Axigen WebMail Stored XSS Vulnerability via Message Headers (CVE-Pending)

A stored XSS vulnerability in Axigen WebMail allows a remote attacker to execute arbitrary HTML and JavaScript in the browser of any user who receives a crafted email and opens the folder with conversation view enabled. The injected code runs within the victim's WebMail session and can redirect the user to attacker-controlled pages, make the interface unusable, or access mailbox content.

Details

Affected versions: 
Axigen 10.5.x up to 10.5.68 and 10.6.x up to 10.6.38; fixed starting with 10.6.39 
Axigen 10.7.0; fixed starting with 10.7.1

Vulnerability type: Cross Site Scripting (XSS)

Affected component(s): Axigen WebMail

Prerequisites: The victim must open the folder containing the crafted message in WebMail with conversation view enabled. No authentication or account on the target server is required for the attacker.

Description:

The display-name part of message headers (such as the From header) was not escaped when WebMail rendered the participant list of the conversation view. In addition, the same header values were HTML-decoded on the client before parsing, so an encoded HTML sequence in a display name was turned into real markup in every component that displays the parsed recipient.

An attacker can send a message whose sender display name contains HTML. When a recipient opens the folder in conversation view, the markup is inserted into the message list and the embedded script executes in the recipient's browser, with no further interaction needed.

This vulnerability was confirmed exploited in a production environment, where a compromised local account was used to distribute the crafted message to other users on the same server.