Cross-site Scripting (XSS) - Stored in modoboa/modoboa

Vulnerability

Overview

CVE-2023-0470 is a stored cross-site scripting (XSS) vulnerability in Modoboa, a mail hosting and management platform, affecting versions prior to 2.0.4. The root cause is insufficient sanitization of user-controlled input when rendering domain names and title attributes in the administration interface. Specifically, the Domains JavaScript prototype directly inserted the title attribute of a delete confirmation link and the domain name into the DOM without HTML encoding [1][3].

Exploitation

Prerequisites

An attacker with the ability to create or modify domains (e.g., a domain administrator) can inject malicious JavaScript into the domain name field or the title attribute. When other administrators or users interact with the affected interface—such as hovering over a delete link or viewing domain details—the injected script executes in their browser session. No additional authentication is required beyond the attacker's existing privileges to manage domains [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, credential theft, defacement, or other actions that the victim can perform within the Modoboa administration panel. The stored nature of the XSS means the payload persists and affects all subsequent visitors to the affected page [1][2].

Mitigation

The vulnerability was fixed in Modoboa version 2.0.4 by introducing an htmlEncode function and applying it to the two vulnerable code paths: the delete confirmation title and the domain name display [3]. Users are strongly advised to upgrade to 2.0.4 or later. No workarounds have been published, and the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.