// back

Microsoft Outlook Web Access Cross-Site Scripting Vulnerability

06.14.05

BACKGROUND

Microsoft Outlook Web Access is an optional component included in
Microsoft Exchange that allows users to access their mailboxes using a
web front end. More information is available at the following address:

http://www.microsoft.com/exchange/owa/

DESCRIPTION

Remote exploitation of a Cross-Site Scripting (XSS) vulnerability in
the Outlook Web Access (OWA) component within version 5.5 of Microsoft
Corp.'s Exchange Server allows an attacker to force to inject arbitrary
script code into a users session, possibly stealing logon credentials.

To demonstrate the vulnerability, simply embed the following encoded
text into an HTML e-mail:

<IMG SRC="jav&#X41sc&#0010;ript:alert('XSS')">

This will have the affect of popping up an alert window when the
targeted user views the mail using Outlook Web Access. This proof of
concept could easily be altered to cause the script to return
authentication credentials to an attacker controlled server.

ANALYSIS

Successful exploitation of this vulnerability would allow an attacker
to inject arbitrary script code into the Web Access session. This could
allow for the theft of authentication information, which could lead to
a compromised mail account.

In order for exploitation to occur, the targeted user would only have
to view an e-mail from an attacker. As it is trivial to spoof the
source of e-mail, this vulnerability has a high potential for
widespread exploitation.

DETECTION

Version 5.5 of Exchange Server has been confirmed vulnerable. Microsoft
has reported that Version 2000 and 2003 of Exchange Server are not
vulnerable.

WORKAROUND

iDEFENSE is currently unaware of any effective workarounds that can be
implemented on the server in order to mitigate the risk of this
vulnerability; however, there are workarounds available for client
protection. Since exploitation allows for the execution of malicious
code in web browsers, successful exploitation could be thwarted by
disabling script code and active content support within a client
browser. Take note that employing this workaround could adversely
affect web sites reliant upon the execution of browser-based script
code. The following steps can be taken to disable active scripting in
Mozilla and Internet Explorer:

Internet Explorer 5.0, 5.01, 5.5, 6

    a. On the Tools menu, click Internet Options, click the Security tab,
       click the Internet Web content zone, and then click Custom Level.
    b. In the Settings box, scroll down to the Scripting section, and click
       Disable under Active scripting and Scripting of Java applets.
    c. Click OK, and then click OK again.

Mozilla Firefox

    a. On the Tools menu, click Options and click the Web Features tab.
    b. De-select the Enable JavaScript checkbox.
    c. Click OK.

VENDOR RESPONSE

The vendor security advisory and appropriate patches are available at:

   http://www.microsoft.com/technet/security/Bulletin/MS05-029.mspx

CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-0563 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

DISCLOSURE TIMELINE

04/08/2005   Initial vendor notification
04/08/2005   Initial vendor response
06/14/2005   Coordinated public disclosure

CREDIT

Gael Delalleau is credited with this discovery.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

LEGAL NOTICES

Copyright © 2005 Verisign, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.