Dario Weiss

An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context, which operates with root privileges. This occurs when the system evaluates attacker-influenced replacement text as Perl code within sender or recipient replacement rules, provided an active rule uses message-derived replacement data and its search condition is matched.

An issue exists where the system trusts a file path provided in externally supplied Large File Transfer (LFT) attachment metadata. An unauthenticated remote sender can exploit this to cause the mail-processing worker, which operates with root privileges, to disclose, move, or delete accessible regular files. This occurs when LFT is enabled and the message reaches an affected secure-mail processing path.

SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailability.

The Webbox application is susceptible to stored cross-site scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. An attacker can exploit this by sending an email containing malicious JavaScript code, which is then executed when a user opens the email.

The Webbox application handles password changes via a function triggered by including the string "(editini)" in the file path to write a new password to the "Archive.ini" file. The application fails to verify if the provided path actually refers to an "Archive.ini" file. An unauthenticated attacker can trigger a buffer overflow—a condition where a program writes more data to a block of memory than it can hold—by specifying a file with an excessive size, leading to a server crash and denial of service.

The Webbox application contains a buffer overflow issue in the "//serverClient close.html" endpoint. An authenticated attacker can cause a server crash and denial of service by submitting excessively long values in multiple form data parameters. If the stack state allows or a stack canary is disclosed, this could lead to remote code execution and full server compromise. A stack canary is a security value placed in memory to detect buffer overflows before they can be exploited.

The Webbox application exposes a functionality that allows the server to be shut down when the '/internalRestart' endpoint is accessed. This endpoint is accessible to unauthenticated users over the public Internet. Instead of performing a restart, the server shuts down completely, allowing a remote attacker to trigger a persistent denial of service. Recovery from this state requires manual administrator intervention to restart the service.

The Webbox application is susceptible to HTTP header injection via the `cType` URL parameter. The application fails to properly restrict control characters, such as colons or URL-encoded newlines (`%0a`), allowing the modification of the Content-Type header in HTTP responses. This flaw enables attackers to inject additional headers, such as extra Location headers, which can lead to an open redirect.

Tobit Laboratories AG TeamDavid's Webbox contains an open redirect issue. An attacker can craft a URL that redirects the user's browser to an arbitrary third-party site via the `replyUrl` parameter. This can be leveraged for phishing attacks by using a trusted domain link to redirect users to a malicious website.

The Webbox application contains a reflected cross-site scripting (XSS) flaw. An attacker can execute a malicious payload in a victim's browser by sending a specially crafted link. This is achieved by including an arbitrary path, an XSS payload or the `EntryInfo` parameter, and the `!templateName=entryMail` parameter.

The send email, fax, and SMS functionality allows for arbitrary file deletion. An attacker can delete any file on the system by specifying an @@COMMENTFILE command within the `scjob` form field.

The Webbox component constructs redirect URLs using user-supplied input appended to the redirect target in a 302 HTTP response. An attacker can use URL-encoded characters, such as `%2e` (representing a dot), to manipulate the URL portion following the top-level domain (TLD). This allows the redirection of users to a malicious domain if a similar registerable TLD exists. Additionally, the use of URL-encoded line feeds enables the insertion of arbitrary response headers in the server's HTTP response, a technique known as header injection.

Tobit Laboratories AG TeamDavid's Webbox contains a flaw in its link storing functionality at the endpoint '//ServerClient celink.htm'. The application fails to properly sanitize the request body, which is subsequently appended to the redirect target in the 302 HTTP response. By inserting a line feed, an attacker can manipulate the response headers, leading to HTTP header injection.

Tobit Laboratories AG TeamDavid's Webbox contains a local file inclusion issue within the functionality used to send emails, faxes, and SMS. An authenticated user can attach files to a message by using the `@@attach` command in the `scjob` form field. Although a filter exists to restrict access to the user folder and the David config folder, it can be bypassed using an alternate data stream. This allows the unauthorized download of sensitive information, including the server's private key and access files containing passwords of other users.

Tobit Laboratories AG TeamDavid's Webbox fails to enforce authentication or authorization checks when serving log files. This allows attackers to access sensitive error information and internal application details, which can be used to facilitate further attacks.

Tobit Laboratories AG TeamDavid's Webbox contains a path traversal flaw in the archive creation functionality. This occurs because the archive path is user-controlled and lacks sufficient validation, allowing an attacker to manipulate input to traverse directories. Consequently, folders can be created in arbitrary locations, including sensitive system directories like `C:Windows` or directories belonging to other users.

A memory leak in the Webbox component allows an unauthorized actor to read sensitive information, including user passwords. This occurs when the application responds with memory contents upon accessing the endpoint "/.well-known/mta-sts.". An attacker can retrieve this data by making repeated requests to the endpoint without requiring authentication.

The search functionality of the Webbox component allows unauthenticated users to provide a `pathnameroot` parameter containing Universal Naming Convention (UNC) paths. Because the server does not validate these paths, it attempts to establish outbound connections to arbitrary SMB servers. This behavior can lead to the exposure of NTLM authentication hashes, which attackers may use for credential theft or SMB relay attacks if outbound traffic on port 445 is permitted.

The link storing functionality at the endpoint '//ServerClient celink.htm' accepts a `pathname` parameter that can be set to network locations using UNC paths. The server processes these paths without validation, leading to outbound connection attempts to attacker-controlled SMB servers. This allows attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information, such as NTLM hashes. If outbound connections to port 445 (SMB) are permitted, this can be used for SMB relay or credential theft attacks. This issue can be exploited without authentication.

The Webbox sending functionality for email, fax, and SMS accepts a @@INCLUDE command that can be configured with network locations using UNC paths. The server processes these paths without validation, leading to outbound connection attempts to SMB servers. This allows attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information, such as NTLM hashes. If outbound connections to port 445 (SMB) are permitted, this can be used for SMB relay or credential theft attacks. Exploitation is possible via the `pathname` parameter without authentication.