Cross Site Scripting (Reflected-XSS) in IceWarp Server (CVE-2023–39600)
Introduction
This article is a write-up on how I found Cross Site Scripting (Reflected-XSS) in IceWarp Server which gave me a new CVE-2023–39600
What is Cross Site Scripting (XSS) ?
Cross-site scripting (also known as XSS) is a web security vulnerability that allows an attacker to compromise the interactions that users have with a vulnerable application. It allows an attacker to circumvent the same-origin policy, which is designed to segregate different websites from each other. Cross-site scripting vulnerabilities normally allow an attacker to masquerade as a victim user, to carry out any actions that the user is able to perform and to access any of the user’s data. If the victim user has privileged access within the application, then the attacker might be able to gain full control over all of the application’s functionality and data.
Steps To Reproduce:
- Visit the home page of the site using IceWarp Client
2. Go to the URL mentioned below screenshot i.e /webmail/?color=”><img src=x onerror=confirm(1)>
3. BOOM, the malicious code is executed.
Happy to get a CVE-2023–39600.
Thanks for Reading!