EGroupware Critical RCE: Auth Bypass, Arbitrary File Read/Write Analysis

Vulnerability Overview A critical remote code execution (RCE) vulnerability has been identified in EGroupware. This vulnerability allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability can be exploited without authentication. Affected Versions Affected Versions: - <=26.2.20260216 - <=23.1.20260131 Fixed Versions: - 26.2.20260224 - 23.1.20260224 Remediation Upgrade to the fixed versions: 26.2.20260224 23.1.20260224 Details 1. Insufficient Authorization in Vulnerability Origin: This function attempts to verify that the current user is a teacher of the specified course before allowing file uploads. The critical authorization check ensures that the course access control list (ACL) contains: However, the value of is derived from user-controlled request data. Bypass Technique A crafted request can manipulate the value in the request body: Since the course ACL is extracted from , setting it to 3 allows the check to be bypassed. 2. Arbitrary File Write After bypassing authorization, the function uploads the provided file to a controllable file path. The file path is derived from the (or ) value, enabling path traversal. Due to file permission restrictions (the server runs as ), writable targets are limited. A viable target is . 3. Constraints Writing a simple PHP webshell may not result in immediate execution due to OPcache. An invalid file will break the system and prevent the server from running. Therefore, the valid file structure must be preserved. 4. Arbitrary File Read A second vulnerability allows reading arbitrary files via: The issue lies in: The parameter is user-controlled and used to read arbitrary files. This allows the retrieval of the original content. 5. Achieving Remote Code Execution By combining arbitrary file read (to obtain a valid ) and arbitrary file write (to overwrite it with modified content), an attacker can inject controlled PHP code while maintaining the file's validity. This results in remote code execution after the server restarts or OPcache expires. Another impact includes modifying the administrator settings password to gain full system control. Impact Remote Code Execution Full System Control Arbitrary File Read Arbitrary File Write Potential Complete Takeover of the EGroupware Instance Reporter This discovery was made by Huong Kieu of Cenobe Security (https://cenobe.com).

Goal Reached Thanks to every supporter — we hit 100%!

EGroupware Critical RCE: Auth Bypass, Arbitrary File Read/Write Analysis

More from this source