Software:    Alt-N MDaemon v13.0.3 and prior versions
Vendor:    http://www.altn.com/
Vulnerability Type:    Session ID Prediction
Remote:    Yes
Local:    No
Discovered:    25 July 2012
Reported:    19 December 2012
Disclosed:    18 February 2013
Whitepaper:   Pwning_MDaemon.pdf

VULNERABILITY DESCRIPTION:

Alt-N WorldClient is the web interface of the MDaemon email server. It has been identified that application session state is not maintained by the user's session cookie but by the URL ''Session'' parameter instead. This parameter is transmitted with every user request sent to the WorldClient web application and under certain circumstances future session IDs can be successfully predicted.

The use of predictable session IDs for authentication makes WorldClient prone to session hijacking attacks. If the attacker can generate a current valid session ID then he/she may be able to access webmail accounts without possessing a valid username/password. The impact of the attack is significantly reduced because WorldClient associates the client's IP address with each session ID produced. However, certain network setups or other scenarios may exist that could render the IP restriction ineffective.

Alt-N MDaemon v13.0.3 & v12.5.6 were tested and found vulnerable; other versions may also be affected.

Pre-Requisites:

1) The attacker needs to get a current or expired session ID.
       a) Google Search: ''WorldClient.dll?Session=''
       b) Steal an HTTP request and observe the Referer field
2) The MDaemon service or the machine has not been restarted since the captured session ID was generated (There may be a way to deal with this but further research is needed).

PoC Python Scripts: seed.py & sessionID.py          Supporting Files: Vulnerable Code