Description

Message Center II service (build 6_24) was found vulnerable to SQL Injection attacks. When exploited by an attacker, the identified vulnerability could lead to Information Disclosure (map database structure, extract data from available tables), Denial of Service (consume server resources by injecting SQL heavy queries), etc.

An authenticated attacker without administrative privileges can inject arbitrary code into the SQL query built to generate the list of quarantined/deleted e-mails. This can be achieved by  manipulating  the sort_direction parameter of /junk_quarantine/process and /trash/process resources.

Test case: sort_direction='

             POST https://mc-s200.postini.com/app/msgctr/junk_quarantine/process HTTP/1.1
             Host: mc-s200.postini.com
             ...
             Content-Type: multipart/form-data; boundary=---------------------------26418279386900
             Content-Length: 1351
             -----------------------------26418279386900
             Content-Disposition: form-data; name="_submitted_junk_quarantine_form"
             1
             ...
             -----------------------------26418279386900
             Content-Disposition: form-data; name="range_menu"
             1-14
             -----------------------------26418279386900
             Content-Disposition: form-data; name="sort_menu"
             from_asc
             -----------------------------26418279386900
             Content-Disposition: form-data; name="sort_direction"
             desc'
             -----------------------------26418279386900
             ...

Due to the unsafe inclusion of user provided content into the dynamically built SQ statement, the system returns an error  including details on the database engine used, error type, middleware settings, and SQL error stack trace. Such information allowed devising further SQL Injection test cases.

Affected Versions

Message Center II service of Google Message Security SaaS build 6_24 (January 2010).