CVE-2026-29965: HSC MailInspector XSS Vulnerability

CVE-2026-29965 Overview

CVE-2026-29965 is a Cross-Site Scripting (XSS) vulnerability affecting HSC MailInspector version 5.3.3-7. The flaw exists in the /police/WarningUrlPage.php endpoint, which fails to properly neutralize user-supplied input that uses alternate or obfuscated JavaScript syntax. An attacker can craft a malicious URL containing encoded script payloads and trick an authenticated user into clicking it. Successful exploitation executes arbitrary JavaScript in the victim's browser session, with the scope changing to other components because the injected content can impact resources beyond the vulnerable application. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Attackers can hijack authenticated sessions, steal cookies, deface mail-inspection dashboards, or pivot to phishing targeted at MailInspector administrators.

Affected Products

• HSC MailInspector 5.3.3-7
• Vendor: HSC Labs (hsclabs:mailinspector)
• Vulnerable endpoint: /police/WarningUrlPage.php

Discovery Timeline

• 2026-05-18 - CVE-2026-29965 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-29965

Vulnerability Analysis

The vulnerability resides in the WarningUrlPage.php script located under the /police/ path of the HSC MailInspector web interface. The endpoint accepts URL parameters and reflects their values back into the rendered HTML response without applying contextual output encoding. While basic XSS filters may strip canonical <script> tags, the filter does not handle alternate or obfuscated JavaScript syntax such as event handlers, encoded attributes, or non-standard tag constructs. Attackers can therefore bypass the filter using payloads that rely on case variation, HTML entity encoding, or attribute-based execution vectors. The injected script runs in the security context of the MailInspector application, granting access to session cookies, CSRF tokens, and any DOM data visible to the victim user.

Root Cause

The root cause is improper input neutralization in the WarningUrlPage.php handler. The application performs incomplete sanitization that only blocks a subset of XSS payloads and does not enforce context-aware output encoding when echoing user-controlled values into the HTML body. This is a classic reflected XSS pattern aligned with CWE-79.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL pointing to /police/WarningUrlPage.php with a parameter containing obfuscated JavaScript and delivers it via phishing email, instant message, or a malicious referrer. When a MailInspector user visits the link, the payload is reflected into the response and executed by the browser. Because the CVSS scope is changed, the impact can extend beyond the vulnerable component to other browser-trusted resources. Refer to the GitHub CVE-2026-29965 XSS Analysis for payload details.

Detection Methods for CVE-2026-29965

Indicators of Compromise

• Web server access logs showing requests to /police/WarningUrlPage.php containing URL-encoded characters such as %3C, %3E, onerror=, onload=, or javascript:.
• Referrer headers originating from untrusted external domains pointing to the MailInspector login or warning pages.
• Anomalous outbound requests from administrator browsers to attacker-controlled domains following a click on a MailInspector URL.

Detection Strategies

• Deploy web application firewall (WAF) rules to flag query parameters on /police/WarningUrlPage.php containing event handler attributes or encoded script syntax.
• Inspect HTTP responses from MailInspector for reflected query-string values rendered without HTML entity encoding.
• Correlate browser telemetry with web proxy logs to identify script execution triggered by reflected payloads.

Monitoring Recommendations

• Enable verbose access logging on the MailInspector web server and forward logs to a centralized analytics platform.
• Alert on repeated 200 OK responses to /police/WarningUrlPage.php with unusually long or encoded query strings.
• Monitor administrator session activity for anomalous session token reuse from new IP addresses or user agents.

How to Mitigate CVE-2026-29965

Immediate Actions Required

• Restrict access to the MailInspector administrative interface to trusted internal networks or VPN users only.
• Deploy a WAF rule that blocks requests to /police/WarningUrlPage.php containing common XSS markers such as onerror, onload, javascript:, and encoded angle brackets.
• Instruct administrators to avoid clicking unsolicited links referencing the MailInspector domain.

Patch Information

No vendor advisory or fixed version has been published at the time of writing. Monitor the HSC Labs MailInspector product page and the GitHub CVE Disclosures Repository for updates and apply patches as soon as they are released.

Workarounds

• Enforce a strict Content Security Policy (CSP) that disallows inline scripts and limits script sources to trusted origins.
• Configure the HttpOnly and Secure flags on session cookies to limit the impact of script-based session theft.
• Place MailInspector behind a reverse proxy that performs input validation and rejects requests containing suspicious encoded payloads in query parameters.