Richardweinberger

Name of the Vulnerable Software and Affected Versions Bulwark Webmail versions prior to 1.4.11 Description Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server, had an issue in S/MIME signature verification. Before version 1.4.11, the software did not validate the certificate trust chain during signature verification. This meant that emails signed with self-signed or untrusted certificates were incorrectly displayed as having valid signatures. Recommendations Update to version 1.4.11 or later.

Name of the Vulnerable Software and Affected Versions Bulwark Webmail versions prior to 1.4.11 Description Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server, was affected by an issue where the reverse proxy (proxy.ts) incorrectly set the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This allowed cross-site scripting (XSS) attacks to be logged without being blocked. An attacker who could inject script content, such as through crafted email HTML, could execute arbitrary JavaScript in the application's context, potentially leading to session token theft or unauthorized actions performed on behalf of the user. Recommendations Update Bulwark Webmail to version 1.4.11 or later.

Name of the Vulnerable Software and Affected Versions Bulwark Webmail versions prior to 1.4.11 Description Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server, is affected by an issue where the `getClientIP()` function in `lib/admin/session.ts` incorrectly trusts the first entry in the X-Forwarded-For header. This allows attackers to forge their source IP address, potentially bypassing IP-based rate limiting and forging audit log entries. The `X-Forwarded-For` header is fully controlled by the client. Recommendations Update to Bulwark Webmail version 1.4.11 or later.

Name of the Vulnerable Software and Affected Versions Bulwark Webmail versions prior to 1.4.10 Description Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server, previously included a user's plaintext password in the JSON response when accessing the `/api/auth/session` endpoint. This exposed credentials to browser logs, local caches, and network proxies. Recommendations Update Bulwark Webmail to version 1.4.10 or later.

Name of the Vulnerable Software and Affected Versions Bulwark Webmail versions prior to 1.4.10 Description Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server, had a security flaw in the `verifyIdentity()` function. This function incorrectly returned true when no session cookies were present, allowing unauthenticated attackers to bypass security checks. Attackers could access and modify user settings via the `/api/settings` endpoint by providing arbitrary headers. Recommendations Update Bulwark Webmail to version 1.4.10 or later.