A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the attlocalname field in Deliver.class.php.
SquirrelMail 1.4.22 (and other versions before 201704270200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the DeliverSendMail.class.php with the initStream function that uses escapeshellcmd() to sanitize the sendmail command before executing it. The use of escapeshellcmd() is not correct in this case since it doesn't escape whitespaces, allowing the injection of arbitrary command parameters. The problem is in -f$envelopefrom within the sendmail command line. Hence, if the target server uses sendmail and SquirrelMail is configured to use it as a command-line program, it's possible to trick sendmail into using an attacker-provided configuration file that triggers the execution of an arbitrary command. For exploitation, the attacker must upload a sendmail.cf file as an email attachment, and inject the sendmail.cf filename with the -C option within the "Options > Personal Informations > Email Address" setting.
Multiple cross-site scripting (XSS) flaws were found in the SquirrelMail webmail client: XSS flaws in generic options inputs, XSS flaw in the SquirrelSpell plug-in, XSS flaw in the Index Order page.
Also protection against Cross-site Request Forgery (CSRF) flaws has been added to the empty trash feature and to the Index Order page.
The CSRF flaws got a dedicated CVE identifier of CVE-2011-2753. For further information have a look at: [1] https://bugzilla.redhat.com/showbug.cgi?id=CVE-2011-2753
Upstream advisory: [2] http://www.squirrelmail.org/security/issue/2011-07-11
Relevant upstream patch: [3] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119
functions/pageheader.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
It was found that SquirrelMail webmail client did not properly handle generation of a particular web page HTML Header in cases, when entire application was loaded in separated HTML frame, potentially overloading other HTML elements on top of SquirrelMail's user interface. A remote attacker could use this flaw to obtain access to sensitive user data (passwords for example).
Upstream advisory: [1] http://www.squirrelmail.org/security/issue/2011-07-12
Relevant upstream patch: [2] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14117
A denial of service flaw was found in the way SquirrelMail processed random login attempts with 8-bit characters in the password. A remote attacker could use this flaw to cause the server system potentially to run out of the hard disk space via random login attempts, causing SquirrelMail temporarily to accept the login and create a preferences file for the given username.
References: [1] http://www.squirrelmail.org/security/issue/2010-07-23
Upstream patch: [2] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?view=patch&r1=13972&r2=13971&pathrev=13972
Affected Versions: <= v1.4.20
Register Globals: Registerglobals does not have to be on for this issue.
Credit: Issue discovered by Mikhail Goriachev
A denial of service flaw was found in the way SquirrelMail processed random login attempts with 8-bit characters in the password. A remote attacker could use this flaw to cause the server system potentially to run out of the hard disk space via random login attempts, causing SquirrelMail temporarily to accept the login and create a preferences file for the given username.
References: [1] http://www.squirrelmail.org/security/issue/2010-07-23
Upstream patch: [2] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?view=patch&r1=13972&r2=13971&pathrev=13972
Affected Versions: <= v1.4.20
Register Globals: Registerglobals does not have to be on for this issue.
Credit: Issue discovered by Mikhail Goriachev
A, From SquirrelMail vulnerability report (http://www.squirrelmail.org/security/issue/2009-05-08):
Two issues were fixed that both allowed an attacker to run arbitrary script (XSS) on most any SquirrelMail page by getting the user to click on specially crafted SquirrelMail links.
Credits: Niels Teusink and Christian Balzer
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670
B, From SquirrelMail vulnerability report: (http://www.squirrelmail.org/security/issue/2009-05-09):
An issue was fixed wherein input to the contrib/decryptheaders.php script was not sanitized and allowed arbitrary script execution upon submission of certain values.
Credits: Niels Teusink
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672
A, From SquirrelMail vulnerability report (http://www.squirrelmail.org/security/issue/2009-05-08):
Two issues were fixed that both allowed an attacker to run arbitrary script (XSS) on most any SquirrelMail page by getting the user to click on specially crafted SquirrelMail links.
Credits: Niels Teusink and Christian Balzer
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670
B, From SquirrelMail vulnerability report: (http://www.squirrelmail.org/security/issue/2009-05-09):
An issue was fixed wherein input to the contrib/decryptheaders.php script was not sanitized and allowed arbitrary script execution upon submission of certain values.
Credits: Niels Teusink
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672
From SquirrelMail vulnerability report:
An issue was fixed that allowed an attacker to possibly steal user data by hijacking the SquirrelMail login session.
Credits: Tomas Hoger
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13676
From SquirrelMail vulnerability report:
An issue was fixed that allowed an attacker to possibly steal user data by hijacking the SquirrelMail login session.
Credits: Tomas Hoger
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13676
From Squirrelmail vulnerability report:
An issue was fixed that allowed phishing and cross-site scripting (XSS) attacks to be run by surreptitious placement of content in specially-crafted emails sent to SquirrelMail users.
Credits: Luc Beurton
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13667
From Squirrelmail vulnerability report:
An issue was fixed that allowed phishing and cross-site scripting (XSS) attacks to be run by surreptitious placement of content in specially-crafted emails sent to SquirrelMail users.
Credits: Luc Beurton
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13667
From SquirrelMail vulnerability report:
An issue was fixed that allowed arbitrary server-side code execution when SquirrelMail was configured to use the example "mapypalias" username mapping functionality.
Credits: Niels Teusink
Updated upstream patch (2009-05-21): http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?r1=13549&r2=13733&view=patch
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
SquirrelMail 1.4.11 and 1.4.12, as distributed on sourceforge.net before 20071213, has been externally modified to create a Trojan Horse that introduces a PHP remote file inclusion vulnerability, which allows remote attackers to execute arbitrary code.
Unspecified vulnerability in the G/PGP (GPG) Plugin 2.0 for Squirrelmail 1.4.10a allows remote authenticated users to execute arbitrary commands via unspecified vectors, possibly related to the passphrase variable in the gpgsignattachment function, aka ZD-00000004. this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.
Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin 2.1 for Squirrelmail allow remote attackers to execute arbitrary commands via unspecified vectors. NOTE: this information is based upon a vague pre-advisory from a reliable researcher.
Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2.1 for Squirrelmail might allow "local authenticated users" to inject certain commands via unspecified vectors. NOTE: this might overlap CVE-2005-1924, CVE-2006-4169, or CVE-2007-3634.
Cross-site request forgery (CSRF) vulnerability in SquirrelMail 1.4.8-4.fc6 and earlier allows remote attackers to perform unspecified actions as arbitrary users via unspecified vectors. NOTE: this issue might overlap CVE-2007-2589 or CVE-2002-1648.
Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail 1.4.0 through 1.4.9a allows remote attackers to send e-mails from arbitrary users via certain data in the SRC attribute of an IMG element.
Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) deletedraft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."
Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.
SquirrelMail 1.4.6 and earlier, with registerglobals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while "cookie theft" is frequently associated with XSS, the vendor disclosure is too vague to be certain of this.
Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary HTML via the mailbox parameter.
DISPUTED PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when registerglobals is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable.
webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the rightframe parameter. NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as XSS.
Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers with invalid (1) "/" and "/" comments, or (2) a newline in a "url" specifier, which is processed by certain web browsers including Internet Explorer.
CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimapmailboxselect command, aka "IMAP injection."