Cross-site Scripting (XSS) - DOM in modoboa/modoboa

Vulnerability

Description

CVE-2023-5688 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the Modoboa mail hosting management platform. The flaw resides in the profile form's JavaScript code, specifically in how the $form variable is assigned. Prior to version 2.2.2, the code used $("form").first() to select a form element, which could incorrectly select an attacker-controlled form or element, leading to potential execution of malicious scripts [1][4].

Exploitation

The vulnerability is triggered via the profile form, where an attacker can inject malicious JavaScript payloads. Since the XSS is DOM-based, the attack does not require the victim to visit a malicious page but can occur through crafted inputs that modify the DOM environment. The exploit requires user interaction, such as clicking on a malicious link or submitting a crafted form, but no prior authentication is necessary to deliver the payload [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, data theft (including access tokens and sensitive information), and potential full compromise of the user's Modoboa session. The issue affects all users of Modoboa versions before 2.2.2 [1][2].

Mitigation

The vulnerability has been patched in Modoboa version 2.2.2. The fix, introduced in commit d33d3cd2d11dbfebd8162c46e2c2a9873919a967, changes the form selector from $("form").first() to $(e.target).closest("form"), ensuring the correct form is used and preventing the XSS condition [4]. Users are strongly advised to upgrade to the latest version. No workarounds have been documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing [1][3].