🇰🇷 한글 설명
EGroupware의 여러 버전에서 CSRF 취약점으로 인해 원격 공격자가 인증된 관리자의 세션을 탈취하여 새로운 관리자 계정 생성이나 시스템 설정 변경을 수행할 수 있다. CVE-2014-2988과 결합하면 임의의 PHP 코드 실행으로 확대될 수 있다.
💡 쉬운 설명
Attackers can trick EGroupware administrators into creating new admin accounts or changing settings by sending specially crafted requests without the admin's knowledge. The application doesn't verify that admin requests come from legitimate sources, allowing these malicious actions to succeed.
🇺🇸 원문 (English)
Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator user via an admin.uiaccounts.add_user action to index.php or (2) modify settings via the newsettings parameter in an admin.uiconfig.index action to index.php. NOTE: vector 2 can be used to execute arbitrary PHP code by leveraging CVE-2014-2988.
📍 영향받는 시스템
EGroupware Enterprise <1.1.20140505, Community Edition <1.8.007.20140506, open source <14.1 beta
⚔️ 공격 벡터
CSRF via admin.uiaccounts.add_user action to create admin users or admin.uiconfig.index action to modify system settings and execute arbitrary PHP code
🛡️ 대응 방법
Upgrade to patched versions (Enterprise 1.1.20140505+, Community 1.8.007.20140506+, open source 14.1+) and implement CSRF token validation
🔧 검증 코드
If version output shows release date before 2014-05-05 (Enterprise), 2014-05-06 (Community), or before 14.1 release, the system is vulnerable
test -f /var/www/html/egroupware/setup/setup-cli.php && grep -E 'version|RELEASE' /var/www/html/egroupware/setup/setup-cli.php 2>/dev/null || echo 'Not found in standard location'