PT-2019-14960 · Egain · Egain Web Email Api

Published 2019-12-13 · Updated 2021-07-21 · CVE-2019-17123

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions eGain Web Email API versions 11 and later

Description The issue allows for spoofed messages due to mishandling of the fromName and message fields in the /system/ws/v11/ss/email API endpoint. This can be demonstrated through fromName header injection using a %0a or %0d character. Additionally, the message parameter can contain initial HTML comment characters.

Recommendations For eGain Web Email API versions 11 and later, consider disabling the /system/ws/v11/ss/email API endpoint until a patch is available to prevent exploitation. Restrict access to the fromName and message fields to minimize the risk of header injection. Avoid using the fromName and message parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2019-17123

Affected Products

Egain Web Email Api

References · 6

• 🔥 https://medium.com/maverislabs/cve-2019-17123-cbc946c99f8 · Exploit
• https://osv.dev/vulnerability/CVE-2019-17123 · Vendor Advisory
• http://egain.com/products/email-management-software · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17123 · Security Note
• https://t.me/canyoupwnme/6187 · Telegram Post
• https://t.me/defcon_news/32969 · Telegram Post