CVE-2024-34462 (Objective-C, published 2024-05-04T19:15Z)
Description: value: Alinto SOGo through 5.10.0 allows XSS during attachment preview.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Alinto/sogo
Files changed:
SoObjects/Mailer/SOGoMailBodyPart.m
Commit message: fix(vulnerability): prevent cross-site scripting when previewing attachments


Vulnerable code:
    {
      response = error; /* return 304 or 416 */
    }
    {
//   [self debugWithFormat: @"should fetch body part: %@",
      data = [self fetchBLOB];
      if (data)
	{
//   [self debugWithFormat:@"  fetched %d bytes: %@", [data length],
// 	[self partInfo]];

	  response = [localContext response];
	  mimeType = [self davContentType];
	  if ([mimeType isEqualToString: @"application/x-xpinstall"])
	    mimeType = @"application/octet-stream";
          else if (!asAttachment)
            mimeType = [self contentTypeForBodyPartInfo: [self partInfo]];

	  [response setHeader: mimeType forKey: @"content-type"];
	  [response setHeader: [NSString stringWithFormat:@"%d", (int)[data length]]
		    forKey: @"content-length"];

	  if (asAttachment)
	    {
	      fileName = [self filename];
	      if ([fileName length])
		[response setHeader: [NSString stringWithFormat: @"attachment; filename*=\"utf-8''%@\"",
					       [fileName stringByEscapingURL]]
			     forKey: @"content-disposition"];
	    }

	  etag = [self davEntityTag];
	  if (etag)
	    [response setHeader: etag forKey: @"etag"];

	  [response setContent: data];
	}
	response = [NSException exceptionWithHTTPStatus: 404 /* not found */
				reason: @"did not find body part"];
    }

Fixed code:
  {
    response = error; /* return 304 or 416 */
  }
  {
//  [self debugWithFormat: @"should fetch body part: %@",
    data = [self fetchBLOB];
    if (data)
	  {
//    [self debugWithFormat:@"  fetched %d bytes: %@", [data length],
// 	  [self partInfo]];

	    response = [localContext response];
	    mimeType = [self davContentType];

	    if ([mimeType isEqualToString: @"application/x-xpinstall"])
	      mimeType = @"application/octet-stream";
      else if (!asAttachment)
        mimeType = [self contentTypeForBodyPartInfo: [self partInfo]];

      if([mimeType rangeOfString:@"xml"].location != NSNotFound || [mimeType rangeOfString:@"html"].location != NSNotFound
         || [mimeType rangeOfString:@"css"].location != NSNotFound || [mimeType rangeOfString:@"javascript"].location != NSNotFound)
        [response setHeader: @"text/plain" forKey: @"content-type"];
	      [response setHeader: mimeType forKey: @"content-type"];

	    [response setHeader: [NSString stringWithFormat:@"%d", (int)[data length]] forKey: @"content-length"];

      if (asAttachment)
      {
          fileName = [self filename];
          if ([fileName length])
            [response setHeader: [NSString stringWithFormat: @"attachment; filename*=\"utf-8''%@\"",
                  [fileName stringByEscapingURL]]
                  forKey: @"content-disposition"];
      }

      etag = [self davEntityTag];
      if (etag)
        [response setHeader: etag forKey: @"etag"];

      [response setContent: data];
	  }
    else
	    response = [NSException exceptionWithHTTPStatus: 404 /* not found */
				  reason: @"did not find body part"];
  }