CVE-2009-1635 in GroupWise
Summary
by MITRE
Multiple cross-site scripting (XSS) vulnerabilities in the WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 allow remote attackers to inject arbitrary web script or HTML via (1) the User.lang parameter to the login page (aka gw/webacc), (2) style expressions in a message that contains an HTML file, or (3) vectors associated with incorrect protection mechanisms against scripting, as demonstrated using whitespace between JavaScript event names and values.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/13/2025
The CVE-2009-1635 vulnerability represents a critical cross-site scripting flaw affecting Novell GroupWise WebAccess component across multiple versions. This vulnerability stems from inadequate input validation and sanitization mechanisms within the web interface, specifically targeting the authentication and message handling processes. The flaw manifests in three distinct attack vectors that collectively demonstrate the severity of the security weakness in the GroupWise web application's protection mechanisms.
The primary vulnerability occurs through the User.lang parameter in the login page which is processed by the gw/webacc endpoint without proper sanitization. Attackers can inject malicious scripts by manipulating this parameter, potentially redirecting users to malicious sites or executing unauthorized commands. The second vector involves style expressions within HTML messages, where the application fails to properly escape or validate HTML content before rendering, allowing attackers to embed malicious JavaScript within message content. The third vector exploits incorrect protection mechanisms that fail to properly handle whitespace characters between JavaScript event names and their values, a technique commonly used to bypass simple input filters and maintain script functionality.
This vulnerability directly maps to CWE-79 which defines Cross-Site Scripting as a weakness where untrusted data is sent to a web browser without proper validation or sanitization. The attack surface is particularly concerning given that GroupWise serves as an enterprise email solution where users frequently interact with web interfaces containing sensitive corporate information. The operational impact includes potential data theft, session hijacking, and unauthorized access to corporate email systems, as attackers can execute malicious scripts in the context of authenticated users' browsers.
The exploitation of these vulnerabilities can result in significant business disruption and data compromise within enterprise environments. Attackers leveraging these XSS flaws can steal user sessions, redirect victims to phishing sites, or inject malicious code that persists across user interactions. The vulnerability affects both GroupWise 7.x versions before 7.03 HP3 and 8.x versions before 8.0 HP2, indicating a widespread issue within the product line. Organizations using these versions face elevated risk of targeted attacks, particularly in environments where users may inadvertently click on malicious links or receive compromised email content.
Security mitigations should focus on implementing comprehensive input validation and output encoding for all user-supplied data, particularly within authentication and message handling components. The recommended approach includes deploying proper HTML sanitization filters, implementing Content Security Policy headers, and ensuring that all parameters passed to web applications undergo strict validation. Organizations should also consider implementing web application firewalls to detect and block suspicious script injection attempts. The vulnerability demonstrates the importance of maintaining up-to-date security patches and implementing defense-in-depth strategies as outlined in the ATT&CK framework's web application attack patterns, particularly focusing on the execution and persistence phases where XSS attacks typically manifest.