Richard Olszynský

An improper restriction of excessive authentication attempts allows unauthenticated attackers to reset account passwords. By repeatedly guessing secret-question answers via the 'passwordRecoveryCheck' endpoint, which lacks lockout or rate limiting, attackers can obtain a valid recovery JWT (JSON Web Token). This token can then be used to change the account password without the original credentials and log in via the 'connect' endpoint, leading to full account takeover for accounts that do not have TOTP (Time-based One-Time Password) enabled.

SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote attackers to replace a victim's contact S/MIME certificate by sending a spoofed multipart/signed message with a mismatched signature and an impersonated From address. Attackers can deliver a crafted CMS signedData object containing their own self-signed certificate, which SOGo's UIxMailView stores on the contact card without validating signature authenticity or certificate identity, enabling subsequent encrypted communications to be decrypted with the attacker's private key.

Missing rate limiting in the web login TOTP (Time-based One-Time Password) verification allows attackers who have a victim's password to brute-force the second-factor code. Because failed TOTP attempts do not increment the failed-login counter and the `SOGoMaximumFailedLoginCount` setting is not applied, attackers can send repeated POST requests to the '/SOGo/connect' endpoint with incorrect codes at high speed to bypass two-factor authentication.

SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed Sieve redirect or discard statements within the notificationAddress preference to bypass the administrator-configured forwarding-domain constraint and redirect or discard incoming mail.

SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can issue concurrent GET requests to the mail view of this account to hold workers indefinitely without an effective timeout, occupying every SOGo worker and denying service to all users for approximately five minutes until the watchdog kills and respawns the stuck workers.

SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.