Summary
HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $_SERVER[‘HTTP_USER_AGENT’] parameter to example_form.ajax.php or example_form.php.
Product
Securimage before 3.6.6
Impact
If exploited, a threat actor would be able to inject arbitrary HTML in the content of an e-mail form submission.
Steps to reproduce
The vulnerable function takes the value of the User-agent parameter and concatenates it directly to the generated message, as can be seen in the code snippet below:
if (sizeof($errors) == 0){
// no errors, send the form
$time = date('r');
$ message = "A message was submitted from the contact form. The following:"
. "Name: $name <br />"
. "Email: $email <br />"
. "URL: $URL <br />"
. "Message: <br />"
. "<pre> $message </pre>"
. "<br /> <br /> IP Address: {$_SERVER['REMOTE_ADDR']} <br />"
. "Time: $time <br />"
. "Browser: {$_SERVER['HTTP_USER_AGENT']} <br />";
}Since the User-agent field of an HTTP Request can be controlled by the user, an attacker can make the following request:
curl https://localhost//example_form.php --user-agent "<h1>Cx Research</h1>" --data "[...]"Expected result
The unsanitized HTML will be accepted and added to the e-mail and later rendered in the victim’s client application (browser or e-mail client)
Remediation
Update Securimage dependency to 3.6.6
Credit
This issue was discovered and reported by Checkmarx Security Researcher @erezyalon (Erez Yalon).
