Remote Code Execution in Horde Groupware Webmail

CVE-2019-9858

What is CVE-2019-9858?

A vulnerability exists in Horde Groupware Webmail that allows attackers to execute arbitrary code through unsanitized user input during image upload. When files are uploaded via the Horde_Form_Type_image method, the system fails to adequately sanitize the input, enabling an attacker to manipulate the temporary file path. By exploiting this weakness, an attacker can upload malicious PHP scripts, potentially leading to unauthorized access and control over the server. This vulnerability particularly affects versions 5.2.22 and 5.2.17, making it crucial for users to apply the necessary security updates to mitigate risks.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2019-9858
Created by Rapid7

References