Alinto SOGo Cross-Site Scripting Vulnerability in Username Parameter

A cross-site scripting (XSS) vulnerability has been identified in Alinto SOGo version 5.12.3. The issue arises in the login functionality, specifically through the 'userName' parameter in POST requests to the '/SOGo/connect' endpoint. When the 'Remember Username' feature is activated, the application sets a cookie that can be exploited to execute injected JavaScript when the user returns to the authentication page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, enable the 'Remember Username' feature in Alinto SOGo. Then, send a POST request to the '/SOGo/connect' endpoint with a 'userName' parameter that includes a base64-encoded XSS payload, such as a script tag injection. The server response will include the encoded script, which is executed when the user revisits the login page.

Remediation

Users can update to Alinto SOGo version 5.12.4, where this vulnerability has been fixed.