Collected research

Horde Webmail 5.2.22 Account Takeover via Email

Simon Scannell · Sonar · 22 February 2022

Shows stored XSS in Horde Webmail's OpenOffice attachment preview. An attacker-supplied XML document reaches a wildcard XSLT template that reconstructs arbitrary MathML-namespaced element names, including script; Horde returns the transformed XHTML without post-transform sanitization, enabling account takeover when the attachment is previewed.

Record

Researcher

Simon Scannell

Published by

Sonar

Date

22 February 2022

In the archive

• Collected in the 2022 research round

Tags

• xss
• email
• xml
• sanitizer-bypass
• account-takeover
• attack-chain
• javascript
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Simon Scannell, first published at the original source. Preserved copies are kept so the citation survives its host.