attrition.2000-02-21.bigmailbox Thu Feb 10 10:57:57 CST 2000 Vendor: BigMailBox.com Platform: All Attrition's Little Errata Report Team -<) A . L . E . R . T (>- ----------------------------------------------------------------- This advisory reports a recently-discovered security issue. It may contain a workaround or information on where to obtain an appropriate patch. Advisories should be considered urgent as these notices are written only when the likelihood of wide impact is determined by the Attrition staff. An HTML version of this and other advisories can be found at Attrition.Org at http://www.attrition.org/security/ ----------------------------------------------------------------- BigMailBox.com href tokens leave mailboxes open to control by a malicious site AFFECTED SYSTEMS --------------------------------------------------------------------------- - Users of the BigMailBox.com email - Users of freemail systems run by BigMailBox.com STATUS --------------------------------------------------------------------------- BigMailBox.com was notified of the problem on Fri, 11 Feb 2000. After additional testing and verification, staff of BigMailBox.com patched the vulnerability on Mon, 14 Feb 2000. BACKGROUND --------------------------------------------------------------------------- BigMailBox.com (http://www.bigmailbox.com) offers free Web-based email services with the site's domain name. BigMailBox.com also offers individual email accounts through the portal site www.gohip.com (http://www.gohip.com). We were able to find over 100 domains using BigMailBox.com to host their email services, including, Antionline (http://www.antionline.com), Teen Zone (http://www.teenzone.com), Anonymous.to (http://www.anonymous.to), CashPile (http://www.cashpile.com), and TeamsterNet (http://www.teamster.net). As can be seen from this list, most of these are smaller portal sites using free email for repeat traffic. BUG REPORT --------------------------------------------------------------------------- As we browse the web, client programs such as Netscape and Internet Explorer forward a variable from one web server to another based on hyperlinks. This variable is called an HREF. It contains the URL of the site that referred the user to another server. When the web visitor clicks on a hyperlink, the HREF variable is forwarded to the next server, where it appears in the access logs. Looking at a sample entry of an access log: your.machine.com - - [10/Feb/2000:22:34:30 -0700] "GET /index.html HTTP/1.0" 200 48797 "http://remote.site.com/" "Mozilla/4.7 [en] (Win98; I)" This shows that your.machine.com requested a web page "/index.html" on the server, and that you found this link from a web page hosted on remote.site.com. BigMailBox.com uses a session token to manage access to the mail box. This session token tells the system that a user is logged in and accessing mail. When the user logs out, the session token is automatically expired, forcing the user to log in which generates a fresh token. Without logging out, this token defaults to expire one hour after initial login. Unfortunately, this session token is forwarded to a web site via the HREF variable if a link is followed from an email message. With this valid session token, users reading these logs can use the information to log into the BigMailBox.com web email accounts without authentication. Several factors contribute to this being a serious problem. * Many systems keep access logs world readable, so that any system user could glean the session key from the logs. * Because of the standard format of the URL required to access the email, it is trivial to construct a valid URL along with a current session token allowing a third party to view the mail box. * BigMailBox.com's web based mail client automatically converts all URL's into hotlinks to the site. * With the knowledge of the above, a third party can send the user mail with a specific URL, encouraging them to visit a site where the session token could be read. THE ATTACK 1. A potential attacker sends the target a piece of e-mail with a 'bait' URL, in hopes of prompting them to follow the link. For example, sending mail to victim@antionline.org with a URL for them to visit: http://www.myserver.com/visit/me.html 2. BigMailBox receives the e-mail and converts the URL into a clickable hotlink. The victim reads the e-mail and follows the link with a single click. 3. www.myserver.com records the hit to its access_log where the attacker is waiting. The attacker views the HREF of the entry: http://mail12.bigmailbox.com/users/antionlineorg/mail.cgi?act =viewPP=root/&fol=Inbox&mid=s00000006&mn=2&tm=2&st=A&sf =2&un=victim&uid=BVZkfObYaz4BZUXWkxPz2ZAvt Using the HREF, the attacker extracts the e-mail account name designated by "un=" (UserName). In the example above: victim Looking closely at the end of the HREF, the attacker extracts the last field designated by "uid=", which is the current session token. In this example, the session token is: BVZkfObYaz4BZUXWkxPz2ZAvt 4. Using the two fields, the attacker crafts a new URL: http://mail12.bigmailbox.com/users/antionlineorg/go.cgi?act =list&fol=InboxPP=root&un=victim&uid=BVZkfObYaz4BZUXWkxPz2ZAvt Putting this into their own browser, they can bypass the login procedure and access the web based e-mail account unchallenged. >From this point, the attacker wields full control over the account and may do a number of things: * Send mail to anyone as the legitimate user * Read and manipulate any mail already received * Change the default timeout from one hour to three hours * Modify user account information RECOMMENDED ACTIONS --------------------------------------------------------------------------- Never click on a URL sent to you via e-mail to any BigMailBox.com email account. Instead, cut and paste the URL into your browser to visit a site. Contact BigMailBox and complain about shoddy and insecure e-mail access. RANT --------------------------------------------------------------------------- How many times must the security community point out trivial vulnerabilities like this? Worse, that 'security' and 'privacy' oriented sites like AntiOnline and Anonymous.to would utilize such insecure third party servers without testing or auditing them to maintain a reasonable level of security. CREDITS --------------------------------------------------------------------------- ADVISORY: Authored by Munge and Jericho VULNERABILITY: Found by Mcintyre CONTACT INFORMATION --------------------------------------------------------------------------- Questions regarding this advisory or information regarding new advisories and potential vulnerabilities should be directed to ALERT using one of the following methods: E-Mail: alert@attrition.org WWW : http://www.attrition.org/security/attrition.html The ALERT PGP Public Key (PGP v2.6.2, RSA) is available at: [14]http://www.attrition.org/security/advisory/attrition/pubkey.txt