A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the att_local_name field in Deliver.class.php.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squirrelmail: Insufficient escaping of user-supplied data (CVE-2017-7692)

  - SquirrelMail: Directory traversal flaw in Deliver.class.php can allow a remote attacker to retrieve or     delete arbitrary files (CVE-2018-8741)

  - The mail message display page in SquirrelMail through 1.4.22 has XSS via a <svg><a xlink:href= attack.
    (CVE-2018-14950)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Florian Grunow and Birk Kauer of ERNW discovered a path traversal vulnerability in SquirrelMail, a webmail application, allowing an authenticated remote attacker to retrieve or delete arbitrary files via mail attachment.

For Debian 7 'Wheezy', these problems have been fixed in version 2:1.4.23~svn20120406-2+deb7u2.

We recommend that you upgrade your squirrelmail packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Florian Grunow and Birk Kauer of ERNW discovered a path traversal vulnerability in SquirrelMail, a webmail application, allowing an authenticated remote attacker to retrieve or delete arbitrary files via mail attachment.

Florian Grunow reports :

An attacker able to exploit this vulnerability can extract files of the server the application is running on. This may include configuration files, log files and additionally all files that are readable for all users on the system. This issue is post-authentication. That means an attacker would need valid credentials for the application to log in or needs to exploit an additional vulnerability of which we are not aware of at this point of time.

An attacker would also be able to delete files on the system, if the user running the application has the rights to do so.

Does this issue affect me?

Likely yes, if you are using Squirrelmail. We checked the latest development version, which is 1.5.2-svn and the latest version available for download at this point of time, 1.4.22. Both contain the vulnerable code.

ID	Name	Product	Family	Severity
199622	RHEL 5 : squirrelmail (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
109062	Debian DLA-1344-1 : squirrelmail security update	Nessus	Debian Local Security Checks	high
108905	Debian DSA-4168-1 : squirrelmail - security update	Nessus	Debian Local Security Checks	high
108476	FreeBSD : SquirrelMail -- post-authentication access privileges (928d5c59-2a5a-11e8-a712-0025908740c2)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-8741

high

Tenable Plugins

high

high

high

high