Cloudanix VulnDB

CVE-2019-12970

Medium · 6.1

CVSS

6.1

EPSS

1.8%

Published

Jul 1, 2019

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

An old email viewer lets attackers slip hidden code into messages that runs when someone opens them, potentially exposing login details.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Application
Class
XSS
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw bypasses SquirrelMail's HTML sanitization for RCDATA and RAWTEXT elements, allowing malicious JavaScript in HTML email to execute in the application context via elements such as NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA.

Why it matters to the business

Attackers can steal session data or credentials from users viewing email, risking unauthorized access to communications. The issue affects an older product with public exploits available but low and stable exploitation probability, so unpatched instances carry lingering exposure without immediate widespread campaigns.

How an attack unfolds

An attacker creates an HTML email embedding script content inside RCDATA/RAWTEXT-bypassing tags, delivers it to a target, and relies on the victim opening the message in the vulnerable webmail interface so the script runs with application privileges.

How to fix it

Upgrade SquirrelMail beyond versions 1.4.22 and 1.5.2 to a release containing corrected sanitization logic. Where upgrades are unavailable, disable HTML message rendering or migrate users to a supported webmail solution.

How to confirm the fix worked

Confirm the deployed version exceeds the listed vulnerable releases, then test rendering of proof-of-concept messages containing the cited elements to verify script content is neutralized.

Typical attack path

  1. Craft HTML email containing script payload wrapped in NOEMBED, TEXTAREA or similar elements
  2. Send the message to the target mailbox
  3. Victim authenticates and views the message through the SquirrelMail web interface
  4. Browser executes the injected script within the application origin

How to detect it

Inspect web server access logs around email view endpoints for unexpected parameters, and examine stored mail for HTML fragments using the listed bypassing tags. Correlate with any observed session anomalies after email access.

What your security team should do

  • Identify and upgrade all SquirrelMail instances to non-vulnerable releases
  • Temporarily disable HTML email display for remaining at-risk deployments
  • Review incoming mail filters for HTML messages that may trigger similar bypass patterns

The record

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.

Affected packages

Ecosystem Package Introduced Fixed
Debian:8 squirrelmail 0 2:1.4.23~svn20120406-2+deb8u4
Mageia:7 squirrelmail 0 1.4.23-0.svn20201220_0200.1.mga7
Ubuntu:16.04:LTS squirrelmail 0 2:1.4.23~svn20120406-2+deb8u3ubuntu0.16.04.2
Ubuntu:Pro:14.04:LTS squirrelmail 0 2:1.4.23~svn20120406-2+deb8u3ubuntu0.14.04.1~esm1

Related vulnerabilities