IceWarp Mail Server Host Header Injection Vulnerability Allowing JavaScript Execution

A host header injection vulnerability has been identified in IceWarp Mail Server version 11.4.0. This vulnerability allows the execution of arbitrary JavaScript code on page load by modifying the Host header to include a payload. The exploitation requires user interaction with a malicious link, which, once clicked, redirects the user and executes the injected script.

Impact

Exploitation of this vulnerability allows for the injection and execution of malicious JavaScript code in the user's browser, potentially leading to cross-site scripting (XSS) attacks.

Remediation

Users can upgrade to IceWarp Mail Server version 13.0.2 to address this vulnerability.