CVE-2009-5097

Vulnerability

Palm Pre WebOS versions 1.1 and earlier [1][2] process and execute JavaScript contained within email messages. This design flaw allows a remote attacker to inject arbitrary JavaScript code into a specially crafted email, which is automatically executed when the email is viewed on the device. Affected versions include all WebOS builds up to and including 1.1; the vulnerability is fixed in WebOS 1.2 [2].

Exploitation

An attacker only needs the ability to send an email to the victim's Palm Pre device [2]. No additional authentication, user interaction beyond viewing the email, or special network position is required. The attacker crafts an email containing malicious JavaScript that, when parsed and executed by the device's email client, can read the contents of any file on the filesystem (e.g., PalmDatabase.db3) and exfiltrate that data to an attacker-controlled web server [2]. A proof-of-concept email uses JavaScript to upload the targeted file to a remote server automatically [2].

Impact

Successful exploitation results in arbitrary file disclosure from the Palm Pre device [1][2]. The attacker gains access to sensitive information stored in the PalmDatabase.db3 file, which includes emails, email addresses, contact names, phone numbers, and other personal data [2]. The impact is limited to confidentiality loss; there is no direct indication of code execution or privilege escalation beyond file reading.

Mitigation

Palm released WebOS version 1.2, which patches this vulnerability [2]. All users are recommended to upgrade to WebOS 1.2 or later. If the device cannot be upgraded, no other official workaround has been published by the vendor [1][2]. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.