Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in forms. When the Horde_Form_Type_image method onSubmit() is called on uploads, it invokes the functions getImage() and _getUpload(), which uses unsanitized user input as a path to save the image. The unsanitized POST parameter object[photo][img][file] is saved in the $upload[img][file] PHP variable, allowing an attacker to manipulate the $tmp_file passed to move_uploaded_file() to save the uploaded file. By setting the parameter to (for example) ../usr/share/horde/static/bd.php, one can write a PHP backdoor inside the web root. The static/ destination folder is a good candidate to drop the backdoor because it is always writable in Horde installations. (The unsanitized POST parameter went probably unnoticed because it's never submitted by the forms, which default to securely using a random path.)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php     contains a vulnerable class that handles image upload in forms. When the Horde_Form_Type_image method     onSubmit() is called on uploads, it invokes the functions getImage() and _getUpload(), which uses     unsanitized user input as a path to save the image. The unsanitized POST parameter     object[photo][img][file] is saved in the $upload[img][file] PHP variable, allowing an attacker to     manipulate the $tmp_file passed to move_uploaded_file() to save the uploaded file. By setting the     parameter to (for example) ../usr/share/horde/static/bd.php, one can write a PHP backdoor inside the web     root. The static/ destination folder is a good candidate to drop the backdoor because it is always     writable in Horde installations. (The unsanitized POST parameter went probably unnoticed because it's     never submitted by the forms, which default to securely using a random path.) (CVE-2019-9858)

Note that Nessus relies on the presence of the package as reported by the vendor.

A path traversal vulnerability due to an unsanitized POST parameter was discovered in php-horde-form, a package providing form rendering, validation, and other functionality for the Horde Application Framework. An attacker can take advantage of this flaw for remote code execution.

The Horde Application Framework contained a remote code execution vulnerability. A remote attacker could use this flaw to use image uploads in forms to install and execute a file in an arbitrary writable location on the server.

For Debian 8 'Jessie', this problem has been fixed in version 2.0.8-2+deb8u1.

We recommend that you upgrade your php-horde-form packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254755	Linux Distros Unpatched Vulnerability : CVE-2019-9858	Nessus	Misc.	high
126127	Debian DSA-4468-1 : php-horde-form - security update	Nessus	Debian Local Security Checks	high
125928	Debian DLA-1822-1 : php-horde-form security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-9858

high

Tenable Plugins

high

high

high