IceWarp Cross-Site Scripting Vulnerability via Email HTML Injection

A cross-site scripting vulnerability has been identified in IceWarp version 11.0.0.0 and in all versions prior to 10.3.4. This vulnerability allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. When the email is viewed, the embedded scripts execute in the client, potentially compromising user sessions and stealing sensitive information.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's email client.

Reproduction

To reproduce this vulnerability, create an email in IceWarp 11.0.0.0 or any version prior to 10.3.4. Embed a base64-encoded payload containing a script into the email using object or embed tags. Once the email is received and viewed, the embedded script will execute, demonstrating the cross-site scripting vulnerability.