CVE-2024-34462 (published 2024-05-04T19:15Z)

Alinto SOGo through 5.10.0 allows XSS during attachment preview.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Alinto/sogo
commit_details: repo_url: https://github.com/Alinto/sogo
author: Hivert Quentin
author_date: 2024-04-03 17:34:16+02:00
msg: fix(vulnerability): prevent cross-site scripting when previewing attachments
repository: repo_url: https://github.com/Alinto/sogo
repo_name: Alinto/sogo
description: SOGo is a very fast and scalable modern collaboration suite (groupware). It offers calendaring, address book management, and a full-featured Webmail client along with resource sharing and permission handling. It also makes use of documented standards (IMAP, CalDAV, CardDAV, etc.) and thereby provides native connectivity (without plugins) to many clients such as Microsoft Outlook, Apple iCal, the iPhone, Mozilla Lightning, and a plethora of mobile devices.
repo_language: Objective-C
owner: Alinto
file_changes: filename: SOGoMailBodyPart.m
change_type: ModificationType.MODIFY
diff: @@ -500,49 +500,54 @@ static BOOL debugOn = NO;
 
   error = [self matchesRequestConditionInContext: localContext];
   if (error)
-    {
-      response = error; /* return 304 or 416 */
-    }
+  {
+    response = error; /* return 304 or 416 */
+  }
   else
-    {
-//   [self debugWithFormat: @"should fetch body part: %@",
+  {
+//  [self debugWithFormat: @"should fetch body part: %@",
 // 	[self bodyPartIdentifier]];
-      data = [self fetchBLOB];
-      if (data)
-	{
-//   [self debugWithFormat:@"  fetched %d bytes: %@", [data length],
-// 	[self partInfo]];
-
-	  response = [localContext response];
-	  mimeType = [self davContentType];
-	  if ([mimeType isEqualToString: @"application/x-xpinstall"])
-	    mimeType = @"application/octet-stream";
-          else if (!asAttachment)
-            mimeType = [self contentTypeForBodyPartInfo: [self partInfo]];
-
-	  [response setHeader: mimeType forKey: @"content-type"];
-	  [response setHeader: [NSString stringWithFormat:@"%d", (int)[data length]]
-		    forKey: @"content-length"];
-
-	  if (asAttachment)
-	    {
-	      fileName = [self filename];
-	      if ([fileName length])
-		[response setHeader: [NSString stringWithFormat: @"attachment; filename*=\"utf-8''%@\"",
-					       [fileName stringByEscapingURL]]
-			     forKey: @"content-disposition"];
-	    }
-
-	  etag = [self davEntityTag];
-	  if (etag)
-	    [response setHeader: etag forKey: @"etag"];
-
-	  [response setContent: data];
-	}
+    data = [self fetchBLOB];
+    if (data)
+	  {
+//    [self debugWithFormat:@"  fetched %d bytes: %@", [data length],
+// 	  [self partInfo]];
+
+	    response = [localContext response];
+	    mimeType = [self davContentType];
+
+	    if ([mimeType isEqualToString: @"application/x-xpinstall"])
+	      mimeType = @"application/octet-stream";
+      else if (!asAttachment)
+        mimeType = [self contentTypeForBodyPartInfo: [self partInfo]];
+
+      if([mimeType rangeOfString:@"xml"].location != NSNotFound || [mimeType rangeOfString:@"html"].location != NSNotFound
+         || [mimeType rangeOfString:@"css"].location != NSNotFound || [mimeType rangeOfString:@"javascript"].location != NSNotFound)
+        [response setHeader: @"text/plain" forKey: @"content-type"];
       else
-	response = [NSException exceptionWithHTTPStatus: 404 /* not found */
-				reason: @"did not find body part"];
-    }
+	      [response setHeader: mimeType forKey: @"content-type"];
+
+	    [response setHeader: [NSString stringWithFormat:@"%d", (int)[data length]] forKey: @"content-length"];
+
+      if (asAttachment)
+      {
+          fileName = [self filename];
+          if ([fileName length])
+            [response setHeader: [NSString stringWithFormat: @"attachment; filename*=\"utf-8''%@\"",
+                  [fileName stringByEscapingURL]]
+                  forKey: @"content-disposition"];
+      }
+
+      etag = [self davEntityTag];
+      if (etag)
+        [response setHeader: etag forKey: @"etag"];
+
+      [response setContent: data];
+	  }
+    else
+	    response = [NSException exceptionWithHTTPStatus: 404 /* not found */
+				  reason: @"did not find body part"];
+  }
 
   return response;
 }

programming_language: Objective-C