Horde Groupware Webmail <= 5.2.22 RCE Vulnerability (Linux)

Horde Groupware Webmail is prone to an authenticated remote code execution vulnerability.

Horde/Form/Type.php contains a vulnerable class that handles image upload in forms. When the Horde_Form_Type_image method onSubmit() is called on uploads, it invokes the functions getImage() and _getUpload(), which uses unsanitized user input as a path to save the image. The unsanitized POST parameter object[photo][img][file] is saved in the $upload[img][file] PHP variable, allowing an attacker to manipulate the $tmp_file passed to move_uploaded_file() to save the uploaded file. By setting the parameter to (for example) ../usr/share/horde/static/bd.php, one can write a PHP backdoor inside the web root. The static/ destination folder is a good candidate to drop the backdoor because it is always writable in Horde installations.

Horde Groupware Webmail version 5.2.22 and prior.

Checks if a vulnerable version is present on the target host.

No known solution is available as of 04th June, 2019. Information regarding this issue will be updated once solution details are available.