Horde/IMP Plesk webmail exploit

Description
  • The Horde/IMP package (3.1.7-3.3.2) that is shipped with Plesk v. 8.x and earlier versions of 9.x (before 9.5.4) has a vulnerability that allows an attacker to run malicious software by passing the login to the webmail with a POST request to the /horde/imp/redirect.php file that includes the PHP code as the username. For example
    
    
    This results in the PHP code being logged to the /var/log/psa-horde/psa-horde.log file, which, due to a vulnerability in the barcode.php file, allows attackers to cause Horde to execute the code by making this request:
    /horde/util/barcode.php?type=../../../../../../../../../../../var/log/psa-horde/psa-horde.log%00
    
    Plesk versions affected:
    • Parallels Plesk Panel 9.3 for Linux/Unix
    • Parallels Plesk Panel 9.2 for Linux/Unix
    • Parallels Plesk Panel 9.0 for Linux/Unix
    • Parallels Plesk Panel 8.6 for Linux/Unix
    • Parallels Plesk Panel 9.3 for Windows
    • Parallels Plesk Panel 9.2 for Windows
    • Parallels Plesk Panel 9.0 for Windows
    • Parallels Plesk Panel 8.6 for Windows
      Remediation
      • Download and install the appropriate patch for Horde 3.1.7-3.3.2 in accordance with the platform your server runs on.
      References