CVE-2012-5565: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-04-05T21:55Z
Repository: https://github.com/horde/horde
Language: Other
Files changed: imp/docs/CHANGES, imp/js/compose-dimp.js, imp/package.xml
Commit date: 2012-10-29 15:48:49 -0600
Commit message: [mms] SECURITY: Fix obscure XSS issue if uploading a file in dynamic view from the browser's local filesystem that has a filename that contains HTML.

This attack requires a filesystem that supports angled brackets in
filenames (Windows does NOT; Linux does). Essentially, a user has to
upload a malicious filename that they created on their own filesystem.

Conflicts:
	imp/docs/CHANGES
	imp/js/compose-dimp.js
	imp/package.xml

Diff: diff --git a/imp/docs/CHANGES b/imp/docs/CHANGES
index c83b8309bf..a882d37c90 100644
--- a/imp/docs/CHANGES
+++ b/imp/docs/CHANGES
@@ -205,12 +205,14 @@ v6.0.0alpha1
 
 -----------
 v5.0.24-git
 -----------
 
-[mms] Catch failure to add attachments because PHP's maximum allowed POST size
-      was exceeded.
+[mms] SECURITY: Fix obscure XSS issue if uploading a file in dynamic view from
+      the browser's local filesystem that has a filename that contains HTML.
+[mms] Catch failure to add attachments in dynamic view because PHP's maximum
+      allowed POST size was exceeded.
 [jan] Fix search link from portal if using dynamic view (Bug #11314).
 [mms] Fix regression in using Virtual Trash (Bug #11478;
       tonyb@go-concepts.com).
 [mms] Fix sending MDN notifications in traditional view (Bug #11311).
 [mms] Fix changing sort order in dynamic search mailboxes (Bug #11108).
diff --git a/imp/js/compose-dimp.js b/imp/js/compose-dimp.js
index 0b03d2597e..334d9914e1 100644
--- a/imp/js/compose-dimp.js
+++ b/imp/js/compose-dimp.js
@@ -798,11 +798,11 @@ var DimpCompose = {
     uploadAttachment: function()
     {
         var u = $('upload');
         this.uniqueSubmit('addAttachment');
         u.up().hide();
-        $('upload_wait').update(DimpCore.text.uploading + ' (' + $F(u) + ')').show();
+        $('upload_wait').update(DimpCore.text.uploading + ' (' + $F(u).escapeHTML() + ')').show();
     },
 
     toggleCC: function(type)
     {
         var t = $('toggle' + type),
diff --git a/imp/package.xml b/imp/package.xml
index 0f6a9b8d1a..62c2e290b0 100644
--- a/imp/package.xml
+++ b/imp/package.xml
@@ -2572,11 +2572,12 @@
     <release>stable</release>
     <api>stable</api></stability>
    <date>2012-07-20</date>
    <license uri="http://www.horde.org/licenses/gpl">GPL-2.0</license>
    <notes>
-* [mms] Catch failure to add attachments because PHP&apos;s maximum allowed POST size was exceeded.
+* [mms] SECURITY: Fix obscure XSS issue if uploading a file in dynamic view from the browser&apos;s local filesystem that has a filename that contains HTML.
+* [mms] Catch failure to add attachments in dynamic view because PHP&apos;s maximum allowed POST size was exceeded.
 * [jan] Fix search link from portal if using dynamic view (Bug #11314).
 * [mms] Fix regression in using Virtual Trash (Bug #11478; tonyb@go-concepts.com).
 * [mms] Fix sending MDN notifications in traditional view (Bug #11311).
 * [mms] Fix changing sort order in dynamic search mailboxes (Bug #11108).
 * [mms] Fix regression in creating top-level mailbox in traditional view (Bug #11326).

Vulnerable code: [mms] Catch failure to add attachments because PHP's maximum allowed POST size
      was exceeded.
        $('upload_wait').update(DimpCore.text.uploading + ' (' + $F(u) + ')').show();
* [mms] Catch failure to add attachments because PHP&apos;s maximum allowed POST size was exceeded.
Fixed code: [mms] SECURITY: Fix obscure XSS issue if uploading a file in dynamic view from
      the browser's local filesystem that has a filename that contains HTML.
[mms] Catch failure to add attachments in dynamic view because PHP's maximum
      allowed POST size was exceeded.
        $('upload_wait').update(DimpCore.text.uploading + ' (' + $F(u).escapeHTML() + ')').show();
* [mms] SECURITY: Fix obscure XSS issue if uploading a file in dynamic view from the browser&apos;s local filesystem that has a filename that contains HTML.
* [mms] Catch failure to add attachments in dynamic view because PHP&apos;s maximum allowed POST size was exceeded.