RSC-SA-2014-0009: Vulnerable SWFUpload in Zarafa

Am 7. September 2014 habe ich entdeckt, dass die standardmäßig vom Zarafa WebAccess mitgelieferte Drittsoftware "SWFUpload", welche eine Flash-Datei namens "swfupload.swf" enthält, die zum einfachen Hochladen von Dateien für E-Mail-Anhänge per "Drag and Drop" vom Desktop in den Browser verwendet wird, für die bereits bekannten Schwachstellen CVE-2012-3414 und CVE-2013-2205 verwundbar ist. Nachfolgend das Security Advisory in englischer Sprache:

Background

Zarafa is a leading European provider of open source groupware and collaboration software. The core product is the Zarafa Collaboration Platform (ZCP), an European open and compatible groupware platform that can be used as a drop-in Microsoft Exchange replacement for e-mail, calendaring, collaboration and tasks (origin: Zarafa company profile).

Description

For accessing e-mails, calendars, contacts and tasks of the groupware platform via the web, Zarafa provides the Zarafa WebAccess as client/frontend. To allow Zarafa users a more easy upload of e-mail attachments using drag and drop from the desktop to the browser an Adobe Flash based third party multi-upload feature was added. But this third party Adobe Flash file is meanwhile known to be vulnerable for multiple XSS flaws.

Analysis

There is no exploitation which would allow unauthenticated remote attackers to gain root access. However, these XSS vulnerabilities in "SWFUpload" may enable attackers to inject client-side scripts into the Zarafa WebAccess to e.g. bypass access controls such as the same origin policy which could lead to information leaks or further attacks might be possible.

Reproducability

Even the following commands could be used to actively exploit and abuse this flaw they are only made public to analyze if the system in question is vulnerable or not. The system is affected if the following command proofs the existence of the file /usr/share/zarafa-webaccess/client/widgets/swfupload/swfupload.swf:

tux:~ # ls -l /usr/share/zarafa-webaccess/client/widgets/swfupload/
total 80
-rw-r--r--. 1 root root 1621 Sep 3 09:56 swfupload.cookies.js
-rw-r--r--. 1 root root 38709 Sep 3 09:56 swfupload.js
-rw-r--r--. 1 root root 3382 Sep 3 09:56 swfupload.queue.js
-rw-r--r--. 1 root root 12787 Sep 3 09:56 swfupload.swf
-rw-r--r--. 1 root root 13738 Sep 3 09:56 swfupload.swfobject.js
tux:~ #

Alternatively the command md5sum can be used to calculate a checksum which can be verified using e.g. the blog article Vulnerable SWF Bundled in 40 Wordpress Plugins if the file is affected or not:

tux:~ # md5sum /usr/share/zarafa-webaccess/client/widgets/swfupload/swfupload.swf
3a1c6cc728dddc258091a601f28a9c12 /usr/share/zarafa-webaccess/client/widgets/swfupload/swfupload.swf
tux:~ #

Workaround

Until a fixed version of the Zarafa WebAccess is available (or for a system where a possible future update can not be applied for different reasons) the following command can be used to replace the vulnerable SWFUpload by the secure SWFUpload fork maintained by WordPress:

tux:~ # wget -q https://github.com/WordPress/secure-swfupload/raw/master/core/Flash/swfupload.swf -O /usr/share/zarafa-webaccess/client/widgets/swfupload/swfupload.swf
tux:~ #

Alternatively the vulnerable SWFUpload can be completely removed using the following commands.

tux:~ # sed -e 's@\(define("ENABLE_MULTI_UPLOAD",\) .*@// Do NOT change, hotfix from RSC-SA-2014-0009 applied\n\t\1 false);@' -i /etc/zarafa/webaccess-ajax/config.php
tux:~ # rm -rf /usr/share/zarafa-webaccess/client/widgets/swfupload/
tux:~ #

Both command sections above are however only treated as a workaround because a possible non-fixed intermediate update of Zarafa WebAccess might reintroduce the vulnerability again.

Solution

As there are fixed releases of the Zarafa WebAccess available, an update is highly recommented over any workaround.

Affected versions

Fixed versions

CVE information

The MITRE Corporation Common Vulnerabilities and Exposures (CVE) number CVE-2012-3414 was assigned on July 16, 2012. The MITRE Corporation Common Vulnerabilities and Exposures (CVE) number CVE-2013-2205 was assigned on February 19, 2013. Currently, the following other identifications are known for this issue:

Disclosure timeline

Credit

Zarafa being affected by this known vulnerability was discovered, analyzed and reported by Robert Scheck.

The vulnerability itself was discovered, analyzed and reported by Nathan Partlan, Neal Poole and Szymon Gruszecki.

Legal notices

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an as is condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.