■■■■□ Zero-Day: A remote code execution vulnerability in the open-source Horde Webmail client can allow to take over servers by sending a specially crafted email.
Researchers from SonarSource discovered a remote code execution vulnerability (CVE-2022-30287) in the open-source Horde Webmail client. Horde Webmail allows users to manage contacts, the flaw could be exploited by an authenticated user of a Horde instance to take over an email server by sending a specially crafted email to a victim.
“The vulnerability can be exploited with a single GET request which can be triggered via Cross-Site-Request-Forgery. For this, an attacker can craft a malicious email and include an external image that when rendered exploits the vulnerability without further interaction of a victim: the only requirement is to have a victim open the malicious email.” reads the advisory published by SonarSource.
https://blog.sonarsource.com/horde-webmail-rce-via-email/
https://t.me/cKure/11418