Dario Weiss

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox application is susceptible to stored cross-site scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. An attacker can exploit this by sending an email containing malicious JavaScript code, which is then executed when a user opens the email. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox application handles password changes via a function triggered by including the string "(editini)" in the file path to write a new password to the "Archive.ini" file. The application fails to verify if the provided path actually refers to an "Archive.ini" file. An unauthenticated attacker can trigger a buffer overflow—a condition where a program writes more data to a block of memory than it can hold—by specifying a file with an excessive size, leading to a server crash and denial of service. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox application contains a buffer overflow issue in the "//serverClient close.html" endpoint. An authenticated attacker can cause a server crash and denial of service by submitting excessively long values in multiple form data parameters. If the stack state allows or a stack canary is disclosed, this could lead to remote code execution and full server compromise. A stack canary is a security value placed in memory to detect buffer overflows before they can be exploited. **Recommendations** Update TeamDavid to a version later than Rollout 524. Restrict access to the "//serverClient close.html" endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox application exposes a functionality that allows the server to be shut down when the '/internalRestart' endpoint is accessed. This endpoint is accessible to unauthenticated users over the public Internet. Instead of performing a restart, the server shuts down completely, allowing a remote attacker to trigger a persistent denial of service. Recovery from this state requires manual administrator intervention to restart the service. **Recommendations** Update TeamDavid to a version later than Rollout 524. Restrict access to the '/internalRestart' endpoint to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox application is susceptible to HTTP header injection via the `cType` URL parameter. The application fails to properly restrict control characters, such as colons or URL-encoded newlines (`%0a`), allowing the modification of the Content-Type header in HTTP responses. This flaw enables attackers to inject additional headers, such as extra Location headers, which can lead to an open redirect. **Recommendations** Update TeamDavid to a version later than Rollout 524. As a temporary mitigation, restrict or sanitize the use of the `cType` parameter in URL requests.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** Tobit Laboratories AG TeamDavid's Webbox contains an open redirect issue. An attacker can craft a URL that redirects the user's browser to an arbitrary third-party site via the `replyUrl` parameter. This can be leveraged for phishing attacks by using a trusted domain link to redirect users to a malicious website. **Recommendations** Update to a version later than Rollout 524. Avoid using the `replyUrl` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox application contains a reflected cross-site scripting (XSS) flaw. An attacker can execute a malicious payload in a victim's browser by sending a specially crafted link. This is achieved by including an arbitrary path, an XSS payload or the `EntryInfo` parameter, and the `!templateName=entryMail` parameter. **Recommendations** Update TeamDavid to a version later than Rollout 524. Avoid using the `EntryInfo` parameter and the `!templateName=entryMail` parameter in the Webbox application until the update is applied.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The send email, fax, and SMS functionality allows for arbitrary file deletion. An attacker can delete any file on the system by specifying an @@COMMENTFILE command within the `scjob` form field. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox component constructs redirect URLs using user-supplied input appended to the redirect target in a 302 HTTP response. An attacker can use URL-encoded characters, such as `%2e` (representing a dot), to manipulate the URL portion following the top-level domain (TLD). This allows the redirection of users to a malicious domain if a similar registerable TLD exists. Additionally, the use of URL-encoded line feeds enables the insertion of arbitrary response headers in the server's HTTP response, a technique known as header injection. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** Tobit Laboratories AG TeamDavid's Webbox contains a flaw in its link storing functionality at the endpoint '//ServerClient celink.htm'. The application fails to properly sanitize the request body, which is subsequently appended to the redirect target in the 302 HTTP response. By inserting a line feed, an attacker can manipulate the response headers, leading to HTTP header injection. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** Tobit Laboratories AG TeamDavid's Webbox contains a local file inclusion issue within the functionality used to send emails, faxes, and SMS. An authenticated user can attach files to a message by using the `@@attach` command in the `scjob` form field. Although a filter exists to restrict access to the user folder and the David config folder, it can be bypassed using an alternate data stream. This allows the unauthorized download of sensitive information, including the server's private key and access files containing passwords of other users. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** Tobit Laboratories AG TeamDavid's Webbox fails to enforce authentication or authorization checks when serving log files. This allows attackers to access sensitive error information and internal application details, which can be used to facilitate further attacks. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** Tobit Laboratories AG TeamDavid's Webbox contains a path traversal flaw in the archive creation functionality. This occurs because the archive path is user-controlled and lacks sufficient validation, allowing an attacker to manipulate input to traverse directories. Consequently, folders can be created in arbitrary locations, including sensitive system directories like `C:Windows` or directories belonging to other users. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** A memory leak in the Webbox component allows an unauthorized actor to read sensitive information, including user passwords. This occurs when the application responds with memory contents upon accessing the endpoint "/.well-known/mta-sts.". An attacker can retrieve this data by making repeated requests to the endpoint without requiring authentication. **Recommendations** Update TeamDavid to a version later than Rollout 524. As a temporary mitigation, restrict access to the "/.well-known/mta-sts." endpoint.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The search functionality of the Webbox component allows unauthenticated users to provide a `pathnameroot` parameter containing Universal Naming Convention (UNC) paths. Because the server does not validate these paths, it attempts to establish outbound connections to arbitrary SMB servers. This behavior can lead to the exposure of NTLM authentication hashes, which attackers may use for credential theft or SMB relay attacks if outbound traffic on port 445 is permitted. **Recommendations** Update TeamDavid to a version later than Rollout 524. Restrict outbound connections on port 445 to prevent the server from connecting to unauthorized SMB endpoints.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The link storing functionality at the endpoint '//ServerClient celink.htm' accepts a `pathname` parameter that can be set to network locations using UNC paths. The server processes these paths without validation, leading to outbound connection attempts to attacker-controlled SMB servers. This allows attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information, such as NTLM hashes. If outbound connections to port 445 (SMB) are permitted, this can be used for SMB relay or credential theft attacks. This issue can be exploited without authentication. **Recommendations** Update to a version later than Rollout 524. Restrict outbound connections to port 445 (SMB) to minimize the risk of credential theft.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox sending functionality for email, fax, and SMS accepts a @@INCLUDE command that can be configured with network locations using UNC paths. The server processes these paths without validation, leading to outbound connection attempts to SMB servers. This allows attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information, such as NTLM hashes. If outbound connections to port 445 (SMB) are permitted, this can be used for SMB relay or credential theft attacks. Exploitation is possible via the `pathname` parameter without authentication. **Recommendations** Update TeamDavid to a version later than Rollout 524. Restrict outbound connections to port 445 (SMB) to minimize the risk of credential theft.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The move archive functionality (`!ArcEntryMove`) in the Webbox component processes the `pathname` parameter without proper validation. This allows an attacker to provide arbitrary paths, including Universal Naming Convention (UNC) paths, which trigger outbound connection attempts to external SMB servers. This behavior can lead to the exposure of NTLM authentication information, such as NTLM hashes, enabling SMB relay or credential theft attacks if outbound connections to port 445 are permitted. This issue can be exploited without authentication. **Recommendations** Update to a version later than Rollout 524. Restrict outbound connections to port 445 (SMB) to minimize the risk of credential theft.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox application allows an unauthenticated attacker to create or modify files on the server using attacker-controlled content. This occurs because user input is written directly to files without adequate validation or restrictions on file types. An attacker can exploit this to create files, such as .htm files, containing malicious JavaScript, which leads to stored cross-site scripting (XSS) when a user accesses the created file. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** SEPPmail Secure Email Gateway versions prior to 15.0.4 **Description** An unauthenticated path traversal issue exists in the '/api.app/attachment/preview' endpoint. This allows remote attackers to read arbitrary local files and trigger the deletion of files within the targeted directory using the privileges of the `api.app` process via the `identifier` parameter. **Recommendations** Update to version 15.0.4 or later. As a temporary workaround, restrict access to the '/api.app/attachment/preview' endpoint or avoid using the `identifier` parameter until the update is applied.