full-disclosure - [FD] SSD Advisory – Horde Groupware Unauthorized File Download

Open Source and information security mailing list archives

Message-ID: <CAAnZqX-_9h_ofVxANOHLSq6W+Lz=Bm9GGLwSbUjXxK7xCvo42g@mail.gmail.com>
Date: Tue, 3 Oct 2017 15:25:10 +0300
From: Maor Shwartz <maors@...ondsecurity.com>
To: fulldisclosure@...lists.org
Cc: SecuriTeam Secure Disclosure <ssd@...ondsecurity.com>
Subject: [FD] SSD Advisory – Horde Groupware Unauthorized File Download

SSD Advisory – Horde Groupware Unauthorized File Download

Full report: https://blogs.securiteam.com/index.php/archives/3454
Twitter: @SecuriTeam_SSD
Weibo: SecuriTeam_SSD

Vulnerability Summary
The following advisory describes an unauthorized file download
vulnerability found in Horde Groupware version 5.2.21.

Horde Groupware Webmail Edition is “a free, enterprise ready, browser based
communication suite. Users can read, send and organize email messages and
manage and share calendars, contacts, tasks, notes, files, and bookmarks
with the standards compliant components from the Horde Project. Horde
Groupware Webmail Edition bundles the separately available applications
IMP, Ingo, Kronolith, Turba, Nag, Mnemo, Gollem, and Trean.”

Credit
An independent security researcher, Juan Pablo Lopez Yacubian, has reported
this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure
program.

Vendor response
Horde Groupware was informed of the vulnerability, to which they response
with:
“this has already been reported earlier by someone else, and is already
fixed in the latest Gollem and Horde Groupware releases.

Besides that, it’s not sufficient to have a list of the server’s users, you
also need to exactly know the file name and path that you want to download.
Finally, this only works on certain backends, where Horde alone is
responsible for authentication, i.e. it won’t work with backends that
require explicit authentication.”

--
Thanks
Maor Shwartz
Beyond Security
GPG Key ID: 93CC36E2DE7FF514

Download attachment "SSD Advisory – Horde Groupware Unauthorized File Download – SecuriTeam Blogs.pdf" of type "application/pdf" (100311 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives