Horde Groupware suffered three critical, high-risk Cross-Site Request Forgery (CSRF) vulnerabilities that High-Tech Bridge identified at the end of September. Although now patched, nearly two months after discovery, the vulnerabilities left customers' data at risk as they can be used in targeted attacks against corporate clients.
An attacker could have gained unauthorised access to information, stored in databases, executed arbitrary commands on the server, compromised the entire application and performed attacks against application users and a company’s infrastructure.
Ilia Kolochenko, CEO of High-Tech Bridge and Chief Architect of ImmuniWeb, stresses the critical risk that millions of corporate webmail systems face while vulnerabilities like Horde's remain unpatched:
"Horde is a very good example as it shows that critical vulnerabilities still exist, even in the most popular web applications, and can have uncommon exploitation vectors or techniques. In this particular case, an CSRF vector is pretty easy to use in combination with spear-phishing and social engineering to compromise the system. Companies that use vulnerable versions of Horde should consider installing patches as soon as possible, otherwise all their corporate email is at a very high risk of compromised."