Cross-site Scripting (XSS) - Reflected in modoboa/modoboa

A reflected cross-site scripting (XSS) vulnerability exists in Modoboa versions prior to 2.0.5. The flaw arises from insufficient sanitization of user-supplied input in tag-related functionality, allowing an attacker to inject arbitrary JavaScript code into a web page [2]. The vulnerability is classified as a reflected XSS, meaning the malicious payload is reflected off the web application immediately, typically via a crafted URL or request parameter.

To exploit this vulnerability, an attacker crafts a URL containing a malicious script and tricks a victim into clicking it. The victim must be logged into the Modoboa application for the attacker to gain session access, but the XSS can also execute without authentication, potentially exposing sensitive information. The attack requires no special privileges other than the ability to deliver the malicious link to a user [2][3].

Successful exploitation allows the attacker to execute arbitrary script in the context of the victim's browser within the Modoboa domain. This can lead to session hijacking, cookie theft, defacement, or redirection to malicious sites, compromising user accounts and data confidentiality.

The issue has been addressed in Modoboa version 2.0.5 with a commit that properly escapes tag input [1][3]. Users are strongly advised to upgrade to the latest version to mitigate the risk. No workarounds are known, and the vulnerability is considered important given Modoboa's use as a mail hosting platform [4].