Richard Olszynský

Uma restrição inadequada de tentativas excessivas de autenticação permite que invasores não autenticados redefinam senhas de contas. Ao adivinhar repetidamente as respostas de perguntas secretas através do endpoint 'passwordRecoveryCheck', que carece de bloqueio ou limitação de taxa, os invasores podem obter um JWT (JSON Web Token) de recuperação válido. Esse token pode então ser usado para alterar a senha da conta sem as credenciais originais e fazer login através do endpoint 'connect', resultando no controle total da conta para contas que não possuem TOTP (Senha de Uso Único Baseada em Tempo) habilitado.

SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote attackers to replace a victim's contact S/MIME certificate by sending a spoofed multipart/signed message with a mismatched signature and an impersonated From address. Attackers can deliver a crafted CMS signedData object containing their own self-signed certificate, which SOGo's UIxMailView stores on the contact card without validating signature authenticity or certificate identity, enabling subsequent encrypted communications to be decrypted with the attacker's private key.

A ausência de limitação de taxa na verificação de TOTP (Senha de Uso Único Baseada em Tempo) no login web permite que invasores que possuam a senha de uma vítima realizem força bruta no código de segundo fator. Como as tentativas de TOTP malsucedidas não incrementam o contador de logins falhos e a configuração `SOGoMaximumFailedLoginCount` não é aplicada, invasores podem enviar requisições POST repetidas para o endpoint '/SOGo/connect' com códigos incorretos em alta velocidade para burlar a autenticação de dois fatores.

SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed Sieve redirect or discard statements within the notificationAddress preference to bypass the administrator-configured forwarding-domain constraint and redirect or discard incoming mail.

SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can issue concurrent GET requests to the mail view of this account to hold workers indefinitely without an effective timeout, occupying every SOGo worker and denying service to all users for approximately five minutes until the watchdog kills and respawns the stuck workers.

SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.