phlyLabs phlyMail Lite 4.03.04 (go param) Open Redirect Vulnerability

Title: phlyLabs phlyMail Lite 4.03.04 (go param) Open Redirect Vulnerability
Advisory ID: ZSL-2013-5123
Type: Local/Remote
Impact: Spoofing
Risk: (2/5)
Release Date: 13.01.2013
Summary
phlyMail offers you an interface in the browser to have access to your emails, contacts, appointments, tasks, files and bookmakrs from anyhwere, where you have internet access. This can be your home, workplace, train station, abroad, offroad, in the woods or your own backyard.
Description
Input passed via the 'go' parameter in 'derefer.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.

--------------------------------------------------------------------------------

/frontend/derefer.php:
----------------------

33: if (!isset($_REQUEST['go'])) exit;
34: $go = preg_replace('!\r|\n|\t!', '', $_REQUEST['go']);
35: if (strlen($go) == 0) exit;
36: if (!preg_match('!^(http://|https://|ftp://)!', $go) && $go{0} != '/') $go = 'http://'.$go;
37:
38: header('Location: '.$go);
39: exit;

--------------------------------------------------------------------------------

Vendor
phlyLabs - http://www.phlymail.com
Affected Version
Lite 4.03.04
Tested On
Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.4
MySQL 5.5.25a
Vendor Status
[23.01.2013] Vendor releases version 4.3.57 to address this issue.
PoC
phlymail_or.txt
Credits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
References
[1] http://cxsecurity.com/issue/WLB-2013010113
[2] http://www.exploit-db.com/exploits/24086/
[3] http://www.securityfocus.com/bid/57303
[4] http://packetstormsecurity.com/files/119527
[5] http://xforce.iss.net/xforce/xfdb/81217
[6] http://www.osvdb.org/show/osvdb/89169
[7] http://www.venustech.com.cn/NewsInfo/124/17961.Html
[8] http://secunia.com/advisories/51828/
[9] http://phlymail.com/en/index/news.html
[10] http://phlymail.com/forum/viewtopic.php?f=20&t=2543&p=14751#p14751
[11] http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-5123
Changelog
[13.01.2013] - Initial release
[14.01.2013] - Added reference [2]
[15.01.2013] - Added reference [3], [4] and [5]
[16.01.2013] - Added reference [6] and [7]
[18.01.2013] - Added reference [8]
[23.01.2013] - Added vendor status and reference [9] and [10]
[04.03.2014] - Added reference [11]
Contact
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk