Executive Summary

This vulnerability in Horde Groupware v5.2.22 allows an unauthenticated attacker to determine if a user account exists on the system. By sending an HTTP request to '/imp/attachment.php' with specific parameters ('id' and 'u'), the attacker can observe the server's response: if the user exists, the server returns an empty file download; if not, no download occurs. This behavior reveals valid user accounts without authentication.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing attackers to enumerate valid user accounts on your Horde Groupware system without authentication. This can facilitate further targeted attacks such as phishing, brute force password attempts, or social engineering, potentially compromising user accounts and system security.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending HTTP requests to the '/imp/attachment.php' endpoint with the parameters 'id' and 'u' set to different usernames. If the server responds by initiating a download of an empty file, it indicates that the user exists; if no download occurs, the user does not exist. For example, using curl commands: curl -i 'http://<target>/imp/attachment.php?id=someid&u=validuser' and curl -i 'http://<target>/imp/attachment.php?id=someid&u=invaliduser' to compare responses.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the '/imp/attachment.php' endpoint, implementing authentication to prevent unauthenticated access, and monitoring for suspicious requests targeting this endpoint. Additionally, updating to a patched version of Horde Groupware when available is recommended.

Useful 0 Not Useful 0