SSD Advisory – Horde Groupware Unauthorized File Download

[Maor Shwartz <maors () beyondsecurity com>]

SSD Advisory – Horde Groupware Unauthorized File Download

Full report: https://blogs.securiteam.com/index.php/archives/3454
Twitter: @SecuriTeam_SSD
Weibo: SecuriTeam_SSD

Vulnerability Summary
The following advisory describes an unauthorized file download
vulnerability found in Horde Groupware version 5.2.21.

Horde Groupware Webmail Edition is “a free, enterprise ready, browser based
communication suite. Users can read, send and organize email messages and
manage and share calendars, contacts, tasks, notes, files, and bookmarks
with the standards compliant components from the Horde Project. Horde
Groupware Webmail Edition bundles the separately available applications
IMP, Ingo, Kronolith, Turba, Nag, Mnemo, Gollem, and Trean.”

Credit
An independent security researcher, Juan Pablo Lopez Yacubian, has reported
this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure
program.

Vendor response
Horde Groupware was informed of the vulnerability, to which they response
with:
“this has already been reported earlier by someone else, and is already
fixed in the latest Gollem and Horde Groupware releases.

Besides that, it’s not sufficient to have a list of the server’s users, you
also need to exactly know the file name and path that you want to download.
Finally, this only works on certain backends, where Horde alone is
responsible for authentication, i.e. it won’t work with backends that
require explicit authentication.”

--
Thanks
Maor Shwartz
Beyond Security
GPG Key ID: 93CC36E2DE7FF514

Attachment: SSD Advisory – Horde Groupware Unauthorized File Download – SecuriTeam Blogs.pdf
Description:

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/