMCAw
MDoxMjozNCAyMDAyDQorKysgbm9jYy0wLjkuNS9mdW5jdGlvbnMucGhwCVN1
biBPY3QgMjAgMDA6Mjc6MTIgMjAwMg0KQEAgLTIxMyw3ICsyMTMsNyBAQA0K
IAkJJ2JvZHknID0+ICRnbG9iX2JvZHksDQogCQknYm9keV9taW1lJyA9PiAk
dG1wWydtaW1lJ10sDQogCQknYm9keV90cmFuc2ZlcicgPT4gJHRtcFsndHJh
bnNmZXInXSwNCi0JCSdoZWFkZXInID0+ICRoZWFkZXIsDQorCQknaGVhZGVy
JyA9PiBodG1sc3BlY2lhbGNoYXJzKCRoZWFkZXIpLA0KIAkJJ3ZlcmJvc2Un
ID0+ICR2ZXJib3NlLA0KIAkJJ3ByZXYnID0+ICRwcmV2X21zZywNCiAJCSdu
ZXh0JyA9PiAkbmV4dF9tc2cNCkBAIC00NDQsNiArNDQ0LDcgQEANCiAJfQ0K
IAllbHNlaWYgKGVyZWdpKCdwbGFpbicsICRtaW1lKSkNCiAJew0KKwkJJGJv
ZHkgPSBodG1sc3BlY2lhbGNoYXJzKCRib2R5KTsNCiAJCSRib2R5ID0gZXJl
Z2lfcmVwbGFjZSgiKGh0dHB8aHR0cHN8ZnRwKTovLyhbYS16QS1aMC05Ky09
JSY6Xy5+P10rWyNhLXpBLVowLTkrXSopIiwiPGEgaHJlZj1cIlxcMTovL1xc
MlwiIHRhcmdldD1cIl9ibGFua1wiPlxcMTovL1xcMjwvYT4iLCAkYm9keSk7
DQogCQkkYm9keSA9IGVyZWdpX3JlcGxhY2UoIihbI2EtekEtWjAtOSstLl9d
KilAKFsjYS16QS1aMC05Ky1fXSopXC4oW2EtekEtWjAtOSstXy5dK1sjYS16
QS1aMC05K10qKSIsIjxhIGhyZWY9XCIkUEhQX1NFTEY/YWN0aW9uPXdyaXRl
JmFtcDttYWlsX3RvPVxcMUBcXDIuXFwzJmFtcDtsYW5nPSRsYW5nXCI+XFwx
QFxcMi5cXDM8L2E+IiwgJGJvZHkpOw0KIAkJJGJvZHkgPSBubDJicigkYm9k
eSk7DQo=
---293465837-47254757-1035134538=:28852--