Cross-site Scripting (XSS) - DOM in modoboa/modoboa

Vulnerability

Overview CVE-2023-5689 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Modoboa, a mail hosting management platform, affecting versions prior to 2.2.2. The issue lies in the TwocolsNav component's event handler, which used $("form").first() to select the form for submission. This allowed an attacker to inject a malicious form element that could be processed instead of the legitimate one, leading to arbitrary JavaScript execution [1].

Exploitation

An attacker could exploit this vulnerability by crafting a form with malicious attributes or content that, when the update action is triggered, executes attacker-controlled scripts in the context of the affected user's session. The attack requires some level of access, such as a user with profile editing capabilities, or could be combined with other vectors like clickjacking or social engineering [4].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to theft of session cookies, data exfiltration, or further compromise of the modoboa instance [2].

Mitigation

The vulnerability was fixed in commit d33d3cd2, which changed the form selector to use $(e.target).closest("form") to ensure only the intended form is processed. Users should upgrade to Modoboa version 2.2.2 or later to remediate the issue [4].