Microsoft Outlook Web Access Vulnerability

October 15, 2008; Martin Suess

The vulnerability found targets the Outlook Web Access application for Microsoft Exchange 2003. A valid user can be redirected to a malicious website when clicking on a specially crafted URL which can be sent to the user by email. If the user is logged in, he is redirected instantly - if he is not logged in yet, the login page will be displayed and he will be redirected after successful login. This vulnerability can be used to redirect the user to a phishing website which shows the (faked) login screen and getting the users logon credentials as soon as he tries to log in on the faked site.

Links:	MS OWA - URL Redirection Vulnerability