CVE-2018-16586 (published 2018-09-28T00:29Z)

In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/OTRS/otrs
commit_details: repo_url: https://github.com/OTRS/otrs
author: Martin Gruner
author_date: 2018-09-04 11:09:30+02:00
msg: Improved HTML filter.
repository: repo_url: https://github.com/OTRS/otrs
repo_name: OTRS/otrs
description: ((OTRS)) Community Edition is one of the most flexible web-based ticketing systems used for Customer Service, Help Desk, IT Service Management. Please note that ((OTRS)) Community Edition offers limited OTRS functionality.
repo_language: Perl
owner: OTRS
file_changes: filename: HTMLUtils.pm
change_type: ModificationType.MODIFY
diff: @@ -1163,10 +1163,28 @@ sub Safety {
                 }egsxim;
             }
 
+            # Remove malicious CSS content
+            $Tag =~ s{
+                (\s)style=("|') (.*?) \2
+            }
+            {
+                my ($Space, $Delimiter, $Content) = ($1, $2, $3);
+
+                if (
+                    ($Param{NoIntSrcLoad} && $Content =~ m{url\(})
+                    || ($Param{NoExtSrcLoad} && $Content =~ m/(http|ftp|https):\//i)) {
+                    $Replaced = 1;
+                    '';
+                }
+                else {
+                    "${Space}style=${Delimiter}${Content}${Delimiter}";
+                }
+            }egsxim;
+
             # remove load tags
             if ($Param{NoIntSrcLoad} || $Param{NoExtSrcLoad}) {
                 $Tag =~ s{
-                    ($TagStart (.+?) (?: \s | /) src=(.+?) (\s.+?|) $TagEnd)
+                    ($TagStart (.+?) (?: \s | /) (?:src|poster)=(.+?) (\s.+?|) $TagEnd)
                 }
                 {
                     my $URL = $3;

programming_language: Perl
filename: Safety.t
change_type: ModificationType.MODIFY
diff: @@ -816,6 +816,116 @@ You should be able to continue reading these lessons, however.
             Replace => 0,
         },
     },
+    {
+        Name   => 'Safety - remote poster attribute, forbidden',
+        Input  => '<video controls poster="http://some.domain/vorschaubild.png"/>',
+        Config => {
+            NoExtSrcLoad => 1,
+        },
+        Result => {
+            Output  => '',
+            Replace => 1,
+        },
+    },
+    {
+        Name   => 'Safety - remote poster attribute, allowed',
+        Input  => '<video controls poster="http://some.domain/vorschaubild.png"/>',
+        Config => {
+            NoExtSrcLoad => 0,
+        },
+        Result => {
+            Output  => '<video controls poster="http://some.domain/vorschaubild.png"/>',
+            Replace => 0,
+        },
+    },
+    {
+        Name  => 'Safety - malicious CSS content - remote background image, forbidden',
+        Input => '<a href="localhost" style="background-image:url(http://localhost:8000/css-background)">localhost</a>',
+        Config => {
+            NoExtSrcLoad => 1,
+        },
+        Result => {
+            Output  => '<a href="localhost">localhost</a>',
+            Replace => 1,
+        },
+    },
+    {
+        Name  => 'Safety - malicious CSS content - remote background image, allowed',
+        Input => '<a href="localhost" style="background-image:url(http://localhost:8000/css-background)">localhost</a>',
+        Config => {
+            NoExtSrcLoad => 0,
+        },
+        Result => {
+            Output  => '<a href="localhost" style="background-image:url(http://localhost:8000/css-background)">localhost</a>',
+            Replace => 0,
+        },
+    },
+    {
+        Name  => 'Safety - malicious CSS content - local background image, forbidden',
+        Input => '<a href="localhost" style="background-image:url(/local/css-background)">localhost</a>',
+        Config => {
+            NoIntSrcLoad => 1,
+        },
+        Result => {
+            Output  => '<a href="localhost">localhost</a>',
+            Replace => 1,
+        },
+    },
+    {
+        Name  => 'Safety - malicious CSS content - local background image, allowed',
+        Input => '<a href="localhost" style="background-image:url(/local/css-background)">localhost</a>',
+        Config => {
+            NoIntSrcLoad => 0,
+        },
+        Result => {
+            Output  => '<a href="localhost" style="background-image:url(/local/css-background)">localhost</a>',
+            Replace => 0,
+        },
+    },
+    {
+        Name   => 'Safety - malicious CSS content - remote css content, forbidden',
+        Input  => q|<p style="content:url('http://localhost:8000/css-content');"></p>|,
+        Config => {
+            NoExtSrcLoad => 1,
+        },
+        Result => {
+            Output  => '<p></p>',
+            Replace => 1,
+        },
+    },
+    {
+        Name   => 'Safety - malicious CSS content - remote css content, allowed',
+        Input  => q|<p style="content:url('http://localhost:8000/css-content');"></p>|,
+        Config => {
+            NoExtSrcLoad => 0,
+        },
+        Result => {
+            Output  => q|<p style="content:url('http://localhost:8000/css-content');"></p>|,
+            Replace => 0,
+        },
+    },
+    {
+        Name   => 'Safety - malicious CSS content - local css content, forbidden',
+        Input  => q|<p style="content:url('/local/css-content');"></p>|,
+        Config => {
+            NoIntSrcLoad => 1,
+        },
+        Result => {
+            Output  => '<p></p>',
+            Replace => 1,
+        },
+    },
+    {
+        Name   => 'Safety - malicious CSS content - local css content, allowed',
+        Input  => q|<p style="content:url('/local/css-content');"></p>|,
+        Config => {
+            NoIntSrcLoad => 0,
+        },
+        Result => {
+            Output  => q|<p style="content:url('/local/css-content');"></p>|,
+            Replace => 0,
+        },
+    },
 );
 
 for my $Test (@Tests) {

programming_language: Perl