by Tan Chew Keong
Release Date: 09 Feb 2005
Multiple directory traversal vulnerabilities were found in ArGoSoft Mail Server's Webmail that may be exploited
by a logon mail user to upload files to arbitrary directories on the server, retrieve arbitrary files from the server,
access other users' emails, and create/delete arbitrary directories on the server.
ArGoSoft Mail Server
is fully functional SMTP/POP3/Finger (Pro version also has IMAP module) server for Windows 95/98/NT/2000, which will let you turn your computer into the email system. It's very compact, takes about 1-5 Mb of disk space (depending on the version), does not have any specific memory requirements, and what is the most important - it's very easy to use.
ArGoSoft Mail Server Version 188.8.131.52 on English WinXP SP2, Win2K SP4.
a. Directory traversal in email attachment filename allows file upload to arbitrary directories
ArGoSoft Mail Server's Webmail allows a logon mail user to upload file attachments when composing an email. Lack of
input sanitization of the supplied filename allows the user to upload files to arbitrary locations on the server. This
may be exploited by a malicious mail user to upload and replace other users' password file (userdata.rec) with a copy
that has known password, thus allowing him/her to logon as other users.
A sample malicious file upload HTTP request is shown below.
This advisory documents 4 directory traversal vulnerabilities in ArGoSoft Mail Server's Webmail. Exploitation of
these vulnerabilites requires a valid logon account on the Webmail. Please note that although the examples use the forward-slash (../) character for directory traversal, in several cases, using the back-slash character is
also possible (..\).
POST /attachfile HTTP/1.0
Content-Type: multipart/form-data; boundary=---------------------------24242261923581
Content-Disposition: form-data; name="x"
Content-Disposition: form-data; name="y"
Content-Disposition: form-data; name="attfile"; filename="../../test2/userdata.rec"
When the Webmail user is composing an email, all attachments uploaded for that email will be saved in the following temporary
C:\Program Files\ArGo Software Design\Mail Server\_users\_nodomain\username\_tempatt\
A sample listing of this directory is shown below.
b. Directory traversal in _msgatt.rec allows any arbitrary files on the server to be sent as
The server will create the file (_msgatt.rec) in this temporary directory. This file contains the filename of all file
attachments that the user has uploaded while composing the current email. The user can control the contents of this file
by uploading a file attachment with the same filename as this server generated file. The user uploaded copy will replace
the one generated by the server.
By uploading a specially crafted _msgatt.rec containing directory traversal characters, it is possible to cause
the server to send any arbitrary files on the server as attachment to the user. A malicious user may exploit this
vulnerability to email other user's password file (userdata.rec) to himself.
A sample malicious _msgatt.rec file is shown below.
This malicious file, when uploaded as attachment and saved to the temporary directory, will contain two additional
lines of server generated entry as shown below.
Directory of C:\Program Files\ArGo Software Design\Mail Server\_users\_nodomain\test\_tempatt
02/09/2005 08:18p <DIR> .
02/09/2005 08:18p <DIR> ..
02/09/2005 08:17p 90 inbox.msl
02/09/2005 08:18p 167 TESTFILE.txt // file attachment uploaded by user
02/09/2005 08:18p 13 _msgatt.rec
02/09/2005 08:18p 0 _msgbody.rec
02/09/2005 08:18p 136 _msgdata.rec
5 File(s) 406 bytes
To ensure that the email can be sent correctly, the malicious user must "detach" the last two files (i.e. "-" and "_msgatt.rec"). This can be trivially done via the web interface as shown below. Subsequently, when the user retrieves his email
via IMAP, he'll be able to receive test2's userdata.rec file as attachment.
The /msg link allows the Webmail user to view his/her emails. The full URL is
c. Directory traversal in /msg and /delete "Folder" parameter allows reading/deleting of other user's emails
It is possible to view other user's email by using directory traversal characters in the Folder parameter
and specifying a correct UIDL. The UIDL uniquely identifies the email and guessing the UIDL of
another user's email is impractical. However, it possible to obtain a list of the UIDL of another user's emails by
surfing to the following link while logon. Note that inbox.msl only exists if the other user is currently logon. i.e.
The server will create inbox.msl in the every user's temporary directory (see vulnerability b. above) only after he/she has logon.
It is then possible to retrieve the other user's emails using the following link.
Sample contents shown below
The /delete link, which allows the user to delete his/her own emails, is similarly vulnerable.
A sample malicious POST request to /delete is shown below, this will delete mails belonging to user test2.
POST /delete HTTP/1.0
The /folderadd and /folderdelete links allows the Webmail user to create/delete mail folders. It is possible to use
directory traversal characters in the Folder parameter to create/delete directories in arbitrary locations on
the server. A malicious user may exploit this vulnerability to delete other users' entire mail directories, which is effectively the same as removing the users from the system.
The following will totally remove user test2 from the system.
d. Directory traversal in /folderadd and /folderdelete "Folder" parameter allows creating/deleting arbitrary directories on the server
- Upgrade to version v184.108.40.206.
06 Feb 05 - Vulnerability Discovered.
08 Feb 05 - Initial Vendor Notification.
08 Feb 05 - Received Notification from Vendor that Fixed Version was Released.
09 Feb 05 - Public Release.
Overall-in-charge: Tan Chew Keong
For further questions and enquries, email them to the following.