Vulnerability

    Hotmail

Affected

    Hotmail

Description

    Georgi  Guninski  found   following.   Hotmail  allows   executing
    JavaScript code in email messages using

        <IMG LOWSRC="javascript:....">

    which may compromise user's Hotmail mailbox.

    There is a major security  flaw in Hotmail which allows  injecting
    and  executing  JavaScript  code  in  an  email  message using the
    javascript protocol.  This exploit works both on Internet Explorer
    5.x (almost sure IE 4.x)  and Netscape Communicator 4.x.   Hotmail
    filters the "javascript:" protocol for security reasons.  But  the
    following JavaScript is executed:

        <IMG LOWSRC="javascript:alert('Javascript is executed')">

    if  the  user  has  enabled  automatically loading of images (most
    users have).

    Executing JavaScript  when the  user opens  Hotmail email  message
    allows for example displaying a  fake login screen where the  user
    enters his password which is then stolen.  No need to make a scary
    demonstration, but it is also possible to read user's messages, to
    send messages from  user's name and  doing other mischief.   It is
    also possible to get the cookie from Hotmail, which is  dangerous.
    Hotmail deliberately  escapes all  JavaScript (it  can escape)  to
    prevent such attacks, but obviously  there are holes.  It  is much
    easier to  exploit this  vulnerability if  the user  uses Internet
    Explorer 5.x

    The code that must be included in HTML email message is:

        <IMG LOWSRC="javascript:alert('Javascript is executed')">

    A  quick  check  of  the  Messenger  Express web client built into
    Netscape  Messaging  Server  4.1  at  one  of  my  sites  seems to
    indicate that  it may  be vulnerable  as well,  as the  code above
    works fine  so long  as the  browser has  JS enabled.  However, it
    doesn't use cookies much if at all, so the cookie capture risk  is
    lower  though  it  seems  plausible  that  the  social engineering
    attacks remain a threat.

    Edwin Gonzalez tested the code and it seems that Yahoo's web-based
    email is also vulnerable.

Solution

    Microsoft developed a fix that eliminates this vulnerability,  and
    have deployed it to all Hotmail servers.  Workaround: disable JS.