4 ms·

I noticed my e-mail provider also gave me the JS popup when i clicked the SVG attachment. They are using Horde. Possible horde security flaw?

mike-cardwell 14y ago
If the JavaScript executed, it's a "probable" critical security flaw, rather than a "possible" one. Are they using the latest version? Would you be able to submit a bug report to your provider and/or the Horde project? [edit] I have alerted security@horde.org
- rvschuilenburg 14y ago
  I've sent them an e-mail. I will let you know when i know more :)
  - mike-cardwell 14y ago
    Thanks. I am currently discussing the problem with Jan Schneider (the core developer and a founding member of Horde LLC) in the #horde IRC channel on Freenode. [edit] They've confirmed the bug and intend to fix it by making "image/svg+xml" attachments download only. This is the same fix that FastMail used. Of course, everyone will need to upgrade when this has been done.
    - rvschuilenburg 14y ago
      My e-mail provider has fixed this by displaying the attachment as plain text. I guess until they update to the newest horde where it has been fixed.
      - mike-cardwell 14y ago
        That's an impressively fast fix for an e-mail provider. Are you able to disclose who you are using?
        rvschuilenburg 14y ago
        I agree, i was also impressed. It's a Dutch provider, dds.nl
pinko 14y ago
Egads, <webmail software redacted> is also vulnerable (or at least the version deployed by my former employer). Thank you for the detection tool! Edit: redacted vendor.
- mike-cardwell 14y ago
  Thanks for the report. I have just sent a bug report to their security address about this. It would probably be better if people submitted these bugs directly to the vendor rather than making them immediately public. If you don't know how to do this, or how to describe the bug, you can let me know and I will do it on your behalf. My contact details are in my HN profile

mike-cardwell 14y ago

If the JavaScript executed, it's a "probable" critical security flaw, rather than a "possible" one. Are they using the latest version? Would you be able to submit a bug report to your provider and/or the Horde project? [edit] I have alerted security@horde.org

rvschuilenburg 14y ago
I've sent them an e-mail. I will let you know when i know more :)
- mike-cardwell 14y ago
  Thanks. I am currently discussing the problem with Jan Schneider (the core developer and a founding member of Horde LLC) in the #horde IRC channel on Freenode. [edit] They've confirmed the bug and intend to fix it by making "image/svg+xml" attachments download only. This is the same fix that FastMail used. Of course, everyone will need to upgrade when this has been done.
  - rvschuilenburg 14y ago
    My e-mail provider has fixed this by displaying the attachment as plain text. I guess until they update to the newest horde where it has been fixed.
    - mike-cardwell 14y ago
      That's an impressively fast fix for an e-mail provider. Are you able to disclose who you are using?
      - rvschuilenburg 14y ago
        I agree, i was also impressed. It's a Dutch provider, dds.nl

pinko 14y ago

Egads, <webmail software redacted> is also vulnerable (or at least the version deployed by my former employer). Thank you for the detection tool! Edit: redacted vendor.

mike-cardwell 14y ago
Thanks for the report. I have just sent a bug report to their security address about this. It would probably be better if people submitted these bugs directly to the vendor rather than making them immediately public. If you don't know how to do this, or how to describe the bug, you can let me know and I will do it on your behalf. My contact details are in my HN profile