MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability via HTML Email Image Tags (CVE-2024-11182)

# Check current MDaemon version
$MDPath = 'C:\MDaemon\App\MDaemon.exe'
if (Test-Path $MDPath) {
    $Version = (Get-Item $MDPath).VersionInfo.ProductVersion
    Write-Host "Current MDaemon Version: $Version"
} else {
    Write-Host 'MDaemon executable not found at default path.' -ForegroundColor Red
}

# Download the patched installer (Run as Administrator)
Invoke-WebRequest -Uri 'https://files.mdaemon.com/mdaemon/beta/md2451c_en.exe' -OutFile '$env:TEMP\md2451c_en.exe'
# Execute silent installation
Start-Process -FilePath '$env:TEMP\md2451c_en.exe' -ArgumentList '/s' -Wait

# Example Nginx configuration for MDaemon Webmail reverse proxy
server {
    listen 443 ssl;
    server_name mail.yourdomain.com;

    # Restrict script execution to self and block inline scripts
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline';" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
    }
}

# Define log directory and search patterns
$LogPath = 'C:\MDaemon\Logs\'
$Pattern = '(<script|onerror|onload|javascript:)'

# Scan WorldClient logs modified in the last 7 days
Get-ChildItem -Path $LogPath -Filter 'WorldClient-*.log' | 
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | 
    ForEach-Object {
        $Results = Select-String -Path $_.FullName -Pattern $Pattern
        if ($Results) {
            Write-Host "[!] Potential XSS payload detected in: $($_.Name)" -ForegroundColor Red
            $Results | Select-Object -First 5 | Format-Table LineNumber, Line
        }
    }