PT-2011-48: Multiple Vulnerabilities in AtMail

Vulnerable software

Webmail Interface AtMail 
Version: 1.04 and earlier

Application link: 
http://atmail.org/

Severity level

Severity level: High 
Impact: Multiple vulnerabilities 
Access Vector: Network exploitable 

CVSS v2: 
Base Score: 9.0 
Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C)

CVE: not assigned

Software description

AtMail is an open source webmail client.

Vulnerability description

Specialists from the Positive Technologies Research Center have revealed multiple vulnerabilities in the AtMail webmail interface.

1. Arbitrary Files Loading
The system allows one to load files attached to email letters. File extension is not checked; thus, arbitrary files including .php files can be downloaded.
As a result, the file will be available at:
https://localhost/tmp/username@host.com/username@host.com-string-PositiveShell.php

2. Path Traversal
Vulnerability in the file: /compose.php
Vulnerable code fragment:
$var['unique'] = preg_replace('/\.\.\//', '', $var['unique']);
The substring "../" is deleted from the $var['unique'] parameter, but the process is not recursive. Thus, if the parameter contains a substring "..././", than the substring "../" will be left after deletion.
As a result, Path Traversal attacks are possible.
Exploitation example:
https://localhost/compose.php?
func=renameattach&unique=/..././..././..././..././..././..././..././..././..././..././..././.../
./tmp/positive.test%00&Attachment[]=/../../../../../../../../../etc/passwd

3. Arbitrary Files Copying
The system allows one to copy the attached files. The name of the file to be copied is not checked, so an arbitrary file can be copied.
The name of the file to be created is not checked for special characters (e.g. null bytes), which allows one to create a file with arbitrary extension.
Furthermore, an attacker will be able to create this file in an arbitrary directory if he/she exploits the Path Traversal vulnerability described above.
Vulnerability in the files:
/compose.php
/libs/Atmail/SendMsg.php (the methods "renameattach" и "copyFile")
Exploitation example:
https://localhost/compose.php?func=renameattach&unique=1.txt%00&Attachment[]
=/../../../../../../../../../etc/passwd
As a result, the file will be available at:
https://localhost/tmp/username@host.com/username@host.com-1.txt

4. Arbitrary Files Reading
The name of the file being read is improperly verified. Filtering mechanism can be bypassed. It allows attackers to read arbitrary files.
Vulnerability in the file: mime.php
Vulnerable code fragment:
$var['src'] = rawurldecode($_REQUEST['file']);
$var['src'] = preg_replace('/^.+[\\\\\\/]/', '', $var['src']); // Don't allow to go down a dir,
sanity check
If the file name contains a slash (‘/’), then all characters before it will be deleted.
However, the regular expression doesn’t use the ‘s’ modifier, and the %0a character will be recognized as two characters (linefeed + carriage return).
The control symbol ‘.’ without the ‘s’ modifier can replace only one character in a regular expression; thus, only characters before %0a will be checked.
Exploitation example:
https://localhost/mime.php?file=%0A/../../../../../../../../../etc/passwd&name=positive.html

5. Sensitive Information Disclosure
The file info.php calls the function phpinfo(), which displays information about the system configuration. https://localhost/install/info.php

How to fix

Update your software up to the latest version

Advisory status

06.12.2011 - Vendor is notified
06.02.2012 - Vulnerability details were sent to CERT
26.03.2012 - Vendor releases fixed version and details
26.03.2012 - Public disclosure

Credits

The vulnerability was discovered by Sergey Scherbel, Positive Research Center (Positive Technologies Company)

References

http://en.securitylab.ru/lab/PT-2011-48
http://www.kb.cert.org/vuls/id/743555

Reports on the vulnerabilities previously discovered by Positive Research:

http://ptsecurity.com/research/advisory/
http://en.securitylab.ru/lab/

Threatscape