🇰🇷 한글 설명
mailcow: dockerized의 관리자 대시보드 Autodiscover 로그에서 EMailAddress 값이 HTML 이스케이프되지 않아 저장형 XSS 취약점 발생. 인증 없는 공격자가 HTML/JS 페이로드를 포함한 crafted EMailAddress를 제출하면, Redis에 저장되어 관리자가 로그 열람 시 자동 실행됨. 버전 2026-03b에서 수정.
💡 쉬운 설명
An attacker can inject malicious JavaScript code through an email address field in mailcow's Autodiscover feature without needing to log in. When an administrator views the logs, the hidden code runs and could steal their account access or sensitive data.
🇺🇸 원문 (English)
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted EMailAddress containing HTML/JS, the payload is stored in Redis and executed when an admin views the Autodiscover logs. Version 2026-03b fixes the vulnerability.
📍 영향받는 시스템
mailcow: dockerized versions prior to 2026-03b
⚔️ 공격 벡터
Unauthenticated attacker submits crafted EMailAddress with HTML/JS payload via Autodiscover request to trigger stored XSS in admin logs
🛡️ 대응 방법
Upgrade mailcow: dockerized to version 2026-03b or later to apply HTML escaping patches
🔧 검증 코드
If version 2026-03b or later appears in output, vulnerability is patched; absence of output or earlier version indicates vulnerable system
grep -r '2026-03b' /opt/mailcow-dockerized/ 2>/dev/null || docker inspect mailcow-dockerized 2>/dev/null | grep -i version