Cross-site Scripting (XSS) - Stored in modoboa/modoboa

Vulnerability

CVE-2023-0519 is a stored cross-site scripting (XSS) vulnerability in Modoboa, an open-source mail hosting and management platform [3]. The flaw existed in versions prior to 2.0.4 and stemmed from insufficient sanitization of user-controlled input when rendering account names in deletion confirmation dialogs and log entries in the admin interface [1][4].

Exploitation

An attacker with the ability to create or modify account identities could inject malicious JavaScript into the account title field. When an administrator attempted to delete that account, the injected script would be rendered by the browser, executing in the context of the admin session [4]. Additionally, unescaped log messages containing attacker-controlled content could trigger XSS when viewed in the logs panel [4]. No authentication was required to trigger the XSS if the attacker could influence the logged data, though exploitation typically required an authenticated admin user to interact with the vulnerable UI elements.

Impact

Successful exploitation allowed an attacker to execute arbitrary JavaScript in the browser of an authenticated Modoboa administrator. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim administrator within the mail hosting platform [1].

Mitigation

The vulnerability was fixed in Modoboa version 2.0.4 by applying HTML encoding to account names and log messages before rendering them in the browser [4]. Users are strongly advised to upgrade to 2.0.4 or later. There is no evidence of this CVE being listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of this writing.